alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: CVE similar to CVE-2015-5790
Matching passage: CVE-2015-5790. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Near-miss passage: CVE-2015-2493. CWE: CWE-119. CVSS: 9.300000190734863. The (1) VBScript and (2) JScript engines in Microsoft Internet Explorer 8 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability."
Query: containment actions for Lateral movement indicators for Web Shell
Matching passage: Playbook for T1505.003 Web Shell. 1) Validate alert telemetry against T1505.003. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: persistence. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.(Citation: volexity_0day_sop
Near-miss passage: Playbook for T1505.004 IIS Components. Different response path focused on persistence.
Query: CVE similar to CVE-2015-7758
Matching passage: CVE-2015-7758. CWE: CWE-59. CVSS: 3.299999952316284. Gummi 0.6.5 allows local users to write to arbitrary files via a symlink attack on a temporary dot file that uses the name of an existing file and a (1) .aux, (2) .log, (3) .out, (4) .pdf, or (5) .toc extension for the file name, as demonstrated by .thesis.tex.aux.
Near-miss passage: CVE-2015-7724. CWE: CWE-59. CVSS: 7.800000190734863. AMD fglrx-driver before 15.9 allows local users to gain privileges via a symlink attack. NOTE: This vulnerability exists due to an incomplete fix for CVE-2015-7723.
Query: CVE similar to CVE-2015-2406
Matching passage: CVE-2015-2406. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2385, CVE-2015-2390, CVE-2015-2397, CVE-2015-2404, and CVE-2015-2422.
Near-miss passage: CVE-2015-3667. CWE: CWE-119. CVSS: 6.800000190734863. QT Media Foundation in Apple QuickTime before 7.7.7, as used in OS X before 10.10.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, a different vulnerability than CVE-2015-3661, CVE-2015-3662, CVE-2015-3663, CVE-2015-3666, and CVE-2015-3668.
Query: explain CWE-1393
Matching passage: CWE-1393 Use of Default Password. The product uses default passwords for potentially critical functionality.
Near-miss passage: CWE-1177 Use of Prohibited Code. The product uses a function, library, or third party component that has been explicitly prohibited, whether by the developer or the customer.
Query: write Sigma for Detects the deletion of the event log files which may indicate an attempt to destroy forensic evidence
Matching passage: Sigma rule: Detects the deletion of the event log files which may indicate an attempt to destroy forensic evidence. Logsource: windows / file_delete. Rule: title: EventLog EVTX File Deleted id: 63c779ba-f638-40a0-a593-ddd45e8b1ddc status: test description: Detects the deletion of the event log files which may indicate an attempt to destroy forensic evidence references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-15 tags: - attack.stealth - attack.t1070 logsource: category: file_delete product: windows detection: selection: TargetFilename|startswith: C:\Windows\System32\winevt\Logs\ TargetFilename|endswith: .evtx condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection.. Logsource: windows / process_creation. Rule: title: Suspicious Child Process Of SQL Server id: 869b9ca7-9ea2-4a5a-8325-e80e62f75445 related: - id: 344482e4-a477-436c-aa70-7536d18a48c7 type: obsolete status: test description: Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection. references: - Internal Research author: FPT.EagleEye Team, wagga date: 2020-12-11 modified: 2023-05-04 tags: - attack.t1505.003 - attack.t1190 - attack.initial-access - attack.persistence - attack.privilege-escalation logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \sqlservr.exe Image|endswith: - \bash.exe - \bitsadmin.exe - \cmd.exe - \netstat.exe - \nltest.exe - \ping.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \sh.exe - \systeminfo.exe - \tasklist.exe - \wsl.exe filter_optional_datev: ParentImage|startswith: C:\Program Files\Microsoft SQL Server\ ParentImage|endswith: DATEV_DBENGINE\MSSQL\Binn\sqlservr.exe Image: C:\Windows\System32\cmd.exe CommandLine|startswith: '"C:\Windows\system32\cmd.exe" ' condition: selection and not 1 of filter_optional_* level: high
Query: patch priority for CVE-2015-5009
Matching passage: CVE-2015-5009. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in IBM WebSphere Commerce 6.0 through FP11, 6.0 Feature Pack 4, 7.0 through FP9, 7.0 Feature Pack 5 through 8, and 8.0 before 8.0.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-6529. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in phpipam 1.1.010 allow remote attackers to inject arbitrary web script or HTML via the (1) section parameter to site/error.php or (2) ip parameter to site/tools/searchResults.php.
Query: patch priority for CVE-2015-2958
Matching passage: CVE-2015-2958. CWE: CWE-264. CVSS: 6.400000095367432. Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to bypass intended access restrictions and modify settings via unspecified vectors, a different vulnerability than CVE-2015-2952 and CVE-2015-2953.
Near-miss passage: CVE-2015-0801. CWE: CWE-264. CVSS: 7.5. Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving anchor navigation, a similar issue to CVE-2015-0818.
Query: rule covering Detects the execution of Microsoft Quick Assist tool "QuickAssist.exe". This utility can be used by attackers to gain re
Matching passage: Sigma rule: Detects the execution of Microsoft Quick Assist tool "QuickAssist.exe". This utility can be used by attackers to gain re. Logsource: windows / process_creation. Rule: title: QuickAssist Execution id: e20b5b14-ce93-4230-88af-981983ef6e74 status: experimental description: 'Detects the execution of Microsoft Quick Assist tool "QuickAssist.exe". This utility can be used by attackers to gain remote access. ' references: - https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/ - https://www.linkedin.com/posts/kevin-beaumont-security_ive-been-assisting-a-few-orgs-hit-with-successful-activity-7268055739116445701-xxjZ/ - https://x.com/cyb3rops/status/1862406110365245506 - https://learn.microsoft.com/en-us/windows/client-management/client-tools/quick-assist author: Muhammad Faisal (@faisalusuf) date: 2024-12-19 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: windows detection: selection: Image|endswith: \QuickAssist.exe condition: selection falsepositives: - Legitimate use of Quick Assist in the environment. level: low
Near-miss passage: Sigma rule: The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows. Logsource: windows / process_creation. Rule: title: Arbitrary Shell Command Execution Via Settingcontent-Ms id: 24de4f3b-804c-4165-b442-5a06a2302c7e status: test description: The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. These files are simply XML and contain paths to various Windows 10 settings binaries. references: - https://posts.specterops.io/the-tale-of-settingcontent-ms-files-f1ea253e4d39 author: Sreeman date: 2020-03-13 modified: 2022-04-14 tags: - attack.t1204 - attack.t1566.001 - attack.execution - attack.initial-access logsource: category: process_creation product: windows detection: selection: CommandLine|contains: .SettingContent-ms filter: CommandLine|contains: immersivecontrolpanel condition: selection and not filter falsepositives: - Unknown level: medium
Query: CVE similar to CVE-2015-8898
Matching passage: CVE-2015-8898. CWE: CWE-476. CVSS: 5.5. The WriteImages function in magick/constitute.c in ImageMagick before 6.9.2-4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted image file.
Near-miss passage: CVE-2015-8270. CWE: CWE-476. CVSS: 7.5. The AMF3ReadString function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to cause a denial of service (invalid pointer dereference and process crash).
Query: patch priority for CVE-2015-5041
Matching passage: CVE-2015-5041. CWE: CWE-200. CVSS: 9.100000381469727. The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20, 7 before SR9 FP30, and 7 R1 before SR3 FP30 allows remote attackers to obtain sensitive information or inject data by invoking non-public interface methods.
Near-miss passage: CVE-2015-1883. CWE: CWE-200. CVSS: 4.0. IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote authenticated users to read certain administrative files via crafted use of an automated-maintenance policy stored procedure.
Query: vulnerability: The Apple Pay component in Apple iOS before 9 allows remote terminals to obtain sensitive recent-transaction information during payments by leveraging the transaction-log feature.
Matching passage: CVE-2015-5916. CWE: CWE-200. CVSS: 4.300000190734863. The Apple Pay component in Apple iOS before 9 allows remote terminals to obtain sensitive recent-transaction information during payments by leveraging the transaction-log feature.
Near-miss passage: CVE-2015-3912. CWE: CWE-200. CVSS: 5.0. Huawei E355s Mobile WiFi with firmware before 22.158.45.02.625 and WEBUI before 13.100.04.01.625 allows remote attackers to obtain sensitive configuration information by sniffing the network or sending unspecified commands.
Query: alert when Detects well-known credential dumping tools execution via service execution events
Matching passage: Sigma rule: Detects well-known credential dumping tools execution via service execution events. Logsource: windows / system. Rule: title: Credential Dumping Tools Service Execution - System id: 4976aa50-8f41-45c6-8b15-ab3fc10e79ed status: test description: Detects well-known credential dumping tools execution via service execution events references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment author: Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community date: 2017-03-05 modified: 2022-11-29 tags: - attack.credential-access - attack.execution - attack.t1003.001 - attack.t1003.002 - attack.t1003.004 - attack.t1003.005 - attack.t1003.006 - attack.t1569.002 - attack.s0005 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ImagePath|contains: - cachedump - dumpsvc - fgexec - gsecdump - mimidrv - pwdump - servpw condition: selection falsepositives: - Legitimate Administrator using credential dumping tool for password recovery level: high
Near-miss passage: Sigma rule: Detects failed attempts to clear Windows event logs via the WMI NTEventLogFile ClearEventLog method. Event 5858 in the W. Logsource: windows / wmi. Rule: title: Failed Event Log Clear Via WMI NTEventLogFile ClearEventLog id: d4f1a2b3-7c8e-4d5f-b6a9-1e0c2d3f4e5b status: test description: 'Detects failed attempts to clear Windows event logs via the WMI NTEventLogFile ClearEventLog method. Event 5858 in the WMI-Activity operational log is an error event, meaning it is only generated when the WMI operation encounters an error (e.g. access denied, provider failure). It could be an indication of an attacker attempting to clear event logs via WMI, but failing due to insufficient privileges or other issues. Successful clearing operations will NOT produce this event; for those, correlate with Security event 1102 or System event 104. ' references: - https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/cleareventlog-method-in-class-win32-nteventlogfile author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-07-01 tags: - attack.defense-impairment - attack.t1685.005 logsource: product: windows service: wmi detection: selection: EventID: 5858 Operation|contains|all: - Win32_NTEventlogFile - cleareventlog condition: selection falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/builtin/wmi/win_wmi_activity_nteventlogfile_cleareventlog/info.yml
Query: risk of Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 allows remote
Matching passage: CVE-2015-2787. CWE: UNKNOWN. CVSS: 7.5. Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages use of the unset function within an __wakeup function, a related issue to CVE-2015-0231.
Near-miss passage: CVE-2015-5432. CWE: UNKNOWN. CVSS: 7.5. HP Virtual Connect Enterprise Manager (VCEM) SDK before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote attackers to obtain sensitive information or modify data via unspecified vectors.
Query: patch priority for CVE-2015-9394
Matching passage: CVE-2015-9394. CWE: CWE-352. CVSS: 8.800000190734863. The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=package_add_new to wp-admin/admin-ajax.php.
Near-miss passage: CVE-2015-1424. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Gecko CMS 2.2 and 2.3 allows remote attackers to hijack the authentication of administrators for requests that add an administrator user via a newuser request to admin/index.php.
Query: detect Detects the import of a alternate datastream to the registry with regedit.exe. in logs
Matching passage: Sigma rule: Detects the import of a alternate datastream to the registry with regedit.exe.. Logsource: windows / process_creation. Rule: title: Imports Registry Key From an ADS id: 0b80ade5-6997-4b1d-99a1-71701778ea61 related: - id: 73bba97f-a82d-42ce-b315-9182e76c57b1 type: similar status: test description: Detects the import of a alternate datastream to the registry with regedit.exe. references: - https://lolbas-project.github.io/lolbas/Binaries/Regedit/ - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f author: Oddvar Moe, Sander Wiebing, oscd.community date: 2020-10-12 modified: 2024-03-13 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \regedit.exe - OriginalFileName: REGEDIT.EXE selection_cli: CommandLine|contains: - ' /i ' - .reg CommandLine|re: :[^ \\] filter: CommandLine|contains|windash: - ' -e ' - ' -a ' - ' -c ' condition: all of selection_* and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Identifies when a application security group is modified or deleted.. Logsource: azure / activitylogs. Rule: title: Azure Application Security Group Modified or Deleted id: 835747f1-9329-40b5-9cc3-97d465754ce6 status: test description: Identifies when a application security group is modified or deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer date: 2021-08-16 modified: 2022-08-23 tags: - attack.impact logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.NETWORK/APPLICATIONSECURITYGROUPS/WRITE - MICROSOFT.NETWORK/APPLICATIONSECURITYGROUPS/DELETE condition: selection falsepositives: - Application security group being modified or deleted may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Application security group modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: describe CVE-2015-6303
Matching passage: CVE-2015-6303. CWE: CWE-200. CVSS: 4.300000190734863. The Cisco Spark application 2015-07-04 for mobile operating systems does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, aka Bug IDs CSCut36742 and CSCut36844.
Near-miss passage: CVE-2015-2935. CWE: CWE-200. CVSS: 5.0. MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to bypass the SVG filtering and obtain sensitive user information via a mixed case @import in a style element in an SVG file, as demonstrated by "@imporT."
Query: patch priority for CVE-2015-5020
Matching passage: CVE-2015-5020. CWE: CWE-264. CVSS: 4.300000190734863. The Big SQL component in IBM InfoSphere BigInsights 3.0, 3.0.0.1, 3.0.0.2, and 4.0 allows remote authenticated users to bypass intended access restrictions and truncate arbitrary tables via unspecified vectors.
Near-miss passage: CVE-2015-0162. CWE: CWE-264. CVSS: 7.0. IBM Security SiteProtector System 3.0, 3.1, and 3.1.1 allows local users to gain privileges.
Query: CVE similar to CVE-2015-4185
Matching passage: CVE-2015-4185. CWE: CWE-264. CVSS: 6.900000095367432. The TCL interpreter in Cisco IOS 15.2 does not properly maintain the vty state, which allows local users to gain privileges by starting a session very soon after a TCL script execution, aka Bug ID CSCuq24202.
Near-miss passage: CVE-2015-1155. CWE: CWE-264. CVSS: 4.300000190734863. The history implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to bypass the Same Origin Policy and read arbitrary files via a crafted web site.
Query: Persistence mechanism resembling Web Protocols
Matching passage: T1071.001 Web Protocols. Tactics: command and control. Description: Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as HTTP/S(Citation: CrowdStrike Putter Panda) and WebSocket(Citation: Brazking-Websockets) that carry web traffic may be very common in environments. HTTP/S packets have many fields and headers in which data can be concealed. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.
Near-miss passage: T1071.004 DNS. Tactics: command and control. Description: Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. The DNS protocol serves an administrative function in computer networking and thus may be very common in environments. DNS traffic may also be allowed even before network authentication is completed. DNS packets contain many fields and headers in which data can be concealed. Often known as DNS tunneling, adversaries may abuse DNS to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.(Citation: PAN DNS Tunneling)(Citation: Medium DnsTunneling) DNS beaconing may be used to send commands to remote systems via DNS queries. A DNS beacon is created by tunneling DNS traffic (i.e. [Protocol Tunneling](https://attack.mitre.org/techniques/T1572)). The commands may be embedded into different DNS records, for example, TXT or A records.(Citation: OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government) DNS beacons may be difficult to detect because the beacons infrequently communicate with infected devices.(Citation: DNS Beacons) Infrequent communication conceals the malicious DNS traffic with normal DNS traffic.
Query: describe CVE-2015-3241
Matching passage: CVE-2015-3241. CWE: CWE-399. CVSS: 6.800000190734863. OpenStack Compute (nova) 2015.1 through 2015.1.1, 2014.2.3, and earlier does not stop the migration process when the instance is deleted, which allows remote authenticated users to cause a denial of service (disk, network, and other resource consumption) by resizing and then deleting an instance.
Near-miss passage: CVE-2015-0775. CWE: CWE-399. CVSS: 5.0. The banner (aka MOTD) implementation in Cisco NX-OS 4.1(2)E1(1f) on Nexus 4000 devices, 5.2(1)SV3(2.1) on Nexus 1000V devices, 6.0(2)N2(2) on Nexus 5000 devices, 6.2(11) on MDS 9000 devices, 6.2(12) on Nexus 7000 devices, 7.0(3) on Nexus 9000 devices, and 7.2(0)ZN(99.67) on Nexus 3000 devices allows remote attackers to cause a denial of service (login process reset) via an unspecified terminal-session request during TELNET session setup, aka Bug IDs CSCuo10554, CSCuu75466, CSCuu75471, CSCuu75484, CSCuu75498, CSCuu77170, and CSCuu77182.
Query: describe CVE-2015-7489
Matching passage: CVE-2015-7489. CWE: CWE-264. CVSS: 7.800000190734863. IBM SPSS Statistics 22.0.0.2 before IF10 and 23.0.0.2 before IF7 uses weak permissions (Everyone: Write) for Python scripts, which allows local users to gain privileges by modifying a script.
Near-miss passage: CVE-2015-1644. CWE: CWE-264. CVSS: 7.199999809265137. Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do not properly constrain impersonation levels, which allows local users to gain privileges via a crafted application, aka "Windows MS-DOS Device Name Vulnerability."