alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before
Matching passage: CVE-2015-3090. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3078, CVE-2015-3089, and CVE-2015-3093.
Near-miss passage: CVE-2015-2726. CWE: CWE-119. CVSS: 10.0. Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Query: patch priority for CVE-2015-0428
Matching passage: CVE-2015-0428. CWE: UNKNOWN. CVSS: 4.900000095367432. Unspecified vulnerability in Oracle Sun Solaris 10 and 11 allows local users to affect availability via unknown vectors related to Resource Control.
Near-miss passage: CVE-2015-0488. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and JRockit R28.3.5, allows remote attackers to affect availability via vectors related to JSSE.
Query: common weakness: Generation of Incorrect Security Tokens
Matching passage: CWE-1270 Generation of Incorrect Security Tokens. The product implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens generated in the system are incorrect.
Near-miss passage: CWE-805 Buffer Access with Incorrect Length Value. The product uses a sequential operation to read or write a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer.
Query: describe CVE-2015-9392
Matching passage: CVE-2015-9392. CWE: CWE-79. CVSS: 5.400000095367432. The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_name parameter.
Near-miss passage: CVE-2015-6528. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in install_classic.php in Coppermine Photo Gallery (CPG) 1.5.36 allow remote attackers to inject arbitrary web script or HTML via the (1) admin_username, (2) admin_password, (3) admin_email, (4) dbserver, (5) dbname, (6) dbuser, (7) dbpass, (8) table_prefix, or (9) impath parameter.
Query: detect Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools in logs
Matching passage: Sigma rule: Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools. Logsource: windows / process_creation. Rule: title: Sticky Key Like Backdoor Execution id: 2fdefcb3-dbda-401e-ae23-f0db027628bc related: - id: baca5663-583c-45f9-b5dc-ea96a22ce542 type: derived status: test description: Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen references: - https://learn.microsoft.com/en-us/archive/blogs/jonathantrull/detecting-sticky-key-backdoors author: Florian Roth (Nextron Systems), @twjackomo, Jonhnathan Ribeiro, oscd.community date: 2018-03-15 modified: 2023-03-07 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.008 - car.2014-11-003 - car.2014-11-008 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \winlogon.exe Image|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe - \wt.exe CommandLine|contains: - sethc.exe - utilman.exe - osk.exe - Magnify.exe - Narrator.exe - DisplaySwitch.exe condition: selection falsepositives: - Unlikely level: critical
Near-miss passage: Sigma rule: Identifies when an EKS cluster is created or deleted.. Logsource: aws / cloudtrail. Rule: title: AWS EKS Cluster Created or Deleted id: 33d50d03-20ec-4b74-a74e-1e65a38af1c0 status: test description: Identifies when an EKS cluster is created or deleted. references: - https://any-api.com/amazonaws_com/eks/docs/API_Description author: Austin Songer date: 2021-08-16 modified: 2022-10-09 tags: - attack.impact - attack.t1485 logsource: product: aws service: cloudtrail detection: selection: eventSource: eks.amazonaws.com eventName: - CreateCluster - DeleteCluster condition: selection falsepositives: - EKS Cluster being created or deleted may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - EKS Cluster created or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: low
Query: patch priority for CVE-2015-8414
Matching passage: CVE-2015-8414. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Near-miss passage: CVE-2015-0491. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and Java FX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2015-0459.
Query: CVE similar to CVE-2015-3630
Matching passage: CVE-2015-3630. CWE: CWE-264. CVSS: 7.199999809265137. Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows local users to modify the host, obtain sensitive information, and perform protocol downgrade attacks via a crafted image.
Near-miss passage: CVE-2015-6384. CWE: CWE-264. CVSS: 4.300000190734863. The Cisco WebEx Meetings application before 8.5.1 for Android improperly initializes custom application permissions, which allows attackers to bypass intended access restrictions via a crafted application, aka Bug ID CSCuw86442.
Query: alert when ForceV1 asks for information directly from the kernel space. Conhost connects to the console application. High Integrity
Matching passage: Sigma rule: ForceV1 asks for information directly from the kernel space. Conhost connects to the console application. High Integrity. Logsource: windows / process_creation. Rule: title: Suspicious High IntegrityLevel Conhost Legacy Option id: 3037d961-21e9-4732-b27a-637bcc7bf539 status: test description: ForceV1 asks for information directly from the kernel space. Conhost connects to the console application. High IntegrityLevel means the process is running with elevated privileges, such as an Administrator context. references: - https://cybercryptosec.medium.com/covid-19-cyber-infection-c615ead7c29 - https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/ - https://learn.microsoft.com/en-us/windows/win32/secauthz/mandatory-integrity-control author: frack113 date: 2022-12-09 modified: 2024-12-01 tags: - attack.stealth - attack.t1202 logsource: product: windows category: process_creation detection: selection: IntegrityLevel: - High - S-1-16-12288 CommandLine|contains|all: - conhost.exe - '0xffffffff' - -ForceV1 condition: selection falsepositives: - Very Likely, including launching cmd.exe via Run As Administrator level: informational
Near-miss passage: Sigma rule: Detects scheduled task creations or modification to be run with high privileges on a suspicious schedule type. Logsource: windows / process_creation. Rule: title: Suspicious Schtasks Schedule Type With High Privileges id: 7a02e22e-b885-4404-b38b-1ddc7e65258a related: - id: 24c8392b-aa3c-46b7-a545-43f71657fe98 type: similar status: test description: Detects scheduled task creations or modification to be run with high privileges on a suspicious schedule type references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-change - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-31 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1053.005 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \schtasks.exe - OriginalFileName: schtasks.exe selection_time: CommandLine|contains: - ' ONLOGON ' - ' ONSTART ' - ' ONCE ' - ' ONIDLE ' selection_privs: CommandLine|contains: - NT AUT - ' SYSTEM' - HIGHEST condition: all of selection_* falsepositives: - Some installers were seen using this method of creation unfortunately. Filter them in your environment level: medium
Query: detect Detects suspicious DNS queries using base64 encoding in logs
Matching passage: Sigma rule: Detects suspicious DNS queries using base64 encoding. Logsource: dns. Rule: title: Suspicious DNS Query with B64 Encoded String id: 4153a907-2451-4e4f-a578-c52bb6881432 status: test description: Detects suspicious DNS queries using base64 encoding references: - https://github.com/krmaxwell/dns-exfiltration author: Florian Roth (Nextron Systems) date: 2018-05-10 modified: 2022-10-09 tags: - attack.exfiltration - attack.t1048.003 - attack.command-and-control - attack.t1071.004 logsource: category: dns detection: selection: query|contains: ==. condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the execution of a binary from the Linux shared memory directory /dev/shm. This directory is a tmpfs mount backe. Logsource: linux / process_creation. Rule: title: Process Execution From Shared Memory Directory id: 5cd16c8f-44a6-4654-81e7-a84d6db507d4 status: experimental description: 'Detects the execution of a binary from the Linux shared memory directory /dev/shm. This directory is a tmpfs mount backed entirely by RAM and is abused by attackers for fileless malware staging because files written there never touch physical disk and may evade disk-based detection. ' references: - https://www.sysdig.com/blog/containers-read-only-fileless-malware - https://unfinished.bike/fun-with-the-new-bpfdoor-2023 - https://asiapacificdefencereporter.com/wp-content/uploads/2023/08/Final-CRWD-2023-Threat-Hunting-Report.pdf - https://www.crowdstrike.com/en-us/blog/how-to-hunt-for-decisivearchitect-and-justforfun-implant/ - https://www.linkedin.com/posts/avradeep_malware-apt-infostealer-activity-7373203959697719296-JR-7 - https://www.stormshield.com/news/orbit-analysis-of-a-linux-dedicated-malware/ author: Stan Beukers date: 2026-06-20 tags: - attack.stealth - attack.execution - attack.t1027.011 logsource: category: process_creation product: linux detection: selection: Image|startswith: /dev/shm/ condition: selection falsepositives: - Unlikely in production environments; some container runtimes or IPC frameworks may use /dev/shm for inter-process communication but should not spawn executables. level: high
Query: SOC alert related to Commonly Used Port
Matching passage: T1043 Commonly Used Port. Tactics: command and control. Description: **This technique has been deprecated. Please use [Non-Standard Port](https://attack.mitre.org/techniques/T1571) where appropriate.** Adversaries may communicate over a commonly used port to bypass firewalls or network detection systems and to blend with normal network activity to avoid more detailed inspection. They may use commonly open ports such as * TCP:80 (HTTP) * TCP:443 (HTTPS) * TCP:25 (SMTP) * TCP/UDP:53 (DNS) They may use the protocol associated with the port or a completely different protocol. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), examples of common ports are * TCP/UDP:135 (RPC) * TCP/UDP:22 (SSH) * TCP/UDP:3389 (RDP)
Near-miss passage: T1205.001 Port Knocking. Tactics: stealth, persistence, command and control. Description: Adversaries may use port knocking to hide open ports used for persistence or command and control. To enable a port, an adversary sends a series of attempted connections to a predefined sequence of closed ports. After the sequence is completed, opening a port is often accomplished by the host based firewall, but could also be implemented by custom software. This technique has been observed both for the dynamic opening of a listening port as well as the initiating of a connection to a listening server on a different system. The observation of the signal packets to trigger the communication can be conducted through different methods. One means, originally implemented by Cd00r (Citation: Hartrell cd00r 2002), is to use the libpcap libraries to sniff for the packets in question. Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs.
Query: patch priority for CVE-2015-1335
Matching passage: CVE-2015-1335. CWE: CWE-59. CVSS: 7.199999809265137. lxc-start in lxc before 1.0.8 and 1.1.x before 1.1.4 allows local container administrators to escape AppArmor confinement via a symlink attack on a (1) mount target or (2) bind mount source.
Near-miss passage: CVE-2015-3156. CWE: CWE-59. CVSS: 5.5. The _write_config function in trove/guestagent/datastore/experimental/mongodb/service.py, reset_configuration function in trove/guestagent/datastore/experimental/postgresql/service/config.py, write_config function in trove/guestagent/datastore/experimental/redis/service.py, _write_mycnf function in trove/guestagent/datastore/mysql/service.py, InnoBackupEx::_run_prepare function in trove/guestagent/strategies/restore/mysql_impl.py, InnoBackupEx::cmd function in trove/guestagent/strategies/backup/mysql_impl.py, MySQLDump::cmd in trove/guestagent/strategies/backup/mysql_impl.py, InnoBackupExIncremental::cmd function in trove/guestagent/strategies/backup/mysql_impl.py, _get_actual_db_status function in trove/guestagent/datastore/experimental/cassandra/system.py and trove/guestagent/datastore/experimental/cassandra/service.py, and multiple class CbBackup methods in trove/guestagent/strategies/backup/experimental/couchbase_impl.py in Openstack DBaaS (aka Trove) as packaged in Openstack before 2015.1.0 (aka Kilo) allows local users to write to configuration files via a symlink attack on a temporary file.
Query: vulnerability: Unspecified vulnerability in the Reference Data Management component in IBM InfoSphere Master Data Management 10.1, 11.0, 11.3 before FP3, and 11.4 allows remote authenticated user
Matching passage: CVE-2015-1945. CWE: UNKNOWN. CVSS: 6.5. Unspecified vulnerability in the Reference Data Management component in IBM InfoSphere Master Data Management 10.1, 11.0, 11.3 before FP3, and 11.4 allows remote authenticated users to gain privileges via unknown vectors.
Near-miss passage: CVE-2015-5669. CWE: UNKNOWN. CVSS: 6.5. Techno Project Japan Enisys Gw before 1.4.1 allows remote authenticated users to write to arbitrary files and consequently execute arbitrary code via unspecified vectors.
Query: detect Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55) in logs
Matching passage: Sigma rule: Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55). Logsource: windows / process_creation. Rule: title: UAC Bypass Using MSConfig Token Modification - Process id: ad92e3f9-7eb6-460e-96b1-582b0ccbb980 status: test description: Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-30 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: IntegrityLevel: - High - System - S-1-16-16384 - S-1-16-12288 ParentImage|endswith: \AppData\Local\Temp\pkgmgr.exe CommandLine: '"C:\Windows\system32\msconfig.exe" -5' condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage. Logsource: windows / network_connection. Rule: title: Uncommon Outbound Kerberos Connection id: e54979bd-c5f9-4d6c-967b-a04b19ac4c74 related: - id: eca91c7c-9214-47b9-b4c5-cb1d7e4f2350 type: similar status: test description: 'Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation. ' references: - https://github.com/GhostPack/Rubeus author: Ilyas Ochkov, oscd.community date: 2019-10-24 modified: 2024-03-15 tags: - attack.credential-access - attack.t1558 - attack.lateral-movement - attack.t1550.003 logsource: category: network_connection product: windows detection: selection: DestinationPort: 88 Initiated: 'true' filter_main_lsass: Image: C:\Windows\System32\lsass.exe filter_optional_chrome: Image: - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe - C:\Program Files\Google\Chrome\Application\chrome.exe filter_optional_firefox: Image: - C:\Program Files (x86)\Mozilla Firefox\firefox.exe - C:\Program Files\Mozilla Firefox\firefox.exe filter_optional_tomcat: Image|endswith: \tomcat\bin\tomcat8.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Web Browsers and third party application might generate similar activity. An initial baseline is required. level: medium
Query: CVE similar to CVE-2015-7571
Matching passage: CVE-2015-7571. CWE: CWE-434. CVSS: 7.800000190734863. Unrestricted file upload vulnerability in Yeager CMS 1.2.1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
Near-miss passage: CVE-2015-9339. CWE: CWE-434. CVSS: 7.5. The wp-file-upload plugin before 2.7.1 for WordPress has insufficient restrictions on upload of .js files.
Query: risk of Unspecified vulnerability in the Oracle Forms component in Oracle Fusion Middleware 11.1.1.7 and 11.1.2.2 allows remote attackers to affect confidentiality via unknown vectors rela
Matching passage: CVE-2015-0420. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle Forms component in Oracle Fusion Middleware 11.1.1.7 and 11.1.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Forms Services.
Near-miss passage: CVE-2015-5206. CWE: UNKNOWN. CVSS: 9.800000190734863. Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server before 5.3.x before 5.3.2 has unknown impact and attack vectors, a different vulnerability than CVE-2015-5168.
Query: CWE for Public Data Assigned to Private Array-Typed Field
Matching passage: CWE-496 Public Data Assigned to Private Array-Typed Field. Assigning public data to a private array is equivalent to giving public access to the array.
Near-miss passage: CWE-1272 Sensitive Information Uncleared Before Debug/Power State Transition. The product performs a power or debug state transition, but it does not clear sensitive information that should no longer be accessible due to changes to information access restrictions.
Query: explain CWE-43
Matching passage: CWE-43 Path Equivalence: 'filename....' (Multiple Trailing Dot). The product accepts path input in the form of multiple trailing dot ('filedir....') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
Near-miss passage: CWE-433 Unparsed Raw Web Content Delivery. The product stores raw content or supporting code under the web document root with an extension that is not specifically handled by the server.
Query: exploit The ptvcursor_add function in the ptvcursor implementation in epan/proto.c in Wireshark 1.12.x before 1.12.7 does not check whether the expected amount of data is available, which 
Matching passage: CVE-2015-6248. CWE: CWE-20. CVSS: 4.300000190734863. The ptvcursor_add function in the ptvcursor implementation in epan/proto.c in Wireshark 1.12.x before 1.12.7 does not check whether the expected amount of data is available, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Near-miss passage: CVE-2015-6546. CWE: CWE-20. CVSS: 6.099999904632568. The vCMP host in F5 BIG-IP Analytics, APM, ASM, GTM, Link Controller, and LTM 11.0.0 before 11.6.0, BIG-IP AAM 11.4.0 before 11.6.0, BIG-IP AFM and PEM 11.3.0 before 11.6.0, BIG-IP Edge Gateway, WebAccelerator, and WOM 11.0.0 through 11.3.0, BIG-IP PSM 11.0.0 through 11.4.1 allows remote attackers to cause a denial of service via "malicious traffic."