alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection engineering for SNMP (MIB Dump)
Matching passage: T1602.001 SNMP (MIB Dump). Tactics: collection. Description: Adversaries may target the Management Information Base (MIB) to collect and/or mine valuable information in a network managed using Simple Network Management Protocol (SNMP). The MIB is a configuration repository that stores variable information accessible via SNMP in the form of object identifiers (OID). Each OID identifies a variable that can be read or set and permits active management tasks, such as configuration changes, through remote modification of these variables. SNMP can give administrators great insight in their systems, such as, system information, description of hardware, physical location, and software packages(Citation: SANS Information Security Reading Room Securing SNMP Securing SNMP). The MIB may also contain device operational information, including running configuration, routing table, and interface details. Adversaries may use SNMP queries to collect MIB content directly from SNMP-managed devices in order to collect network information that allows the adversary to build network maps and facilitate future targeted exploitation.(Citation: US-CERT-TA18-106A)(Citation: Cisco Blog Legacy Device Attacks)
Near-miss passage: T1602.002 Network Device Configuration Dump. Tactics: collection. Description: Adversaries may access network configuration files to collect sensitive data about the device and the network. The network configuration is a file containing parameters that determine the operation of the device. The device typically stores an in-memory copy of the configuration while operating, and a separate configuration on non-volatile storage to load after device reset. Adversaries can inspect the configuration files to reveal information about the target network and its layout, the network device and its software, or identifying legitimate accounts and credentials for later use. Adversaries can use common management tools and protocols, such as Simple Network Management Protocol (SNMP) and Smart Install (SMI), to access network configuration files.(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)(Citation: Cisco Blog Legacy Device Attacks) These tools may be used to query specific data from a configuration repository or configure the device to export the configuration for later analysis.
Query: describe CVE-2015-9378
Matching passage: CVE-2015-9378. CWE: CWE-79. CVSS: 6.099999904632568. iThemes Builder Theme Market before 5.1.27 for WordPress has XSS via add_query_arg() and remove_query_arg().
Near-miss passage: CVE-2015-1177. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Exponent CMS 2.3.2.
Query: CVE similar to CVE-2015-10005
Matching passage: CVE-2015-10005. CWE: CWE-1333. CVSS: 7.5. A vulnerability was found in markdown-it up to 2.x. It has been classified as problematic. Affected is an unknown function of the file lib/common/html_re.js. The manipulation leads to inefficient regular expression complexity. Upgrading to version 3.0.0 is able to address this issue. The name of the patch is 89c8620157d6e38f9872811620d25138fc9d1b0d. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216852.
Near-miss passage: CVE-2015-8315. CWE: CWE-1333. CVSS: 7.5. The ms package before 0.7.1 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS)."
Query: vulnerability: The setUpSubtleUserAccount function in /bin/bw on Harman AMX devices before 2015-10-12 has a hardcoded password for the BlackWidow account, which makes it easier for remote attacke
Matching passage: CVE-2015-8362. CWE: CWE-255. CVSS: 9.800000190734863. The setUpSubtleUserAccount function in /bin/bw on Harman AMX devices before 2015-10-12 has a hardcoded password for the BlackWidow account, which makes it easier for remote attackers to obtain access via a (1) SSH or (2) HTTP session, a different vulnerability than CVE-2016-1984.
Near-miss passage: CVE-2015-1320. CWE: CWE-255. CVSS: 9.800000190734863. The SeaMicro provisioning of Ubuntu MAAS logs credentials, including username and password, for the management interface. This issue affects Ubuntu MAAS versions prior to 1.9.2.
Query: exploit Multiple cross-site scripting (XSS) vulnerabilities in Free Reprintables ArticleFR 3.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) name parameter to
Matching passage: CVE-2015-5529. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Free Reprintables ArticleFR 3.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) name parameter to dashboard/settings/categories/, (2) title or (3) rel parameter to dashboard/settings/links/, or (4) url parameter to dashboard/tools/pingservers/.
Near-miss passage: CVE-2015-7726. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in role deletion in the Web-based Development Workbench in SAP HANA DB 1.00.091.00.1418659308 allows remote authenticated users to inject arbitrary web script or HTML via the role name, aka SAP Security Note 2153898.
Query: patch priority for CVE-2015-7328
Matching passage: CVE-2015-7328. CWE: CWE-200. CVSS: 4.699999809265137. Puppet Server in Puppet Enterprise before 3.8.x before 3.8.3 and 2015.2.x before 2015.2.3 uses world-readable permissions for the private key of the Certification Authority (CA) certificate during the initial installation and configuration, which might allow local users to obtain sensitive information via unspecified vectors.
Near-miss passage: CVE-2015-8473. CWE: CWE-200. CVSS: 4.300000190734863. The Issues API in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote authenticated users to obtain sensitive information in changeset messages by leveraging permission to read issues with related changesets from other projects.
Query: explain CWE-1311
Matching passage: CWE-1311 Improper Translation of Security Attributes by Fabric Bridge. The bridge incorrectly translates security attributes from either trusted to untrusted or from untrusted to trusted when converting from one fabric protocol to another.
Near-miss passage: CWE-1232 Improper Lock Behavior After Power State Transition. Register lock bit protection disables changes to system configuration once the bit is set. Some of the protected registers or lock bits become programmable after power state transitions (e.g., Entry and wake from low power sleep modes) causing the system configuration to be changeable.
Query: write Sigma for Detects deployments of pods within the kube-system namespace, which could be intended to imitate system pods. System pod
Matching passage: Sigma rule: Detects deployments of pods within the kube-system namespace, which could be intended to imitate system pods. System pod. Logsource: kubernetes / application / audit. Rule: title: Creation Of Pod In System Namespace id: a80d927d-ac6e-443f-a867-e8d6e3897318 status: test description: 'Detects deployments of pods within the kube-system namespace, which could be intended to imitate system pods. System pods, created by controllers such as Deployments or DaemonSets have random suffixes in their names. Attackers can use this fact and name their backdoor pods as if they were created by these controllers to avoid detection. Deployment of such a backdoor container e.g. named kube-proxy-bv61v, could be attempted in the kube-system namespace alongside the other administrative containers. ' references: - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Pod%20or%20container%20name%20similarily/ author: Leo Tsaousis (@laripping) date: 2024-03-26 tags: - attack.stealth - attack.t1036.005 logsource: category: application product: kubernetes service: audit detection: selection: verb: create objectRef.resource: pods objectRef.namespace: kube-system condition: selection falsepositives: - System components such as daemon-set-controller and kube-scheduler also create pods in the kube-system namespace level: medium
Near-miss passage: Sigma rule: Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been. Logsource: windows / process_creation. Rule: title: Remote Access Tool - Team Viewer Session Started On Windows Host id: ab70c354-d9ac-4e11-bbb6-ec8e3b153357 related: - id: 1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d type: similar - id: f459ccb4-9805-41ea-b5b2-55e279e2424a type: similar status: test description: 'Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder. ' references: - Internal Research author: Josh Nickels, Qi Nan date: 2024-03-11 tags: - attack.persistence - attack.initial-access - attack.t1133 logsource: category: process_creation product: windows detection: selection: Image: TeamViewer_Desktop.exe ParentImage: TeamViewer_Service.exe CommandLine|endswith: TeamViewer_Desktop.exe --IPCport 5939 --Module 1 condition: selection falsepositives: - Legitimate usage of TeamViewer level: low
Query: describe CVE-2015-2862
Matching passage: CVE-2015-2862. CWE: CWE-22. CVSS: 4.0. Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote authenticated users to read arbitrary files via a crafted HTTP request.
Near-miss passage: CVE-2015-6914. CWE: CWE-22. CVSS: 7.800000190734863. Absolute path traversal vulnerability in SiteFactory CMS 5.5.9 allows remote attackers to read arbitrary files via a full pathname in the file parameter to assets/download.aspx.
Query: risk of Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 37.0 allow remote attackers to cause a denial of service (memory corruption and application cra
Matching passage: CVE-2015-0814. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 37.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Near-miss passage: CVE-2015-4880. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 10.1.3.5.1 allows remote attackers to affect integrity via unknown vectors related to Content Server, a different vulnerability than CVE-2015-4867.
Query: adversary uses Account Manipulation
Matching passage: T1098 Account Manipulation. Tactics: persistence, privilege escalation. Description: Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.(Citation: FireEye SMOKEDHAM June 2021) These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged [Valid Accounts](https://attack.mitre.org/techniques/T1078).
Near-miss passage: T1098.003 Additional Cloud Roles. Tactics: persistence, privilege escalation. Description: An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments.(Citation: AWS IAM Policies and Permissions)(Citation: Google Cloud IAM Policies)(Citation: Microsoft Support O365 Add Another Admin, October 2019)(Citation: Microsoft O365 Admin Roles) With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the ability to reset the passwords of other admins).(Citation: Expel AWS Attacker) (Citation: Microsoft O365 Admin Roles) This account modification may immediately follow [Create Account](https://attack.mitre.org/techniques/T1136) or other malicious account activity. Adversaries may also modify existing [Valid Accounts](https://attack.mitre.org/techniques/T1078) that they have compromised. This could lead to privilege escalation, particularly if the roles added allow for lateral movement to additional accounts. For example, in AWS environments, an adversary with appropriate permissions may be able to use the <code>CreatePolicyVersion</code> API to define a new version of an IAM policy or the <code>AttachUserPolicy</code> API to attach an IAM policy with additional or distinct permissions to a compromised user account.(Citation: Rhino Security Labs AWS Privilege Escalation) In some cases, adversaries may add roles to adversary-controlled accounts outside the victim cloud tenant. This allows these external accounts to perform actions inside the victim tenant without requiring the adversary to [Create Account](https://attack.mitre.org/techniques/T1136) or modify a victim-owned account.(Citation: Invictus IR DangerDev 2024)
Query: explain CWE-642
Matching passage: CWE-642 External Control of Critical State Data. The product stores security-critical state information about its users, or the product itself, in a location that is accessible to unauthorized actors.
Near-miss passage: CWE-780 Use of RSA Algorithm without OAEP. The product uses the RSA algorithm but does not incorporate Optimal Asymmetric Encryption Padding (OAEP), which might weaken the encryption.
Query: describe CVE-2015-6932
Matching passage: CVE-2015-6932. CWE: CWE-310. CVSS: 5.800000190734863. VMware vCenter Server 5.5 before u3 and 6.0 before u1 does not verify X.509 certificates from TLS LDAP servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Near-miss passage: CVE-2015-4550. CWE: CWE-310. CVSS: 4.300000190734863. The Cavium cryptographic-module firmware on Cisco Adaptive Security Appliance (ASA) devices with software 9.3(3) and 9.4(1.1) does not verify the AES-GCM Integrity Check Value (ICV) octets, which makes it easier for man-in-the-middle attackers to spoof IPSec and IKEv2 traffic by modifying packet data, aka Bug ID CSCuu66218.
Query: SOC alert related to Exploitation for Stealth
Matching passage: T1211 Exploitation for Stealth. Tactics: stealth. Description: Adversaries may exploit vulnerabilities to evade detection by hiding activity, suppressing logging, or operating within trusted or unmonitored components. Adversaries may exploit a system or application vulnerability to avoid detection while maintaining access within an environment. Exploitation occurs when an adversary leverages a programming flaw to execute code in a manner that minimizes visibility or blends in with legitimate activity. Rather than directly disabling defenses, adversaries may use exploitation to circumvent monitoring and logging mechanisms. This can include abusing vulnerabilities in logging pipelines, security tools, or cloud infrastructure to evade audit trails, suppress alerts, or operate without generating telemetry. Adversaries may identify these opportunities through prior reconnaissance or by performing discovery of security controls after initial access. In some cases, vulnerabilities in SaaS or public cloud environments may be exploited to evade logging, obscure activity, or deploy infrastructure that remains hidden from standard monitoring tools.(Citation: Bypassing CloudTrail in AWS Service Catalog)(Citation: GhostToken GCP flaw)
Near-miss passage: T1036.003 Rename Legitimate Utilities. Tactics: stealth. Description: Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for legitimate utilities adversaries are capable of abusing, including both built-in binaries and tools such as PSExec, AutoHotKey, and IronPython.(Citation: LOLBAS Main Site)(Citation: Huntress Python Malware 2025)(Citation: The DFIR Report AutoHotKey 2023)(Citation: Splunk Detect Renamed PSExec) It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename <code>rundll32.exe</code>).(Citation: Elastic Masquerade Ball) An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on these utilities executing from non-standard paths.(Citation: F-Secure CozyDuke)
Query: CVE similar to CVE-2015-4457
Matching passage: CVE-2015-4457. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in the Cloudera Manager UI before 5.4.3 allow remote authenticated users to inject arbitrary web script or HTML using unspecified vectors.
Near-miss passage: CVE-2015-5169. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20.
Query: weakness Unverified Password Change
Matching passage: CWE-620 Unverified Password Change. When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.
Near-miss passage: CWE-188 Reliance on Data/Memory Layout. The product makes invalid assumptions about how protocol data or memory is organized at a lower level, resulting in unintended program behavior.
Query: patch priority for CVE-2015-4195
Matching passage: CVE-2015-4195. CWE: CWE-399. CVSS: 4.0. Cisco IOS XR 5.1.1.K9SEC allows remote authenticated users to cause a denial of service (vty error, and SSH and TELNET outage) via a crafted disconnect action within an SSH session, aka Bug ID CSCul63127.
Near-miss passage: CVE-2015-1737. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1731, CVE-2015-1736, and CVE-2015-1755.
Query: describe CVE-2015-0615
Matching passage: CVE-2015-0615. CWE: CWE-19. CVSS: 7.099999904632568. The call-handling implementation in Cisco Unity Connection 8.5 before 8.5(1)SU7, 8.6 before 8.6(2a)SU4, 9.x before 9.1(2)SU2, and 10.0 before 10.0(1)SU1, when SIP trunk integration is enabled, allows remote attackers to cause a denial of service (port consumption) by improperly terminating SIP sessions, aka Bug ID CSCul28089.
Near-miss passage: CVE-2015-3990. CWE: CWE-19. CVSS: 9.0. The GMS ViewPoint (GMSVP) web application in Dell Sonicwall GMS, Analyzer, and UMA EM5000 before 7.2 SP4 allows remote authenticated users to execute arbitrary commands via vectors related to configuration.
Query: risk of The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtain sensitive information from memory or cause a denial of service (out-of-
Matching passage: CVE-2015-3237. CWE: CWE-20. CVSS: 6.400000095367432. The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtain sensitive information from memory or cause a denial of service (out-of-bounds read and crash) via crafted length and offset values.
Near-miss passage: CVE-2015-6260. CWE: CWE-20. CVSS: 7.5. Cisco NX-OS 7.1(1)N1(1) on Nexus 5500, 5600, and 6000 devices does not properly validate PDUs in SNMP packets, which allows remote attackers to cause a denial of service (SNMP application restart) via a crafted packet, aka Bug ID CSCut84645.
Query: vulnerability: Microsoft Internet Explorer 8 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site
Matching passage: CVE-2015-6151. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 8 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6083.
Near-miss passage: CVE-2015-9174. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 410/12, SD 617, SD 650/52, SD 800, SD 808, and SD 810, lack of validation of the return value prior to using for buffer allocation in QSEE application, TQS, may result in memory overwrite.
Query: Sigma YAML for windows / security
Matching passage: Sigma rule: Potential adversaries accessing the microphone and webcam in an endpoint.. Logsource: windows / security. Rule: title: Processes Accessing the Microphone and Webcam id: 8cd538a4-62d5-4e83-810b-12d41e428d6e status: test description: Potential adversaries accessing the microphone and webcam in an endpoint. references: - https://twitter.com/duzvik/status/1269671601852813320 - https://medium.com/@7a616368/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-06-07 modified: 2021-11-27 tags: - attack.collection - attack.t1123 logsource: product: windows service: security detection: selection: EventID: - 4657 - 4656 - 4663 ObjectName|contains: - \SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone\NonPackaged - \SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam\NonPackaged condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects suspicious shell commands used in various Equation Group scripts and tools. Logsource: linux. Rule: title: Equation Group Indicators id: 41e5c73d-9983-4b69-bd03-e13b67e9623c status: test description: Detects suspicious shell commands used in various Equation Group scripts and tools references: - https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1 author: Florian Roth (Nextron Systems) date: 2017-04-09 modified: 2021-11-27 tags: - attack.execution - attack.g0020 - attack.t1059.004 logsource: product: linux detection: keywords: - 'chown root*chmod 4777 ' - cp /bin/sh .;chown - chmod 4777 /tmp/.scsi/dev/bin/gsh - chown root:root /tmp/.scsi/dev/bin/ - chown root:root x; - /bin/telnet locip locport < /dev/console | /bin/sh - /tmp/ratload - 'ewok -t ' - 'xspy -display ' - cat > /dev/tcp/127.0.0.1/80 <<END - rm -f /current/tmp/ftshell.latest - 'ghost_* -v ' - ' --wipe > /dev/null' - ping -c 2 *; grep * /proc/net/arp >/tmp/gx - iptables * OUTPUT -p tcp -d 127.0.0.1 --tcp-flags RST RST -j DROP; - '> /var/log/audit/audit.log; rm -f .' - cp /var/log/audit/audit.log .tmp - sh >/dev/tcp/* <&1 2>&1 - ncat -vv -l -p * < - nc -vv -l -p * < - < /dev/console | uudecode && uncompress - sendmail -osendmail;chmod +x sendmail - /usr/bin/wget -O /tmp/a http* && chmod 755 /tmp/cron - chmod 666 /var/run/utmp~ - chmod 700 nscd crond - cp /etc/shadow /tmp/. - </dev/console |uudecode > /dev/null 2>&1 && uncompress - chmod 700 jp&&netstat -an|grep - uudecode > /dev/null 2>&1 && uncompress -f * && chmod 755 - chmod 700 crond - wget http*; chmod +x /tmp/sendmail - chmod 700 fp sendmail pt - chmod 755 /usr/vmsys/bin/pipe - chmod -R 755 /usr/vmsys - chmod 755 $opbin/*tunnel - chmod 700 sendmail - chmod 0700 sendmail - /usr/bin/wget http*sendmail;chmod +x sendmail; - '&& telnet * 2>&1 </dev/console' condition: keywords falsepositives: - Unknown level: high