alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit Unspecified vulnerability in the XDB - XML Database component in Oracle Database Server 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confi
Matching passage: CVE-2015-0455. CWE: UNKNOWN. CVSS: 6.800000190734863. Unspecified vulnerability in the XDB - XML Database component in Oracle Database Server 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality via unknown vectors.
Near-miss passage: CVE-2015-6051. CWE: UNKNOWN. CVSS: 4.300000190734863. Microsoft Internet Explorer 10 and 11 allows remote attackers to gain privileges via a crafted web site, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "Internet Explorer Elevation of Privilege Vulnerability."
Query: exploit Ansible before 1.9.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows
Matching passage: CVE-2015-3908. CWE: CWE-345. CVSS: 4.300000190734863. Ansible before 1.9.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Near-miss passage: CVE-2015-5236. CWE: CWE-345. CVSS: 7.5. It was discovered that the IcedTea-Web used codebase attribute of the <applet> tag on the HTML page that hosts Java applet in the Same Origin Policy (SOP) checks. As the specified codebase does not have to match the applet's actual origin, this allowed malicious site to bypass SOP via spoofed codebase value.
Query: Sigma rule for Detects a threat actor creating a file named `iertutil.dll` in the `C:\Program Files\Internet Explorer\` directory over
Matching passage: Sigma rule: Detects a threat actor creating a file named `iertutil.dll` in the `C:\Program Files\Internet Explorer\` directory over. Logsource: windows / security. Rule: title: DCOM InternetExplorer.Application Iertutil DLL Hijack - Security id: c39f0c81-7348-4965-ab27-2fde35a1b641 status: test description: Detects a threat actor creating a file named `iertutil.dll` in the `C:\Program Files\Internet Explorer\` directory over the network for a DCOM InternetExplorer DLL Hijack scenario. references: - https://threathunterplaybook.com/hunts/windows/201009-RemoteDCOMIErtUtilDLLHijack/notebook.html author: Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR) date: 2020-10-12 modified: 2022-11-26 tags: - attack.lateral-movement - attack.t1021.002 - attack.t1021.003 logsource: product: windows service: security detection: selection: EventID: 5145 RelativeTargetName|endswith: \Internet Explorer\iertutil.dll filter: SubjectUserName|endswith: $ condition: selection and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a suspicious child process spawning from Outlook where the image is located in a remote location (SMB/WebDav sha. Logsource: windows / process_creation. Rule: title: Suspicious Remote Child Process From Outlook id: e212d415-0e93-435f-9e1a-f29005bb4723 related: - id: 208748f7-881d-47ac-a29c-07ea84bf691d type: similar status: test description: Detects a suspicious child process spawning from Outlook where the image is located in a remote location (SMB/WebDav shares). references: - https://github.com/sensepost/ruler - https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=49 author: Markus Neis, Nasreddine Bencherchali (Nextron Systems) date: 2018-12-27 modified: 2023-02-09 tags: - attack.execution - attack.stealth - attack.t1059 - attack.t1202 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \outlook.exe Image|startswith: \\\\ condition: selection falsepositives: - Unknown level: high
Query: vulnerability: ProcessFileUpload.jsp in SolarWinds Storage Manager before 6.2 allows remote attackers to upload and execute arbitrary files via unspecified vectors.
Matching passage: CVE-2015-7838. CWE: CWE-20. CVSS: 10.0. ProcessFileUpload.jsp in SolarWinds Storage Manager before 6.2 allows remote attackers to upload and execute arbitrary files via unspecified vectors.
Near-miss passage: CVE-2015-9193. CWE: CWE-20. CVSS: 7.5. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, improper input validation could cause a memory overread and cause the app to crash.
Query: CVE similar to CVE-2015-3833
Matching passage: CVE-2015-3833. CWE: CWE-284. CVSS: 4.300000190734863. The getRunningAppProcesses function in services/core/java/com/android/server/am/ActivityManagerService.java in Android before 5.1.1 LMY48I allows attackers to bypass intended getRecentTasks restrictions and discover the name of the foreground application via a crafted application, aka internal bug 20034603.
Near-miss passage: CVE-2015-8973. CWE: CWE-284. CVSS: 8.300000190734863. xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to bypass intended access restrictions via vectors related to the forum password.
Query: exploit Multiple unspecified vulnerabilities in Google Chrome before 40.0.2214.91 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Matching passage: CVE-2015-1205. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in Google Chrome before 40.0.2214.91 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Near-miss passage: CVE-2015-6463. CWE: UNKNOWN. CVSS: 5.800000190734863. CodeWrights HART Comm DTM components, as used with Endress+Hauser FieldCare, allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a longtag XML schema containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Query: exploit ldapauth-fork before 2.3.3 allows remote attackers to perform LDAP injection attacks via a crafted username.
Matching passage: CVE-2015-7294. CWE: CWE-90. CVSS: 7.5. ldapauth-fork before 2.3.3 allows remote attackers to perform LDAP injection attacks via a crafted username.
Near-miss passage: CVE-2015-10027. CWE: CWE-90. CVSS: 9.800000190734863. A vulnerability, which was classified as problematic, has been found in hydrian TTRSS-Auth-LDAP. Affected by this issue is some unknown functionality of the component Username Handler. The manipulation leads to ldap injection. Upgrading to version 2.0b1 is able to address this issue. The patch is identified as a7f7a5a82d9202a5c40d606a5c519ba61b224eb8. It is recommended to upgrade the affected component. VDB-217622 is the identifier assigned to this vulnerability.
Query: describe CVE-2015-5187
Matching passage: CVE-2015-5187. CWE: CWE-200. CVSS: 6.5. Candlepin allows remote attackers to obtain sensitive information by obtaining Java exception statements as a result of excessive web traffic.
Near-miss passage: CVE-2015-6671. CWE: CWE-200. CVSS: 5.900000095367432. Open edX edx-platform before 2015-08-25 requires use of the database for storage of SAML SSO secrets, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging access to a database backup.
Query: SOC alert related to Transfer Data to Cloud Account
Matching passage: T1537 Transfer Data to Cloud Account. Tactics: exfiltration. Description: Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service. A defender who is monitoring for large transfers to outside the cloud environment through normal file transfers or over command and control channels may not be watching for data transfers to another account within the same cloud provider. Such transfers may utilize existing cloud provider APIs and the internal address space of the cloud provider to blend into normal traffic or avoid data transfers over external network interfaces.(Citation: TLDRSec AWS Attacks) Adversaries may also use cloud-native mechanisms to share victim data with adversary-controlled cloud accounts, such as creating anonymous file sharing links or, in Azure, a shared access signature (SAS) URI.(Citation: Microsoft Azure Storage Shared Access Signature) Incidents have been observed where adversaries have created backups of cloud instances and transferred them to separate accounts.(Citation: DOJ GRU Indictment Jul 2018)
Near-miss passage: T1041 Exfiltration Over C2 Channel. Tactics: exfiltration. Description: Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.
Query: adversary uses Cloud Secrets Management Stores
Matching passage: T1555.006 Cloud Secrets Management Stores. Tactics: credential access. Description: Adversaries may acquire credentials from cloud-native secret management solutions such as AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, and Terraform Vault. Secrets managers support the secure centralized management of passwords, API keys, and other credential material. Where secrets managers are in use, cloud services can dynamically acquire credentials via API requests rather than accessing secrets insecurely stored in plain text files or environment variables. If an adversary is able to gain sufficient privileges in a cloud environment – for example, by obtaining the credentials of high-privileged [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004) or compromising a service that has permission to retrieve secrets – they may be able to request secrets from the secrets manager. This can be accomplished via commands such as `get-secret-value` in AWS, `gcloud secrets describe` in GCP, and `az key vault secret show` in Azure.(Citation: Permiso Scattered Spider 2023)(Citation: Sysdig ScarletEel 2.0 2023)(Citation: AWS Secrets Manager)(Citation: Google Cloud Secrets)(Citation: Microsoft Azure Key Vault) **Note:** this technique is distinct from [Cloud Instance Metadata API](https://attack.mitre.org/techniques/T1552/005) in that the credentials are being directly requested from the cloud secrets manager, rather than through the medium of the instance metadata API.
Near-miss passage: T1555 Credentials from Password Stores. Tactics: credential access. Description: Adversaries may search for common password storage locations to obtain user credentials.(Citation: F-Secure The Dukes) Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.
Query: risk of fts.c in coreutils 8.4 allows local users to delete arbitrary files.
Matching passage: CVE-2015-1865. CWE: CWE-362. CVSS: 5.099999904632568. fts.c in coreutils 8.4 allows local users to delete arbitrary files.
Near-miss passage: CVE-2015-9022. CWE: CWE-362. CVSS: 7.0. In all Android releases from CAF using the Linux kernel, time-of-check Time-of-use (TOCTOU) Race Conditions exist in several TZ APIs.
Query: describe CVE-2015-5161
Matching passage: CVE-2015-5161. CWE: UNKNOWN. CVSS: 6.800000190734863. The Zend_Xml_Security::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded environment, allows remote attackers to bypass security checks and conduct XML external entity (XXE) and XML entity expansion (XEE) attacks via multibyte encoded characters.
Near-miss passage: CVE-2015-0923. CWE: UNKNOWN. CVSS: 5.0. The ContentBlockEx method in Workarea/ServerControlWS.asmx in Ektron Content Management System (CMS) 8.5 and 8.7 before 8.7sp2 and 9.0 before sp1 allows remote attackers to read arbitrary files via an external entity declaration in conjunction with an entity reference within an XML document named in the xslt parameter, related to an XML External Entity (XXE) issue.
Query: patch priority for CVE-2015-0808
Matching passage: CVE-2015-0808. CWE: CWE-17. CVSS: 5.0. The webrtc::VPMContentAnalysis::Release function in the WebRTC implementation in Mozilla Firefox before 37.0 uses incompatible approaches to the deallocation of memory for simple-type arrays, which might allow remote attackers to cause a denial of service (memory corruption) via unspecified vectors.
Near-miss passage: CVE-2015-2922. CWE: CWE-17. CVSS: 3.299999952316284. The ndisc_router_discovery function in net/ipv6/ndisc.c in the Neighbor Discovery (ND) protocol implementation in the IPv6 stack in the Linux kernel before 3.19.6 allows remote attackers to reconfigure a hop-limit setting via a small hop_limit value in a Router Advertisement (RA) message.
Query: describe CVE-2015-5717
Matching passage: CVE-2015-5717. CWE: CWE-310. CVSS: 5.800000190734863. The Siemens COMPAS Mobile application before 1.6 for Android does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Near-miss passage: CVE-2015-1358. CWE: CWE-310. CVSS: 5.0. The remote-management module in the (1) Multi Panels, (2) Comfort Panels, and (3) RT Advanced functionality in Siemens SIMATIC WinCC (TIA Portal) before 13 SP1 and in the (4) panels and (5) runtime functionality in SIMATIC WinCC flexible before 2008 SP3 Up7 does not properly encrypt credentials in transit, which makes it easier for remote attackers to determine cleartext credentials by sniffing the network and conducting a decryption attack.
Query: vulnerability: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, A
Matching passage: CVE-2015-7656. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via crafted actionImplementsOp arguments, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.
Near-miss passage: CVE-2015-5558. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-5554, CVE-2015-5555, and CVE-2015-5562.
Query: Sigma YAML for linux / process_creation
Matching passage: Sigma rule: Detects the use of Python's base64 decoding functions in command line executions on Linux systems. Malicious scripts oft. Logsource: linux / process_creation. Rule: title: Python One-Liners with Base64 Decoding - Linux id: 55e862a8-dd9c-4651-807a-f21fcad56716 related: - id: 50a0aa3d-ab16-4594-a8aa-5145a6e6792b type: similar status: experimental description: 'Detects the use of Python''s base64 decoding functions in command line executions on Linux systems. Malicious scripts often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion. ' references: - https://docs.python.org/3/library/base64.html - https://www.virustotal.com/gui/file/bc43e925d7b4b74319f6e74e836a96f1997ba404e14ac566cf12a21e9da463db/behavior - https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites author: Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-03-09 tags: - attack.execution - attack.stealth - attack.t1059.006 - attack.t1027.010 logsource: category: process_creation product: linux detection: selection_img: Image|contains: /python selection_cli: CommandLine|contains|all: - import - base64 - ' -c' CommandLine|contains: - .decode - b16decode - b32decode - b32hexdecode - b64decode - b85decode - z85decode condition: all of selection_* falsepositives: - Legitimate use of Python for decoding data, which is uncommon in typical enterprise environments but possible in development or data analysis contexts. level: high
Near-miss passage: Sigma rule: Detects Windows PowerShell Web Access. Logsource: proxy. Rule: title: Windows PowerShell User Agent id: c8557060-9221-4448-8794-96320e6f3e74 status: test description: Detects Windows PowerShell Web Access references: - https://msdn.microsoft.com/powershell/reference/5.1/microsoft.powershell.utility/Invoke-WebRequest author: Florian Roth (Nextron Systems) date: 2017-03-13 modified: 2021-11-27 tags: - attack.command-and-control - attack.t1071.001 logsource: category: proxy detection: selection: c-useragent|contains: ' WindowsPowerShell/' condition: selection falsepositives: - Administrative scripts that download files from the Internet - Administrative scripts that retrieve certain website contents level: medium
Query: weakness Improper Restriction of Rendered UI Layers or Frames
Matching passage: CWE-1021 Improper Restriction of Rendered UI Layers or Frames. The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.
Near-miss passage: CWE-943 Improper Neutralization of Special Elements in Data Query Logic. The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.
Query: describe CVE-2015-0762
Matching passage: CVE-2015-0762. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the management interface in Cisco Unified MeetingPlace 8.6(1.2) and 8.6(1.9) for Microsoft Outlook allows remote attackers to inject arbitrary web script or HTML via a crafted value in a URL, aka Bug ID CSCuu51400.
Near-miss passage: CVE-2015-5494. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Webform Matrix Component module 7.x-4.x before 7.x-4.13 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
Query: rule covering Detects a remote DLL load event via "rundll32.exe".
Matching passage: Sigma rule: Detects a remote DLL load event via "rundll32.exe".. Logsource: windows / image_load. Rule: title: Remote DLL Load Via Rundll32.EXE id: f40017b3-cb2e-4335-ab5d-3babf679c1de status: test description: Detects a remote DLL load event via "rundll32.exe". references: - https://github.com/gabe-k/themebleed - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-09-18 tags: - attack.execution - attack.t1204.002 logsource: category: image_load product: windows detection: selection: Image|endswith: \rundll32.exe ImageLoaded|startswith: \\\\ condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects usage of the "Add-AppxPackage" or it's alias "Add-AppPackage" to install unsigned AppX packages. Logsource: windows / process_creation. Rule: title: Unsigned AppX Installation Attempt Using Add-AppxPackage id: 37651c2a-42cd-4a69-ae0d-22a4349aa04a related: - id: 975b2262-9a49-439d-92a6-0709cccdf0b2 type: similar - id: 9a025188-6f2d-42f8-bb2f-d3a83d24a5af type: similar status: test description: Detects usage of the "Add-AppxPackage" or it's alias "Add-AppPackage" to install unsigned AppX packages references: - https://learn.microsoft.com/en-us/windows/msix/package/unsigned-package - https://twitter.com/WindowsDocs/status/1620078135080325122 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-31 tags: - attack.persistence - attack.stealth logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_cmdlet: CommandLine|contains: - 'Add-AppPackage ' - 'Add-AppxPackage ' selection_flag: CommandLine|contains: ' -AllowUnsigned' condition: all of selection_* falsepositives: - Installation of unsigned packages for testing purposes level: medium
Query: detection rule: Detects the presence of the keywords "Wscript", "Shell" and "Run" in the command, which could indicate a suspicious acti
Matching passage: Sigma rule: Detects the presence of the keywords "Wscript", "Shell" and "Run" in the command, which could indicate a suspicious acti. Logsource: windows / process_creation. Rule: title: Wscript Shell Run In CommandLine id: 2c28c248-7f50-417a-9186-a85b223010ee status: test description: Detects the presence of the keywords "Wscript", "Shell" and "Run" in the command, which could indicate a suspicious activity references: - https://web.archive.org/web/20220830122045/http://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html - https://blog.talosintelligence.com/modernloader-delivers-multiple-stealers-cryptominers-and-rats/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-31 modified: 2023-05-15 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - Wscript. - .Shell - .Run condition: selection falsepositives: - Inline scripting can be used by some rare third party applications or administrators. Investigate and apply additional filters accordingly level: medium
Near-miss passage: Sigma rule: Detects Windows Pcap driver installation based on a list of associated .sys files.. Logsource: windows / security. Rule: title: Windows Pcap Drivers id: 7b687634-ab20-11ea-bb37-0242ac130002 status: test description: Detects Windows Pcap driver installation based on a list of associated .sys files. references: - https://ragged-lab.blogspot.com/2020/06/capturing-pcap-driver-installations.html#more author: Cian Heasley date: 2020-06-10 modified: 2023-04-14 tags: - attack.discovery - attack.credential-access - attack.t1040 logsource: product: windows service: security definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697 detection: selection: EventID: 4697 ServiceFileName|contains: - pcap - npcap - npf - nm3 - ndiscap - nmnt - windivert - USBPcap - pktmon condition: selection falsepositives: - Unknown level: medium