alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: Cross-site scripting (XSS) vulnerability in the DataTables plugin 1.10.8 and earlier for jQuery allows remote attackers to inject arbitrary web script or HTML via the scripts param
Matching passage: CVE-2015-6584. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the DataTables plugin 1.10.8 and earlier for jQuery allows remote attackers to inject arbitrary web script or HTML via the scripts parameter to media/unit_testing/templates/6776.php.
Near-miss passage: CVE-2015-3948. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Query: exploit Multiple cross-site request forgery (CSRF) vulnerabilities in Horde before 5.2.8, Horde Groupware before 5.2.11, and Horde Groupware Webmail Edition before 5.2.11 allow remote atta
Matching passage: CVE-2015-7984. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in Horde before 5.2.8, Horde Groupware before 5.2.11, and Horde Groupware Webmail Edition before 5.2.11 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary (1) commands via the cmd parameter to admin/cmdshell.php, (2) SQL queries via the sql parameter to admin/sqlshell.php, or (3) PHP code via the php parameter to admin/phpshell.php.
Near-miss passage: CVE-2015-1585. CWE: CWE-352. CVSS: 6.800000190734863. Fat Free CRM before 0.13.6 allows remote attackers to conduct cross-site request forgery (CSRF) attacks via a request without the authenticity_token, as demonstrated by a crafted HTML page that creates a new administrator account.
Query: common weakness: Insufficient Session Expiration
Matching passage: CWE-613 Insufficient Session Expiration. According to WASC, Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization.
Near-miss passage: CWE-676 Use of Potentially Dangerous Function. The product invokes a potentially dangerous function that could introduce a vulnerability if it is used incorrectly, but the function can also be used safely.
Query: detect Exploitation for Privilege Escalation
Matching passage: T1068 Exploitation for Privilege Escalation. Tactics: privilege escalation. Description: Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions. When initially gaining access to a system, an adversary may be operating within a lower privileged process which will prevent them from accessing certain resources on the system. Vulnerabilities may exist, usually in operating system components and software commonly running at higher permissions, that can be exploited to gain higher levels of access on the system. This could enable someone to move from unprivileged or user level permissions to SYSTEM or root permissions depending on the component that is vulnerable. This could also enable an adversary to move from a virtualized environment, such as within a virtual machine or container, onto the underlying host. This may be a necessary step for an adversary compromising an endpoint system that has been properly configured and limits other privilege escalation methods. Adversaries may bring a signed vulnerable driver onto a compromised machine so that they can exploit the vulnerability to execute code in kernel mode. This process is sometimes referred to as Bring Your Own Vulnerable Driver (BYOVD).(Citation: ESET InvisiMole June 2020)(Citation: Unit42 AcidBox June 2020) Adversaries may include the vulnerable driver with files delivered during Initial Access or download it to a compromised system via [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105) or [Lateral Tool Transfer](https://attack.mitre.org/techniques/T1570).
Near-miss passage: T1037 Boot or Logon Initialization Scripts. Tactics: persistence, privilege escalation. Description: Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.(Citation: Mandiant APT29 Eye Spy Email Nov 22)(Citation: Anomali Rocke March 2019) Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating system and whether applied locally or remotely. Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary. An adversary may also be able to escalate their privileges since some boot or logon initialization scripts run with higher privileges.
Query: vulnerability: s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allows remote attackers to bypass authentication if message decryption is u
Matching passage: CVE-2015-8013. CWE: CWE-310. CVSS: 7.5. s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allows remote attackers to bypass authentication if message decryption is used as an authentication mechanism via a crafted symmetrically encrypted PGP message.
Near-miss passage: CVE-2015-1596. CWE: CWE-310. CVSS: 5.800000190734863. The Siemens SPCanywhere application for Android and iOS does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the execution of EDRSilencer, a tool that leverages Windows Filtering Platform (WFP) to block Endpoint Detection. Logsource: windows / process_creation. Rule: title: HackTool - EDRSilencer Execution id: eb2d07d4-49cb-4523-801a-da002df36602 status: test description: 'Detects the execution of EDRSilencer, a tool that leverages Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server based on PE metadata information. ' references: - https://github.com/netero1010/EDRSilencer author: '@gott_cyber' date: 2024-01-02 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \EDRSilencer.exe - OriginalFileName: EDRSilencer.exe - Description|contains: EDRSilencer condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects potentially suspicious changes to the SentinelOne context menu scan command by a process other than SentinelOne.. Logsource: windows / registry_set. Rule: title: Potential SentinelOne Shell Context Menu Scan Command Tampering id: 6c304b02-06e6-402d-8be4-d5833cdf8198 status: test description: Detects potentially suspicious changes to the SentinelOne context menu scan command by a process other than SentinelOne. references: - https://mrd0x.com/sentinelone-persistence-via-menu-context/ author: Nasreddine Bencherchali (Nextron Systems) date: 2024-03-06 tags: - attack.persistence logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \shell\SentinelOneScan\command\ filter_main_sentinelone_default_scan_binary: Details|startswith: - C:\Program Files\SentinelOne\Sentinel Agent - C:\Program Files (x86)\SentinelOne\Sentinel Agent Details|contains: \SentinelScanFromContextMenu.exe filter_main_sentinelone_binary: Image|endswith: - C:\Program Files\SentinelOne\ - C:\Program Files (x86)\SentinelOne\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Query: describe CVE-2015-0366
Matching passage: CVE-2015-0366. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in the Siebel Core - EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Java Integration, a different vulnerability than CVE-2014-0369.
Near-miss passage: CVE-2015-8420. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: exploit The wp-polls plugin before 2.72 for WordPress has SQL injection.
Matching passage: CVE-2015-9352. CWE: CWE-89. CVSS: 9.800000190734863. The wp-polls plugin before 2.72 for WordPress has SQL injection.
Near-miss passage: CVE-2015-9449. CWE: CWE-89. CVSS: 7.199999809265137. The microblog-poster plugin before 1.6.2 for WordPress has SQL Injection via the wp-admin/options-general.php?page=microblogposter.php account_id parameter.
Query: explain CWE-908
Matching passage: CWE-908 Use of Uninitialized Resource. The product uses or accesses a resource that has not been initialized.
Near-miss passage: CWE-281 Improper Preservation of Permissions. The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
Query: CVE similar to CVE-2015-1659
Matching passage: CVE-2015-1659. CWE: UNKNOWN. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1662 and CVE-2015-1665.
Near-miss passage: CVE-2015-0406. CWE: UNKNOWN. CVSS: 5.800000190734863. Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality and availability via unknown vectors related to Deployment.
Query: risk of The authentication setup in XWayland 1.16.x and 1.17.x before 1.17.2 starts the server in non-authenticating mode, which allows local users to read from or send information to arbi
Matching passage: CVE-2015-3164. CWE: CWE-264. CVSS: 3.5999999046325684. The authentication setup in XWayland 1.16.x and 1.17.x before 1.17.2 starts the server in non-authenticating mode, which allows local users to read from or send information to arbitrary X11 clients via vectors involving a UNIX socket.
Near-miss passage: CVE-2015-1795. CWE: CWE-264. CVSS: 7.800000190734863. Red Hat Gluster Storage RPM Package 3.2 allows local users to gain privileges and execute arbitrary code as root.
Query: vulnerability: Heap-based buffer overflow in Aruba Instant (IAP) with firmware before 4.0.0.7 and 4.1.x before 4.1.1.2 allows remote attackers to cause a denial of service (crash or reset to fact
Matching passage: CVE-2015-1348. CWE: CWE-119. CVSS: 7.800000190734863. Heap-based buffer overflow in Aruba Instant (IAP) with firmware before 4.0.0.7 and 4.1.x before 4.1.1.2 allows remote attackers to cause a denial of service (crash or reset to factory default) via a malformed frame to the wireless interface.
Near-miss passage: CVE-2015-3247. CWE: CWE-119. CVSS: 6.900000095367432. Race condition in the worker_update_monitors_config function in SPICE 0.12.4 allows a remote authenticated guest user to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary code on the host via unspecified vectors.
Query: EDR alert: possible Code Signing (T1553.002)
Matching passage: T1553.002 Code Signing. Tactics: defense impairment. Description: Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. (Citation: Wikipedia Code Signing) The certificates used during an operation may be created, acquired, or stolen by the adversary. (Citation: Securelist Digital Certificates) (Citation: Symantec Digital Certificates) Unlike [Invalid Code Signature](https://attack.mitre.org/techniques/T1036/001), this activity will result in a valid signature. Code signing to verify software on first run can be used on modern Windows and macOS systems. It is not used on Linux due to the decentralized nature of the platform. (Citation: Wikipedia Code Signing)(Citation: EclecticLightChecksonEXECodeSigning) Code signing certificates may be used to bypass security policies that require signed code to execute on a system.
Near-miss passage: T1553.003 SIP and Trust Provider Hijacking. Tactics: defense impairment. Description: Adversaries may tamper with SIP and trust provider components to mislead the operating system and application control tools when conducting signature validation checks. In user mode, Windows Authenticode (Citation: Microsoft Authenticode) digital signatures are used to verify a file's origin and integrity, variables that may be used to establish trust in signed code (ex: a driver with a valid Microsoft signature may be handled as safe). The signature validation process is handled via the WinVerifyTrust application programming interface (API) function, (Citation: Microsoft WinVerifyTrust) which accepts an inquiry and coordinates with the appropriate trust provider, which is responsible for validating parameters of a signature. (Citation: SpectorOps Subverting Trust Sept 2017) Because of the varying executable file types and corresponding signature formats, Microsoft created software components called Subject Interface Packages (SIPs) (Citation: EduardosBlog SIPs July 2008) to provide a layer of abstraction between API functions and files. SIPs are responsible for enabling API functions to create, retrieve, calculate, and verify signatures. Unique SIPs exist for most file formats (Executable, PowerShell, Installer, etc., with catalog signing providing a catch-all (Citation: Microsoft Catalog Files and Signatures April 2017)) and are identified by globally unique identifiers (GUIDs). (Citation: SpectorOps Subverting Trust Sept 2017) Similar to [Code Signing](https://attack.mitre.org/techniques/T1553/002), adversaries may abuse this architecture to subvert trust controls and bypass security policies that allow only legitimately signed code to execute on a system. Adversaries may hijack SIP and trust provider components to mislead operating system and application control tools to classify malicious (or any) code as signed by: (Citation: SpectorOps Subverting Trust Sept 2017) * Modifying the <code>Dll</code> and <code>FuncName</code> Registry values in <code>HKLM\SOFTWARE
Query: incident response steps for SIEM correlation: discovery activity consistent with Cloud Groups
Matching passage: Playbook for T1069.003 Cloud Groups. 1) Validate alert telemetry against T1069.003. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: discovery. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may attempt to find cloud groups and permission settings. The knowledge of cloud permission groups can help adversaries determine the particular roles of users and groups within an environment, as well as which users are associated with a particular group. With authenticated access there are several tools that can be used to find permissions groups. The <code>Get-MsolRole</code> PowerS
Near-miss passage: Playbook for T1069.001 Local Groups. Different response path focused on discovery.
Query: risk of Cross-site scripting (XSS) vulnerability in defaultnewsletter.php in SuperWebMailer 5.60.0.01190 and earlier allows remote attackers to inject arbitrary web script or HTML via the 
Matching passage: CVE-2015-2349. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in defaultnewsletter.php in SuperWebMailer 5.60.0.01190 and earlier allows remote attackers to inject arbitrary web script or HTML via the HTMLForm parameter.
Near-miss passage: CVE-2015-2082. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Login.aspx in UNIT4 Prosoft HRMS before 8.14.330.43 allows remote attackers to inject arbitrary web script or HTML via the txtUserID parameter.
Query: patch priority for CVE-2015-2441
Matching passage: CVE-2015-2441. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 7 through 11 and Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2452.
Near-miss passage: CVE-2015-5796. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Query: detection rule: Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery
Matching passage: Sigma rule: Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery. Logsource: linux / process_creation. Rule: title: Docker Container Discovery Via Dockerenv Listing id: 11701de9-d5a5-44aa-8238-84252f131895 status: test description: Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery references: - https://blog.skyplabs.net/posts/container-detection/ - https://stackoverflow.com/questions/20010199/how-to-determine-if-a-process-runs-inside-lxc-docker tags: - attack.discovery - attack.t1082 author: Seth Hanford date: 2023-08-23 logsource: category: process_creation product: linux detection: selection: Image|endswith: - /cat - /dir - /find - /ls - /stat - /test - grep CommandLine|endswith: .dockerenv condition: selection falsepositives: - Legitimate system administrator usage of these commands - Some container tools or deployments may use these techniques natively to determine how they proceed with execution, and will need to be filtered level: low
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via use MSHTA in Scripts. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation Via Use MSHTA - PowerShell id: e55a5195-4724-480e-a77e-3ebe64bd3759 status: test description: Detects Obfuscated Powershell via use MSHTA in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2020-10-08 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_4104: ScriptBlockText|contains|all: - set - '&&' - mshta - vbscript:createobject - .run - (window.close) condition: selection_4104 falsepositives: - Unknown level: high
Query: describe CVE-2015-7422
Matching passage: CVE-2015-7422. CWE: CWE-119. CVSS: 5.5. Buffer overflow in IBM i Access 7.1 on Windows allows local users to cause a denial of service (application crash) via unspecified vectors.
Near-miss passage: CVE-2015-2498. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2486, CVE-2015-2487, CVE-2015-2490, CVE-2015-2492, CVE-2015-2494, and CVE-2015-2499.
Query: alert when Detects Obfuscated use of Clip.exe to execute PowerShell
Matching passage: Sigma rule: Detects Obfuscated use of Clip.exe to execute PowerShell. Logsource: windows / security. Rule: title: Invoke-Obfuscation CLIP+ Launcher - Security id: 4edf51e1-cb83-4e1a-bc39-800e396068e3 related: - id: f7385ee2-0e0c-11eb-adc1-0242ac120002 type: derived status: test description: Detects Obfuscated use of Clip.exe to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-13 modified: 2022-11-27 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows service: security definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697 detection: selection: EventID: 4697 ServiceFileName|contains|all: - cmd - '&&' - 'clipboard]::' condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects commands that indicate a Raccine removal from an end system. Raccine is a free ransomware protection tool.. Logsource: windows / process_creation. Rule: title: Raccine Uninstall id: a31eeaed-3fd5-478e-a8ba-e62c6b3f9ecc status: test description: Detects commands that indicate a Raccine removal from an end system. Raccine is a free ransomware protection tool. references: - https://github.com/Neo23x0/Raccine author: Florian Roth (Nextron Systems) date: 2021-01-21 modified: 2022-10-09 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection1: CommandLine|contains|all: - 'taskkill ' - RaccineSettings.exe selection2: CommandLine|contains|all: - reg.exe - delete - Raccine Tray selection3: CommandLine|contains|all: - schtasks - /DELETE - Raccine Rules Updater condition: 1 of selection* falsepositives: - Legitimate deinstallation by administrative staff level: high