alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memo
Matching passage: CVE-2015-0028. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0048.
Near-miss passage: CVE-2015-0021. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Query: risk of The ReadBlobByte function in coders/pdb.c in ImageMagick 6.x before 6.9.0-5 Beta allows remote attackers to cause a denial of service (infinite loop) via a crafted PDB file.
Matching passage: CVE-2015-8902. CWE: CWE-835. CVSS: 6.5. The ReadBlobByte function in coders/pdb.c in ImageMagick 6.x before 6.9.0-5 Beta allows remote attackers to cause a denial of service (infinite loop) via a crafted PDB file.
Near-miss passage: CVE-2015-6815. CWE: CWE-835. CVSS: 3.5. The process_tx_desc function in hw/net/e1000.c in QEMU before 2.4.0.1 does not properly process transmit descriptor data when sending a network packet, which allows attackers to cause a denial of service (infinite loop and guest crash) via unspecified vectors.
Query: describe CVE-2015-1889
Matching passage: CVE-2015-1889. CWE: CWE-89. CVSS: 6.5. The Big SQL component in IBM InfoSphere BigInsights 3.0 through 3.0.0.2 allows remote authenticated users to bypass intended HDFS data-access restrictions via (1) a crafted CREATE HADOOP TABLE statement referencing the data of an arbitrary user or (2) an import of a certain Hive table definition with the HCAT_SYNC_OBJECTS procedure.
Near-miss passage: CVE-2015-2292. CWE: CWE-89. CVSS: 6.5. Multiple SQL injection vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.
Query: exploit Unspecified vulnerability in the PeopleSoft Enterprise Portal Interaction Hub component in Oracle PeopleSoft Products 9.1.00 allows remote attackers to affect integrity via unknown
Matching passage: CVE-2015-0497. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the PeopleSoft Enterprise Portal Interaction Hub component in Oracle PeopleSoft Products 9.1.00 allows remote attackers to affect integrity via unknown vectors related to Enterprise Portal.
Near-miss passage: CVE-2015-4838. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.4.0, 12.1.2.0.0, and 12.1.3.0.0 allows remote authenticated users to affect confidentiality via vectors related to ADF Faces.
Query: CVE similar to CVE-2015-7939
Matching passage: CVE-2015-7939. CWE: CWE-119. CVSS: 9.600000381469727. Heap-based buffer overflow in Unitronics VisiLogic OPLC IDE before 9.8.09 allows remote attackers to execute arbitrary code via a long vlp filename.
Near-miss passage: CVE-2015-3874. CWE: CWE-119. CVSS: 10.0. The Sonivox components in Android before 5.1.1 LMY48T allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bugs 23335715, 23307276, and 23286323.
Query: write Sigma for Detects attempts to disable security event logging by adding the `MiniNt` registry key. This key is used to disable the
Matching passage: Sigma rule: Detects attempts to disable security event logging by adding the `MiniNt` registry key. This key is used to disable the. Logsource: windows / process_creation. Rule: title: Security Event Logging Disabled via MiniNt Registry Key - Process id: 1a4bd6af-99ac-4466-b5b2-7b72b4a05462 related: - id: 8839e550-52d7-4958-9f2f-e13c1e736838 type: similar status: experimental description: 'Detects attempts to disable security event logging by adding the `MiniNt` registry key. This key is used to disable the Windows Event Log service, which collects and stores event logs from the operating system and applications. Adversaries may want to disable this service to prevent logging of security events that could be used to detect their activities. ' references: - https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-04-09 tags: - attack.persistence - attack.defense-impairment - attack.t1685.001 - attack.t1112 - car.2022-03-001 logsource: category: process_creation product: windows detection: selection_reg_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_reg_cmd: CommandLine|contains|all: - ' add ' - \SYSTEM\CurrentControlSet\Control\MiniNt selection_powershell_img: - Image|endswith: - \powershell.exe - \pwsh.exe - \powershell_ise.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_powershell_cmd1: CommandLine|contains: - 'New-Item ' - 'ni ' selection_powershell_cmd2: CommandLine|contains: \SYSTEM\CurrentControlSet\Control\MiniNt condition: all of selection_reg_* or all of selection_powershell_* falsepositives: - Highly Unlikely level: high
Near-miss passage: Sigma rule: Detects the use of the 'Launch-VsDevShell.ps1' Microsoft signed script to execute commands.. Logsource: windows / process_creation. Rule: title: Launch-VsDevShell.PS1 Proxy Execution id: 45d3a03d-f441-458c-8883-df101a3bb146 status: test description: Detects the use of the 'Launch-VsDevShell.ps1' Microsoft signed script to execute commands. references: - https://twitter.com/nas_bench/status/1535981653239255040 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-19 tags: - attack.stealth - attack.t1216.001 logsource: category: process_creation product: windows detection: selection_script: CommandLine|contains: Launch-VsDevShell.ps1 selection_flags: CommandLine|contains: - 'VsWherePath ' - 'VsInstallationPath ' condition: all of selection_* falsepositives: - Legitimate usage of the script by a developer level: medium
Query: CVE similar to CVE-2015-0143
Matching passage: CVE-2015-0143. CWE: CWE-200. CVSS: 4.0. IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to obtain sensitive information by reading error messages.
Near-miss passage: CVE-2015-4295. CWE: CWE-200. CVSS: 4.0. The Prime Collaboration Deployment component in Cisco Unified Communications Manager 10.5(3.10000.9) allows remote authenticated users to discover root credentials via a direct request to an unspecified URL, aka Bug ID CSCuv21819.
Query: detection engineering for Exclusive Control
Matching passage: T1668 Exclusive Control. Tactics: persistence. Description: Adversaries who successfully compromise a system may attempt to maintain persistence by “closing the door” behind them – in other words, by preventing other threat actors from initially accessing or maintaining a foothold on the same system. For example, adversaries may patch a vulnerable, compromised system(Citation: Mandiant-iab-control)(Citation: CERT AT Fortinent Ransomware 2025) to prevent other threat actors from leveraging that vulnerability in the future. They may “close the door” in other ways, such as disabling vulnerable services(Citation: sophos-multiple-attackers), stripping privileges from accounts(Citation: aquasec-postgres-processes), or removing other malware already on the compromised device.(Citation: fsecure-netsky) Hindering other threat actors may allow an adversary to maintain sole access to a compromised system or network. This prevents the threat actor from needing to compete with or even being removed themselves by other threat actors. It also reduces the “noise” in the environment, lowering the possibility of being caught and evicted by defenders. Finally, in the case of [Resource Hijacking](https://attack.mitre.org/techniques/T1496), leveraging a compromised device’s full power allows the threat actor to maximize profit.(Citation: sophos-multiple-attackers)
Near-miss passage: T1037.004 RC Scripts. Tactics: persistence, privilege escalation. Description: Adversaries may establish persistence by modifying RC scripts, which are executed during a Unix-like system’s startup. These files allow system administrators to map and start custom services at startup for different run levels. RC scripts require root privileges to modify. Adversaries may establish persistence by adding a malicious binary path or shell commands to <code>rc.local</code>, <code>rc.common</code>, and other RC scripts specific to the Unix-like distribution.(Citation: IranThreats Kittens Dec 2017)(Citation: Intezer HiddenWasp Map 2019) Upon reboot, the system executes the script's contents as root, resulting in persistence. Adversary abuse of RC scripts is especially effective for lightweight Unix-like distributions using the root user as default, such as ESXi hypervisors, IoT, or embedded systems.(Citation: intezer-kaiji-malware) As ESXi servers store most system files in memory and therefore discard changes on shutdown, leveraging `/etc/rc.local.d/local.sh` is one of the few mechanisms for enabling persistence across reboots.(Citation: Juniper Networks ESXi Backdoor 2022) Several Unix-like systems have moved to Systemd and deprecated the use of RC scripts. This is now a deprecated mechanism in macOS in favor of Launchd.(Citation: Apple Developer Doco Archive Launchd)(Citation: Startup Items) This technique can be used on Mac OS X Panther v10.3 and earlier versions which still execute the RC scripts.(Citation: Methods of Mac Malware Persistence) To maintain backwards compatibility some systems, such as Ubuntu, will execute the RC scripts if they exist with the correct file permissions.(Citation: Ubuntu Manpage systemd rc)
Query: risk of Web Reference Database (aka refbase) through 0.9.6 and bleeding-edge before 2015-01-08 allows remote attackers to conduct XML injection attacks via (1) the id parameter to unapi.ph
Matching passage: CVE-2015-6011. CWE: UNKNOWN. CVSS: 5.0. Web Reference Database (aka refbase) through 0.9.6 and bleeding-edge before 2015-01-08 allows remote attackers to conduct XML injection attacks via (1) the id parameter to unapi.php or (2) the stylesheet parameter to sru.php.
Near-miss passage: CVE-2015-6712. CWE: UNKNOWN. CVSS: 6.800000190734863. The ANSendApprovalToAuthorEnabled method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7616, CVE-2015-7618, CVE-2015-7619, CVE-2015-7620, and CVE-2015-7623.
Query: write Sigma for Detects suspicious access to the "svchost" process such as that used by Invoke-Phantom to kill the thread of the Windows
Matching passage: Sigma rule: Detects suspicious access to the "svchost" process such as that used by Invoke-Phantom to kill the thread of the Windows. Logsource: windows / process_access. Rule: title: Suspicious Svchost Process Access id: 166e9c50-8cd9-44af-815d-d1f0c0e90dde status: test description: Detects suspicious access to the "svchost" process such as that used by Invoke-Phantom to kill the thread of the Windows event logging service. references: - https://github.com/hlldz/Invoke-Phant0m - https://twitter.com/timbmsft/status/900724491076214784 author: Tim Burrell date: 2020-01-02 modified: 2023-01-30 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: process_access product: windows detection: selection: TargetImage|endswith: :\Windows\System32\svchost.exe GrantedAccess: '0x1F3FFF' CallTrace|contains: UNKNOWN filter_main_msbuild: SourceImage|contains: :\Program Files\Microsoft Visual Studio\ SourceImage|endswith: \MSBuild\Current\Bin\MSBuild.exe CallTrace|contains: - Microsoft.Build.ni.dll - System.ni.dll condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via use MSHTA in Scripts. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation Via Use MSHTA - PowerShell id: e55a5195-4724-480e-a77e-3ebe64bd3759 status: test description: Detects Obfuscated Powershell via use MSHTA in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2020-10-08 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_4104: ScriptBlockText|contains|all: - set - '&&' - mshta - vbscript:createobject - .run - (window.close) condition: selection_4104 falsepositives: - Unknown level: high
Query: SOC alert related to Dynamic Resolution
Matching passage: T1568 Dynamic Resolution. Tactics: command and control. Description: Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control. Adversaries may use dynamic resolution for the purpose of [Fallback Channels](https://attack.mitre.org/techniques/T1008). When contact is lost with the primary command and control server malware may employ dynamic resolution as a means to reestablishing command and control.(Citation: Talos CCleanup 2017)(Citation: FireEye POSHSPY April 2017)(Citation: ESET Sednit 2017 Activity)
Near-miss passage: T1568.003 DNS Calculation. Tactics: command and control. Description: Adversaries may perform calculations on addresses returned in DNS results to determine which port and IP address to use for command and control, rather than relying on a predetermined port number or the actual returned IP address. A IP and/or port number calculation can be used to bypass egress filtering on a C2 channel.(Citation: Meyers Numbered Panda) One implementation of [DNS Calculation](https://attack.mitre.org/techniques/T1568/003) is to take the first three octets of an IP address in a DNS response and use those values to calculate the port for command and control traffic.(Citation: Meyers Numbered Panda)(Citation: Moran 2014)(Citation: Rapid7G20Espionage)
Query: CVE similar to CVE-2015-2901
Matching passage: CVE-2015-2901. CWE: CWE-119. CVSS: 6.800000190734863. Multiple stack-based buffer overflows in Medicomp MEDCIN Engine 2.22.20142.166 might allow remote attackers to execute arbitrary code via a crafted packet on port 8190, related to (1) the GetProperty info_getproperty function and (2) the GetProperty UdfCodeList function.
Near-miss passage: CVE-2015-6160. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6140, CVE-2015-6142, CVE-2015-6143, CVE-2015-6153, CVE-2015-6158, and CVE-2015-6159.
Query: CVE similar to CVE-2015-8683
Matching passage: CVE-2015-8683. CWE: CWE-119. CVSS: 5.5. The putcontig8bitCIELab function in tif_getimage.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via a packed TIFF image.
Near-miss passage: CVE-2015-4695. CWE: CWE-119. CVSS: 5.0. meta.h in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WMF file.
Query: CVE similar to CVE-2015-0424
Matching passage: CVE-2015-0424. CWE: UNKNOWN. CVSS: 7.5. Unspecified vulnerability in the Integrated Lights Out Manager (ILOM) component in Oracle Sun Systems Products Suite ILOM prior to 3.2.4 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to IPMI.
Near-miss passage: CVE-2015-7644. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, and CVE-2015-7643.
Query: patch priority for CVE-2015-4064
Matching passage: CVE-2015-4064. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in modules/module.ab-testing.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the post parameter in an edit delete-variation action to wp-admin/post.php.
Near-miss passage: CVE-2015-1513. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in SIPhone Enterprise PBX allows remote attackers to execute arbitrary SQL commands via the Username.
Query: exploit Audio in Apple OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file, a different vulnerab
Matching passage: CVE-2015-5934. CWE: CWE-119. CVSS: 6.800000190734863. Audio in Apple OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file, a different vulnerability than CVE-2015-5933.
Near-miss passage: CVE-2015-2869. CWE: CWE-119. CVSS: 5.0. The FileInfo plugin before 2.22 for Ghisler Total Commander allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via (1) a large Size value in the Archive Member Header of a COFF Archive Library file, (2) a large Number Of Symbols value in the 1st Linker Member of a COFF Archive Library file, (3) a large Resource Table Count value in the LE Header of a Linear Executable file, or (4) a large value in a certain Object field in a Resource Table Entry in a Linear Executable file.
Query: Sigma YAML for windows / registry_set
Matching passage: Sigma rule: Detects potential persistence activity via outlook home page. An attacker can set a home page to achieve code execution. Logsource: windows / registry_set. Rule: title: Potential Persistence Via Outlook Home Page id: ddd171b5-2cc6-4975-9e78-f0eccd08cc76 related: - id: 487bb375-12ef-41f6-baae-c6a1572b4dd1 type: similar status: test description: 'Detects potential persistence activity via outlook home page. An attacker can set a home page to achieve code execution and persistence by editing the WebView registry keys. ' references: - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=70 - https://support.microsoft.com/en-us/topic/outlook-home-page-feature-is-missing-in-folder-properties-d207edb7-aa02-46c5-b608-5d9dbed9bd04?ui=en-us&rs=en-us&ad=us - https://trustedsec.com/blog/specula-turning-outlook-into-a-c2-with-one-registry-change author: Tobias Michalski (Nextron Systems), David Bertho (@dbertho) & Eirik Sveen (@0xSV1), Storebrand date: 2021-06-09 modified: 2024-08-07 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: registry_set detection: selection: TargetObject|contains|all: - \Software\Microsoft\Office\ - \Outlook\WebView\ TargetObject|endswith: \URL condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects an attempt to terminate a process via "wmic" with the "call terminate" flag. Adversaries may use wmic to termina. Logsource: windows / process_creation. Rule: title: Application Termination Attempt via Wmic.EXE id: 49d9671b-0a0a-4c09-8280-d215bfd30662 related: - id: 847d5ff3-8a31-4737-a970-aeae8fe21765 type: derived status: test description: 'Detects an attempt to terminate a process via "wmic" with the "call terminate" flag. Adversaries may use wmic to terminate security products or other applications on the compromised host. This event is triggered on on attempt and process creation can be either successful or unsuccessful. ' references: - https://cyble.com/blog/lockfile-ransomware-using-proxyshell-attack-to-deploy-ransomware/ - https://www.bitdefender.com/files/News/CaseStudies/study/377/Bitdefender-Whitepaper-WMI-creat4871-en-EN-GenericUse.pdf author: Nasreddine Bencherchali (Nextron Systems) date: 2023-09-11 tags: - attack.execution - attack.t1047 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \WMIC.exe - OriginalFileName: wmic.exe selection_cli: CommandLine|contains|all: - call - terminate condition: all of selection_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_terminate_application/info.yml
Query: describe CVE-2015-3680
Matching passage: CVE-2015-3680. CWE: CWE-119. CVSS: 6.800000190734863. Apple Type Services (ATS) in Apple OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-3679, CVE-2015-3681, and CVE-2015-3682.
Near-miss passage: CVE-2015-1658. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1706, CVE-2015-1711, CVE-2015-1717, and CVE-2015-1718.