alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: HP CentralView Fraud Risk Management 11.1, 11.2, and 11.3; CentralView Revenue Leakage Control 4.1, 4.2, and 4.3; CentralView Dealer Performance Audit 2.0 and 2.1; CentralView Cred
Matching passage: CVE-2015-5406. CWE: UNKNOWN. CVSS: 9.0. HP CentralView Fraud Risk Management 11.1, 11.2, and 11.3; CentralView Revenue Leakage Control 4.1, 4.2, and 4.3; CentralView Dealer Performance Audit 2.0 and 2.1; CentralView Credit Risk Control 2.1, 2.2, and 2.3; CentralView Roaming Fraud Control 2.1, 2.2, and 2.3; and CentralView Subscription Fraud Prevention 2.0 and 2.1 allow remote attackers to obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2015-5407 and CVE-2015-5408.
Near-miss passage: CVE-2015-0502. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1 and 8.2 allows remote attackers to affect integrity via unknown vectors related to Portal Framework.
Query: patch priority for CVE-2015-4703
Matching passage: CVE-2015-4703. CWE: CWE-22. CVSS: 5.300000190734863. Absolute path traversal vulnerability in mysqldump_download.php in the WordPress Rename plugin 1.0 for WordPress allows remote attackers to read arbitrary files via a full pathname in the dumpfname parameter.
Near-miss passage: CVE-2015-9464. CWE: CWE-22. CVSS: 7.5. The s3bubble-amazon-s3-html-5-video-with-adverts plugin 0.7 for WordPress has directory traversal via the adverts/assets/plugins/ultimate/content/downloader.php path parameter.
Query: patch priority for CVE-2015-4726
Matching passage: CVE-2015-4726. CWE: CWE-94. CVSS: 7.5. PHP remote file inclusion vulnerability in ajax/myajaxphp.php in AudioShare 2.0.2 allows remote attackers to execute arbitrary PHP code via a URL in the config['basedir'] parameter.
Near-miss passage: CVE-2015-0898. CWE: CWE-94. CVSS: 7.5. futomi CGI Cafe MP Form Mail CGI eCommerce before 2.0.12 on Windows allows remote attackers to execute arbitrary Perl code via unspecified vectors.
Query: detect Detects execution of the "finger.exe" utility. Finger.EXE or "TCPIP Finger Command" is an old utility that is still pres in logs
Matching passage: Sigma rule: Detects execution of the "finger.exe" utility. Finger.EXE or "TCPIP Finger Command" is an old utility that is still pres. Logsource: windows / process_creation. Rule: title: Finger.EXE Execution id: af491bca-e752-4b44-9c86-df5680533dbc related: - id: c082c2b0-525b-4dbc-9a26-a57dc4692074 type: similar - id: 2fdaf50b-9fd5-449f-ba69-f17248119af6 type: similar status: test description: 'Detects execution of the "finger.exe" utility. Finger.EXE or "TCPIP Finger Command" is an old utility that is still present on modern Windows installation. It Displays information about users on a specified remote computer (typically a UNIX computer) that is running the finger service or daemon. Due to the old nature of this utility and the rareness of machines having the finger service. Any execution of "finger.exe" can be considered "suspicious" and worth investigating. ' references: - https://twitter.com/bigmacjpg/status/1349727699863011328?s=12 - https://app.any.run/tasks/40115012-a919-4208-bfed-41e82cb3dadf/ - http://hyp3rlinx.altervista.org/advisories/Windows_TCPIP_Finger_Command_C2_Channel_and_Bypassing_Security_Software.txt author: Florian Roth (Nextron Systems), omkar72, oscd.community date: 2021-02-24 modified: 2024-06-27 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection: - OriginalFileName: finger.exe - Image|endswith: \finger.exe condition: selection falsepositives: - Admin activity (unclear what they do nowadays with finger.exe) level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_finger_execution/info.yml
Near-miss passage: Sigma rule: Powerup tool's Write Hijack DLL exploits DLL hijacking for privilege escalation. In it's default mode, it builds a self. Logsource: windows / file_event. Rule: title: HackTool - Powerup Write Hijack DLL id: 602a1f13-c640-4d73-b053-be9a2fa58b96 status: test description: 'Powerup tool''s Write Hijack DLL exploits DLL hijacking for privilege escalation. In it''s default mode, it builds a self deleting .bat file which executes malicious command. The detection rule relies on creation of the malicious bat file (debug.bat by default). ' references: - https://powersploit.readthedocs.io/en/latest/Privesc/Write-HijackDll/ author: Subhash Popuri (@pbssubhash) date: 2021-08-21 modified: 2024-06-27 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: file_event product: windows detection: selection: Image|endswith: - \powershell.exe - \pwsh.exe TargetFilename|endswith: .bat condition: selection falsepositives: - Any powershell script that creates bat files level: high
Query: write Sigma for Detects uncommon child processes spawning from "sigverif.exe", which could indicate potential abuse of the latter as a l
Matching passage: Sigma rule: Detects uncommon child processes spawning from "sigverif.exe", which could indicate potential abuse of the latter as a l. Logsource: windows / process_creation. Rule: title: Uncommon Sigverif.EXE Child Process id: 7d4aaec2-08ed-4430-8b96-28420e030e04 status: test description: 'Detects uncommon child processes spawning from "sigverif.exe", which could indicate potential abuse of the latter as a living of the land binary in order to proxy execution. ' references: - https://www.hexacorn.com/blog/2018/04/27/i-shot-the-sigverif-exe-the-gui-based-lolbin/ - https://twitter.com/0gtweet/status/1457676633809330184 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-19 modified: 2024-08-27 tags: - attack.stealth - attack.t1216 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \sigverif.exe filter_main_werfault: Image: - C:\Windows\System32\WerFault.exe - C:\Windows\SysWOW64\WerFault.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently acc. Logsource: windows / ps_classic_start. Rule: title: Use Get-NetTCPConnection id: b366adb4-d63d-422d-8a2c-186463b5ded0 status: test description: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md#atomic-test-2---system-network-connections-discovery-with-powershell author: frack113 date: 2021-12-10 modified: 2023-10-27 tags: - attack.discovery - attack.t1049 logsource: product: windows category: ps_classic_start detection: selection: Data|contains: Get-NetTCPConnection condition: selection falsepositives: - Unknown level: low
Query: describe CVE-2015-6966
Matching passage: CVE-2015-6966. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in Nibbleblog before 4.0.5 allow remote attackers to hijack the authentication of administrators for requests that (1) create a post via a new_simple action to admin.php or (2) conduct cross-site scripting (XSS) attacks via the content parameter in a new_simple action to admin.php.
Near-miss passage: CVE-2015-2805. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in sec/content/sec_asa_users_local_db_add.html in the management web interface in Alcatel-Lucent OmniSwitch 6450, 6250, 6850E, 9000E, 6400, 6855, 6900, 10K, and 6860 with firmware 6.4.5.R02, 6.4.6.R01, 6.6.4.R01, 6.6.5.R02, 7.3.2.R01, 7.3.3.R01, 7.3.4.R01, and 8.1.1.R01 allows remote attackers to hijack the authentication of administrators for requests that create users via a crafted request.
Query: risk of Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect availability via unknown vectors related to Libc.
Matching passage: CVE-2015-0378. CWE: UNKNOWN. CVSS: 2.0999999046325684. Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect availability via unknown vectors related to Libc.
Near-miss passage: CVE-2015-1764. CWE: UNKNOWN. CVSS: 4.300000190734863. The web applications in Microsoft Exchange Server 2013 SP1 and Cumulative Update 8 allow remote attackers to bypass the Same Origin Policy and send HTTP traffic to intranet servers via a crafted request, related to a Server-Side Request Forgery (SSRF) issue, aka "Exchange Server-Side Request Forgery Vulnerability."
Query: patch priority for CVE-2015-6139
Matching passage: CVE-2015-6139. CWE: CWE-264. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 and Microsoft Edge mishandle content types, which allows remote attackers to execute arbitrary web script in a privileged context via a crafted web site, aka "Microsoft Browser Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-7266. CWE: CWE-264. CVSS: 7.5. The Interactive Advertising Bureau (IAB) OpenRTB 2.3 protocol implementation might allow remote attackers to conceal the status of ad transactions and potentially compromise bid integrity by leveraging failure to limit the time between bid responses and impression notifications, aka the Amnesia Bug.
Query: exploit Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect confidentiality, int
Matching passage: CVE-2015-2626. CWE: UNKNOWN. CVSS: 6.900000095367432. Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-2583, CVE-2015-2624, CVE-2015-2640, CVE-2015-2654, CVE-2015-2656, CVE-2015-4754, CVE-2015-4764, CVE-2015-4775, CVE-2015-4776, CVE-2015-4777, CVE-2015-4778, CVE-2015-4780, CVE-2015-4781, CVE-2015-4782, CVE-2015-4783, CVE-2015-4784, CVE-2015-4785, CVE-2015-4786, CVE-2015-4787, CVE-2015-4789, and CVE-2015-4790.
Near-miss passage: CVE-2015-0511. CWE: UNKNOWN. CVSS: 2.799999952316284. Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : SP.
Query: CVE similar to CVE-2015-2440
Matching passage: CVE-2015-2440. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft XML Core Services 3.0, 5.0, and 6.0 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "MSXML Information Disclosure Vulnerability."
Near-miss passage: CVE-2015-5859. CWE: CWE-200. CVSS: 4.300000190734863. The CFNetwork HTTPProtocol component in Apple iOS before 9 and OS X before 10.11 does not properly recognize the HSTS preload list during a Safari private-browsing session, which makes it easier for remote attackers to obtain sensitive information by sniffing the network.
Query: Sigma rule for Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon parent process or directory
Matching passage: Sigma rule: Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon parent process or directory. Logsource: windows / file_event. Rule: title: NTDS.DIT Creation By Uncommon Parent Process id: 4e7050dd-e548-483f-b7d6-527ab4fa784d related: - id: 11b1ed55-154d-4e82-8ad7-83739298f720 type: similar status: test description: Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon parent process or directory references: - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration - https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/ - https://pentestlab.blog/tag/ntds-dit/ - https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Gather/Copy-VSS.ps1 author: Florian Roth (Nextron Systems) date: 2022-03-11 modified: 2023-01-05 tags: - attack.credential-access - attack.t1003.003 logsource: product: windows category: file_event definition: 'Requirements: The "ParentImage" field is not available by default on EID 11 of Sysmon logs. To be able to use this rule to the full extent you need to enrich the log with additional ParentImage data' detection: selection_file: TargetFilename|endswith: \ntds.dit selection_process_parent: ParentImage|endswith: - \cscript.exe - \httpd.exe - \nginx.exe - \php-cgi.exe - \powershell.exe - \pwsh.exe - \w3wp.exe - \wscript.exe selection_process_parent_path: ParentImage|contains: - \apache - \tomcat - \AppData\ - \Temp\ - \Public\ - \PerfLogs\ condition: selection_file and 1 of selection_process_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the usage of "reg.exe" in order to query reconnaissance information from the registry. Adversaries may interact. Logsource: windows / process_creation. Rule: title: Potential Configuration And Service Reconnaissance Via Reg.EXE id: 970007b7-ce32-49d0-a4a4-fbef016950bd status: test description: Detects the usage of "reg.exe" in order to query reconnaissance information from the registry. Adversaries may interact with the Windows registry to gather information about credentials, the system, configuration, and installed software. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1012/T1012.md author: Timur Zinniatullin, oscd.community date: 2019-10-21 modified: 2023-02-05 tags: - attack.discovery - attack.t1012 - attack.t1007 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_flag: CommandLine|contains: query selection_key: CommandLine|contains: - currentVersion\windows - winlogon\ - currentVersion\shellServiceObjectDelayLoad - currentVersion\run - currentVersion\policies\explorer\run - currentcontrolset\services condition: all of selection_* falsepositives: - Discord level: medium
Query: describe CVE-2015-8300
Matching passage: CVE-2015-8300. CWE: CWE-275. CVSS: 7.800000190734863. Polycom BToE Connector before 3.0.0 uses weak permissions (Everyone: Full Control) for "Program Files (x86)\polycom\polycom btoe connector\plcmbtoesrv.exe," which allows local users to gain privileges via a Trojan horse file.
Near-miss passage: CVE-2015-7842. CWE: CWE-275. CVSS: 7.099999904632568. Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with software before V100R003C00SPC503, XH628 V3 with software before V100R003C00SPC602, RH1288 V3 with software before V100R003C00SPC602, RH2288A V2 with software before V100R002C00SPC701, RH1288A V2 with software before V100R002C00SPC502, RH8100 V3 with software before V100R003C00SPC110, CH222 V3 with software before V100R001C00SPC161, CH220 V3 with software before V100R001C00SPC161, and CH121 V3 with software before V100R001C00SPC161 allow remote authenticated operators to change server information by leveraging failure to verify user permissions.
Query: describe CVE-2015-4848
Matching passage: CVE-2015-4848. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in the Oracle Configurator component in Oracle Supply Chain Products Suite 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality via unknown vectors related to Integration with Peoplesoft.
Near-miss passage: CVE-2015-2115. CWE: UNKNOWN. CVSS: 2.700000047683716. Unspecified vulnerability in HP Capture and Route Software (HPCR) 1.3 before Patch 7, 1.3 FP1 before Patch 1, and 1.4 before Patch 1 allows remote authenticated users to obtain sensitive information via unknown vectors.
Query: describe CVE-2015-5537
Matching passage: CVE-2015-5537. CWE: CWE-312. CVSS: 4.300000190734863. The SSL layer of the HTTPS service in Siemens RuggedCom ROS before 4.2.0 and ROX II does not properly implement CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a different vulnerability than CVE-2014-3566.
Near-miss passage: CVE-2015-1931. CWE: CWE-312. CVSS: 5.5. IBM Java Security Components in IBM SDK, Java Technology Edition 8 before SR1 FP10, 7 R1 before SR3 FP10, 7 before SR9 FP10, 6 R1 before SR8 FP7, 6 before SR16 FP7, and 5.0 before SR16 FP13 stores plaintext information in memory dumps, which allows local users to obtain sensitive information by reading a file.
Query: patch priority for CVE-2015-3646
Matching passage: CVE-2015-3646. CWE: CWE-200. CVSS: 4.0. OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs.
Near-miss passage: CVE-2015-7322. CWE: CWE-200. CVSS: 5.0. The Secure Meeting (Pulse Collaboration) in Pulse Connect Secure (formerly Juniper Junos Pulse) before 7.1R22.1, 7.4, 8.0 before 8.0R11, and 8.1 before 8.1R3 provides different messages for attempts to join a meeting depending on the status of the meeting, which allows remote attackers to enumerate valid meeting ids via a series of requests.
Query: common weakness: Initialization of a Resource with an Insecure Default
Matching passage: CWE-1188 Initialization of a Resource with an Insecure Default. The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.
Near-miss passage: CWE-448 Obsolete Feature in UI. A UI function is obsolete and the product does not warn the user.
Query: vulnerability: The TLS protocol 1.2 and earlier supports the rsa_fixed_dh, dss_fixed_dh, rsa_fixed_ecdh, and ecdsa_fixed_ecdh values for ClientCertificateType but does not directly document the a
Matching passage: CVE-2015-8960. CWE: CWE-295. CVSS: 8.100000381469727. The TLS protocol 1.2 and earlier supports the rsa_fixed_dh, dss_fixed_dh, rsa_fixed_ecdh, and ecdsa_fixed_ecdh values for ClientCertificateType but does not directly document the ability to compute the master secret in certain situations with a client secret key and server public key but not a server secret key, which makes it easier for man-in-the-middle attackers to spoof TLS servers by leveraging knowledge of the secret key for an arbitrary installed client X.509 certificate, aka the "Key Compromise Impersonation (KCI)" issue.
Near-miss passage: CVE-2015-7778. CWE: CWE-295. CVSS: 5.900000095367432. Gurunavi App for iOS before 6.0.0 does not verify SSL certificates which could allow remote attackers to perform man-in-the-middle attacks.
Query: patch priority for CVE-2015-3363
Matching passage: CVE-2015-3363. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Contact Form Fields module before 6.x-2.3 for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete fields via unspecified vectors.
Near-miss passage: CVE-2015-10081. CWE: CWE-352. CVSS: 8.800000190734863. A vulnerability was found in arnoldle submitByMailPlugin 1.0b2.9 and classified as problematic. This issue affects some unknown processing of the file edit_list.php. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.0b2.9a is able to address this issue. The patch is named a739f680a1623d22f52ff1371e86ca472e63756f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-221495.
Query: describe CVE-2015-8550
Matching passage: CVE-2015-8550. CWE: CWE-284. CVSS: 8.199999809265137. Xen, when used on a system providing PV backends, allows local guest OS administrators to cause a denial of service (host OS crash) or gain privileges by writing to memory shared between the frontend and backend, aka a double fetch vulnerability.
Near-miss passage: CVE-2015-0141. CWE: CWE-284. CVSS: 4.0. IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to modify arbitrary user filters via a JSON request.
Query: vulnerability: Zimbra Collaboration before 8.6.0 patch5 has XSS.
Matching passage: CVE-2015-2249. CWE: CWE-79. CVSS: 5.400000095367432. Zimbra Collaboration before 8.6.0 patch5 has XSS.
Near-miss passage: CVE-2015-3386. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Node Access Product module for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a node title.
Query: Sigma rule for Detects the creation of a registry hive file (UsrClass.dat or NTUSER.DAT) outside of the standard user profile path. The
Matching passage: Sigma rule: Detects the creation of a registry hive file (UsrClass.dat or NTUSER.DAT) outside of the standard user profile path. The. Logsource: windows / file_event. Rule: title: Registry Hive File Staged Outside Standard User Profile Path id: a7f3c891-2e4d-4b6a-9f8c-d5e2a1b04c73 status: experimental description: 'Detects the creation of a registry hive file (UsrClass.dat or NTUSER.DAT) outside of the standard user profile path. These files generally contain various user-specific registry settings and are typically located in the user''s profile directory. Staging these files outside of the standard path can be indicative of an attacker attempting to manipulate user registry settings for persistence, privilege escalation, or dump user registry hives for credential harvesting. ' references: - https://github.com/MSNightmare/LegacyHive - https://git.projectnightcrawler.dev/NightmareEclipse/LegacyHive author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-07-23 tags: - attack.privilege-escalation - attack.t1548 - attack.credential-access - attack.t1003 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: - \UsrClass.dat - \NTUSER.DAT filter_main_usrclass: TargetFilename|endswith: \AppData\Local\Microsoft\Windows\UsrClass.dat filter_main_ntuser: TargetFilename|re|i: ^C:\\Users\\[^\\]+\\NTUSER\.DAT$ filter_main_system: TargetFilename|startswith: - C:\Windows\System32\config\ - C:\Windows\SYSVOL\ - C:\Windows\ServiceProfiles\ condition: selection and not 1 of filter_main_* falsepositives: - Backup or profile migration software - Forensic acquisition tools level: high regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_registry_hive_file_creation/info.yml
Near-miss passage: Sigma rule: Transferring files with well-known filenames (sensitive files with credential data) using network shares. Logsource: zeek / smb_files. Rule: title: Transferring Files with Credential Data via Network Shares - Zeek id: 2e69f167-47b5-4ae7-a390-47764529eff5 related: - id: 910ab938-668b-401b-b08c-b596e80fdca5 type: similar status: test description: Transferring files with well-known filenames (sensitive files with credential data) using network shares references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment author: '@neu5ron, Teymur Kheirkhabarov, oscd.community' date: 2020-04-02 modified: 2021-11-27 tags: - attack.credential-access - attack.t1003.002 - attack.t1003.001 - attack.t1003.003 logsource: product: zeek service: smb_files detection: selection: name: - \mimidrv - \lsass - \windows\minidump\ - \hiberfil - \sqldmpr - \sam - \ntds.dit - \security condition: selection falsepositives: - Transferring sensitive files for legitimate administration work by legitimate administrator level: medium