alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-7010
Matching passage: CVE-2015-7010. CWE: CWE-119. CVSS: 6.800000190734863. FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976, CVE-2015-6977, CVE-2015-6978, CVE-2015-6990, CVE-2015-6991, CVE-2015-6993, CVE-2015-7008, CVE-2015-7009, and CVE-2015-7018.
Near-miss passage: CVE-2015-5094. CWE: CWE-119. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3095, CVE-2015-5087, CVE-2015-5100, CVE-2015-5102, CVE-2015-5103, CVE-2015-5104, and CVE-2015-5115.
Query: CVE similar to CVE-2015-8797
Matching passage: CVE-2015-8797. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in webapp/web/js/scripts/plugins.js in the stats page in the Admin UI in Apache Solr before 5.3.1 allows remote attackers to inject arbitrary web script or HTML via the entry parameter to a plugins/cache URI.
Near-miss passage: CVE-2015-7365. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the plugin upgrade form in Revive Adserver before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via the filename of an uploaded file containing errors.
Query: patch priority for CVE-2015-0266
Matching passage: CVE-2015-0266. CWE: CWE-264. CVSS: 7.099999904632568. The Policy Admin Tool in Apache Ranger before 0.5.0 allows remote authenticated users to bypass intended access restrictions via direct access to module URLs.
Near-miss passage: CVE-2015-6335. CWE: CWE-264. CVSS: 9.0. The policy implementation in Cisco FireSIGHT Management Center 5.3.1.7, 5.4.0.4, and 6.0.0 for VMware allows remote authenticated administrators to bypass intended policy restrictions and execute Linux commands as root via unspecified vectors, aka Bug ID CSCuw12839.
Query: Multiple failed authentications followed by Component Object Model
Matching passage: T1559.001 Component Object Model. Tactics: execution. Description: Adversaries may use the Windows Component Object Model (COM) for local code execution. COM is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.(Citation: Fireeye Hunting COM June 2019) Through COM, a client object can call methods of server objects, which are typically binary Dynamic Link Libraries (DLL) or executables (EXE).(Citation: Microsoft COM) Remote COM execution is facilitated by [Remote Services](https://attack.mitre.org/techniques/T1021) such as [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) (DCOM).(Citation: Fireeye Hunting COM June 2019) Various COM interfaces are exposed that can be abused to invoke arbitrary execution via a variety of programming languages such as C, C++, Java, and [Visual Basic](https://attack.mitre.org/techniques/T1059/005).(Citation: Microsoft COM) Specific COM objects also exist to directly perform functions beyond code execution, such as creating a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), fileless download/execution, and other adversary behaviors related to privilege escalation and persistence.(Citation: Fireeye Hunting COM June 2019)(Citation: ProjectZero File Write EoP Apr 2018)
Near-miss passage: T1559 Inter-Process Communication. Tactics: execution. Description: Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. IPC is typically used by processes to share data, communicate with each other, or synchronize execution. IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern. Adversaries may abuse IPC to execute arbitrary code or commands. IPC mechanisms may differ depending on OS, but typically exists in a form accessible through programming languages/libraries or native interfaces such as Windows [Dynamic Data Exchange](https://attack.mitre.org/techniques/T1559/002) or [Component Object Model](https://attack.mitre.org/techniques/T1559/001). Linux environments support several different IPC mechanisms, two of which being sockets and pipes.(Citation: Linux IPC) Higher level execution mediums, such as those of [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)s, may also leverage underlying IPC mechanisms. Adversaries may also use [Remote Services](https://attack.mitre.org/techniques/T1021) such as [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) to facilitate remote IPC execution.(Citation: Fireeye Hunting COM June 2019)
Query: detection rule: Detects file access requests to the the Windows Data Protection API Master keys by an uncommon application. This can be
Matching passage: Sigma rule: Detects file access requests to the the Windows Data Protection API Master keys by an uncommon application. This can be. Logsource: windows / file_access. Rule: title: Access To Windows DPAPI Master Keys By Uncommon Applications id: 46612ae6-86be-4802-bc07-39b59feb1309 status: test description: 'Detects file access requests to the the Windows Data Protection API Master keys by an uncommon application. This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::masterkey" function ' references: - http://blog.harmj0y.net/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/ - https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-17 modified: 2026-07-28 tags: - attack.credential-access - attack.t1555.004 logsource: category: file_access product: windows definition: 'Requirements: Microsoft-Windows-Kernel-File ETW provider' detection: selection: FileName|contains: - \Microsoft\Protect\S-1-5-18\ - \Microsoft\Protect\S-1-5-21- filter_main_system_folders: Image|startswith: - C:\Program Files\ - C:\Program Files (x86)\ - C:\Windows\system32\ - C:\Windows\SysWOW64\ filter_main_explorer: Image: C:\Windows\explorer.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Find information about network devices that is not stored in config files. Logsource: cisco / aaa. Rule: title: Cisco Discovery id: 9705a6a1-6db6-4a16-a987-15b7151e299b status: test description: Find information about network devices that is not stored in config files references: - https://www.cisco.com/c/en/us/td/docs/server_nw_virtual/2-5_release/command_reference/show.html author: Austin Clark date: 2019-08-12 modified: 2023-01-04 tags: - attack.discovery - attack.t1083 - attack.t1201 - attack.t1057 - attack.t1018 - attack.t1082 - attack.t1016 - attack.t1049 - attack.t1033 - attack.t1124 logsource: product: cisco service: aaa detection: keywords: - dir - show arp - show cdp - show clock - show ip interface - show ip route - show ip sockets - show processes - show ssh - show users - show version condition: keywords falsepositives: - Commonly used by administrators for troubleshooting level: low
Query: CVE similar to CVE-2015-10013
Matching passage: CVE-2015-10013. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability was found in WebDevStudios taxonomy-switcher Plugin up to 1.0.3 on WordPress. It has been classified as problematic. Affected is the function taxonomy_switcher_init of the file taxonomy-switcher.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.0.4 is able to address this issue. It is recommended to upgrade the affected component. VDB-217446 is the identifier assigned to this vulnerability.
Near-miss passage: CVE-2015-2064. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in DLGuard 5, 4.6, and 4.5 allow remote attackers to inject arbitrary web script or HTML via the (1) page, (2) c, or (3) redirect parameter to index.php or (4) search field (searchTerm parameter) in the main page.
Query: CVE similar to CVE-2015-2869
Matching passage: CVE-2015-2869. CWE: CWE-119. CVSS: 5.0. The FileInfo plugin before 2.22 for Ghisler Total Commander allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via (1) a large Size value in the Archive Member Header of a COFF Archive Library file, (2) a large Number Of Symbols value in the 1st Linker Member of a COFF Archive Library file, (3) a large Resource Table Count value in the LE Header of a Linear Executable file, or (4) a large value in a certain Object field in a Resource Table Entry in a Linear Executable file.
Near-miss passage: CVE-2015-1001. CWE: CWE-119. CVSS: 10.0. Multiple stack-based buffer overflows in IniNet embeddedWebServer (aka eWebServer) before 2.02 allow remote attackers to execute arbitrary code via a long field in an HTTP request.
Query: SOC runbook when seeing SIEM correlation: persistence activity consistent with Hypervisor
Matching passage: Playbook for T1062 Hypervisor. 1) Validate alert telemetry against T1062. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: persistence. 5) Eradicate persistence and recover. Reference detection notes: **This technique has been deprecated and should no longer be used.** A type-1 hypervisor is a software layer that sits between the guest operating systems and system's hardware. (Citation: Wikipedia Hypervisor) It presents a virtual running environment to an operating system. An example of a common hypervisor is Xen. (Citation: Wikipedia Xen) A type-1 hypervisor operates at a level below the opera
Near-miss passage: Playbook for T1505.006 vSphere Installation Bundles. Different response path focused on persistence.
Query: detect Print Processors
Matching passage: T1547.012 Print Processors. Tactics: persistence, privilege escalation. Description: Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation. Print processors are DLLs that are loaded by the print spooler service, `spoolsv.exe`, during boot.(Citation: Microsoft Intro Print Processors) Adversaries may abuse the print spooler service by adding print processors that load malicious DLLs at startup. A print processor can be installed through the <code>AddPrintProcessor</code> API call with an account that has <code>SeLoadDriverPrivilege</code> enabled. Alternatively, a print processor can be registered to the print spooler service by adding the <code>HKLM\SYSTEM\\[CurrentControlSet or ControlSet001]\Control\Print\Environments\\[Windows architecture: e.g., Windows x64]\Print Processors\\[user defined]\Driver</code> Registry key that points to the DLL. For the malicious print processor to be correctly installed, the payload must be located in the dedicated system print-processor directory, that can be found with the <code>GetPrintProcessorDirectory</code> API call, or referenced via a relative path from this directory.(Citation: Microsoft AddPrintProcessor May 2018) After the print processors are installed, the print spooler service, which starts during boot, must be restarted in order for them to run.(Citation: ESET PipeMon May 2020) The print spooler service runs under SYSTEM level permissions, therefore print processors installed by an adversary may run under elevated privileges.
Near-miss passage: T1547.014 Active Setup. Tactics: persistence, privilege escalation. Description: Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine. Active Setup is a Windows mechanism that is used to execute programs when a user logs in. The value stored in the Registry key will be executed after a user logs into the computer.(Citation: Klein Active Setup 2010) These programs will be executed under the context of the user and will have the account's associated permissions level. Adversaries may abuse Active Setup by creating a key under <code> HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\</code> and setting a malicious value for <code>StubPath</code>. This value will serve as the program that will be executed when a user logs into the computer.(Citation: Mandiant Glyer APT 2010)(Citation: Citizenlab Packrat 2015)(Citation: FireEye CFR Watering Hole 2012)(Citation: SECURELIST Bright Star 2015)(Citation: paloalto Tropic Trooper 2016) Adversaries can abuse these components to execute malware, such as remote access tools, to maintain persistence through system reboots. Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make the Registry entries look as if they are associated with legitimate programs.
Query: exploit The ANSendApprovalToAuthorEnabled method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and A
Matching passage: CVE-2015-6712. CWE: UNKNOWN. CVSS: 6.800000190734863. The ANSendApprovalToAuthorEnabled method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7616, CVE-2015-7618, CVE-2015-7619, CVE-2015-7620, and CVE-2015-7623.
Near-miss passage: CVE-2015-2596. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in Oracle Java SE 7u80 allows remote attackers to affect integrity via unknown vectors related to Hotspot.
Query: exploit Directory traversal vulnerability in ManageEngine Firewall Analyzer before 8.0.
Matching passage: CVE-2015-7780. CWE: CWE-22. CVSS: 6.5. Directory traversal vulnerability in ManageEngine Firewall Analyzer before 8.0.
Near-miss passage: CVE-2015-5650. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in AjaXplorer 2.0 allows remote attackers to read arbitrary files via unspecified vectors.
Query: Sigma rule for Detects suspicious child processes of the Veeam service process. This could indicate potential RCE or SQL Injection.
Matching passage: Sigma rule: Detects suspicious child processes of the Veeam service process. This could indicate potential RCE or SQL Injection.. Logsource: windows / process_creation. Rule: title: Suspicious Child Process Of Veeam Dabatase id: d55b793d-f847-4eea-b59a-5ab09908ac90 related: - id: 869b9ca7-9ea2-4a5a-8325-e80e62f75445 type: similar status: test description: Detects suspicious child processes of the Veeam service process. This could indicate potential RCE or SQL Injection. references: - https://labs.withsecure.com/publications/fin7-target-veeam-servers author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-04 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \sqlservr.exe ParentCommandLine|contains: VEEAMSQL selection_child_1: Image|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe - \wsl.exe - \wt.exe CommandLine|contains: - '-ex ' - bypass - cscript - DownloadString - http:// - https:// - mshta - regsvr32 - rundll32 - wscript - 'copy ' selection_child_2: Image|endswith: - \net.exe - \net1.exe - \netstat.exe - \nltest.exe - \ping.exe - \tasklist.exe - \whoami.exe condition: selection_parent and 1 of selection_child_* level: critical
Near-miss passage: Sigma rule: Detects DLL sideloading of DLLs that are part of third party software (zoom, discord....etc). Logsource: windows / image_load. Rule: title: Third Party Software DLL Sideloading id: f9df325d-d7bc-4a32-8a1a-2cc61dcefc63 status: test description: Detects DLL sideloading of DLLs that are part of third party software (zoom, discord....etc) references: - https://hijacklibs.net/ author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research) date: 2022-08-17 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection_lenovo: ImageLoaded|endswith: \commfunc.dll filter_lenovo: - ImageLoaded|contains: \AppData\local\Google\Chrome\Application\ - ImageLoaded|startswith: - C:\Program Files\Lenovo\Communications Utility\ - C:\Program Files (x86)\Lenovo\Communications Utility\ selection_toshiba: ImageLoaded|endswith: \tosbtkbd.dll filter_toshiba: ImageLoaded|startswith: - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\ - C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\ condition: (selection_lenovo and not filter_lenovo) or (selection_toshiba and not filter_toshiba) falsepositives: - Unknown level: medium
Query: SOC runbook when seeing Encoded PowerShell / command-line abuse matching Component Object Model
Matching passage: Playbook for T1559.001 Component Object Model. 1) Validate alert telemetry against T1559.001. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: execution. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may use the Windows Component Object Model (COM) for local code execution. COM is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.(Citation: Fireeye Hunting COM June 2019) Through COM, a client object can call methods
Near-miss passage: Playbook for T1559.003 XPC Services. Different response path focused on execution.
Query: patch priority for CVE-2015-4070
Matching passage: CVE-2015-4070. CWE: CWE-601. CVSS: 6.099999904632568. Open redirect vulnerability in the proxyimages function in wowproxy.php in the Wow Moodboard Lite plugin 1.1.1.1 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.
Near-miss passage: CVE-2015-5354. CWE: CWE-601. CVSS: 5.800000190734863. Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter to admin/nos/login.
Query: detect Detects execution of "odbcconf" where the path of the DLL being registered is located in a potentially suspicious locati in logs
Matching passage: Sigma rule: Detects execution of "odbcconf" where the path of the DLL being registered is located in a potentially suspicious locati. Logsource: windows / process_creation. Rule: title: Odbcconf.EXE Suspicious DLL Location id: 6b65c28e-11f3-46cb-902a-68f2cafaf474 status: test description: Detects execution of "odbcconf" where the path of the DLL being registered is located in a potentially suspicious location. references: - https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16 - https://www.trendmicro.com/en_us/research/17/h/backdoor-carrying-emails-set-sights-on-russian-speaking-businesses.html - https://securityintelligence.com/posts/raspberry-robin-worm-dridex-malware/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-22 modified: 2023-05-26 tags: - attack.stealth - attack.t1218.008 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \odbcconf.exe - OriginalFileName: odbcconf.exe selection_cli: CommandLine|contains: - :\PerfLogs\ - :\ProgramData\ - :\Temp\ - :\Users\Public\ - :\Windows\Registration\CRMLog - :\Windows\System32\com\dmp\ - :\Windows\System32\FxsTmp\ - :\Windows\System32\Microsoft\Crypto\RSA\MachineKeys\ - :\Windows\System32\spool\drivers\color\ - :\Windows\System32\spool\PRINTERS\ - :\Windows\System32\spool\SERVERS\ - :\Windows\System32\Tasks_Migrated\ - :\Windows\System32\Tasks\Microsoft\Windows\SyncCenter\ - :\Windows\SysWOW64\com\dmp\ - :\Windows\SysWOW64\FxsTmp\ - :\Windows\SysWOW64\Tasks\Microsoft\Windows\PLA\System\ - :\Windows\SysWOW64\Tasks\Microsoft\Windows\SyncCenter\ - :\Windows\Tasks\ - :\Windows\Temp\ - :\Windows\Tracing\ - \AppData\Local\Temp\ - \AppData\Roaming\ condition: all of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects execution of the "mshta" utility with an argument containing the "http" keyword, which could indicate that an at. Logsource: windows / process_creation. Rule: title: Remotely Hosted HTA File Executed Via Mshta.EXE id: b98d0db6-511d-45de-ad02-e82a98729620 status: test description: Detects execution of the "mshta" utility with an argument containing the "http" keyword, which could indicate that an attacker is executing a remotely hosted malicious hta file references: - https://www.trendmicro.com/en_us/research/22/e/avoslocker-ransomware-variant-abuses-driver-file-to-disable-anti-Virus-scans-log4shell.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-08 modified: 2023-02-06 tags: - attack.execution - attack.stealth - attack.t1218.005 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \mshta.exe - OriginalFileName: MSHTA.EXE selection_cli: CommandLine|contains: - http:// - https:// - ftp:// condition: all of selection_* falsepositives: - Unknown level: high