alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: patch priority for CVE-2015-4736
Matching passage: CVE-2015-4736. CWE: UNKNOWN. CVSS: 9.300000190734863. Unspecified vulnerability in Oracle Java SE 7u80 and 8u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.
Near-miss passage: CVE-2015-1250. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in Google Chrome before 42.0.2311.135 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Query: rule covering Detects file names with specific patterns seen generated and used by tools such as Mimikatz and DSInternals related to e
Matching passage: Sigma rule: Detects file names with specific patterns seen generated and used by tools such as Mimikatz and DSInternals related to e. Logsource: windows / file_event. Rule: title: DPAPI Backup Keys And Certificate Export Activity IOC id: 7892ec59-c5bb-496d-8968-e5d210ca3ac4 status: test description: 'Detects file names with specific patterns seen generated and used by tools such as Mimikatz and DSInternals related to exported or stolen DPAPI backup keys and certificates. ' references: - https://www.dsinternals.com/en/dpapi-backup-key-theft-auditing/ - https://github.com/MichaelGrafnetter/DSInternals/blob/39ee8a69bbdc1cfd12c9afdd7513b4788c4895d4/Src/DSInternals.Common/Data/DPAPI/DPAPIBackupKey.cs#L28-L32 author: Nounou Mbeiri, Nasreddine Bencherchali (Nextron Systems) date: 2024-06-26 tags: - attack.credential-access - attack.t1555 - attack.t1552.004 logsource: product: windows category: file_event detection: selection: TargetFilename|contains: - ntds_capi_ - ntds_legacy_ - ntds_unknown_ TargetFilename|endswith: - .cer - .key - .pfx - .pvk condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detect commandline usage of Microsoft Connection Manager Profile Installer (cmstp.exe) to install specially formatted lo. Logsource: windows / process_creation. Rule: title: Bypass UAC via CMSTP id: e66779cc-383e-4224-a3a4-267eeb585c40 status: test description: Detect commandline usage of Microsoft Connection Manager Profile Installer (cmstp.exe) to install specially formatted local .INF files references: - https://eqllib.readthedocs.io/en/latest/analytics/e584f1a1-c303-4885-8a66-21360c90995b.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.003/T1218.003.md - https://lolbas-project.github.io/lolbas/Binaries/Cmstp/ author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community date: 2019-10-24 modified: 2022-08-30 tags: - attack.privilege-escalation - attack.stealth - attack.t1548.002 - attack.t1218.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \cmstp.exe - OriginalFileName: CMSTP.EXE selection_cli: CommandLine|contains: - /s - -s - /au - -au - /ni - -ni condition: all of selection* falsepositives: - Legitimate use of cmstp.exe utility by legitimate user level: high
Query: risk of The packet-storing feature on Cisco 9900 phones with firmware 9.3(2) does not properly support the RTP protocol, which allows remote attackers to cause a denial of service (device 
Matching passage: CVE-2015-4226. CWE: CWE-399. CVSS: 7.099999904632568. The packet-storing feature on Cisco 9900 phones with firmware 9.3(2) does not properly support the RTP protocol, which allows remote attackers to cause a denial of service (device hang) by sending malformed RTP packets after a call is answered, aka Bug ID CSCur39976.
Near-miss passage: CVE-2015-1819. CWE: CWE-399. CVSS: 5.0. The xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data, related to an XML Entity Expansion (XEE) attack.
Query: detection rule: Detects usage of namp/zenmap. Adversaries may attempt to get a listing of services running on remote hosts, including th
Matching passage: Sigma rule: Detects usage of namp/zenmap. Adversaries may attempt to get a listing of services running on remote hosts, including th. Logsource: windows / process_creation. Rule: title: PUA - Nmap/Zenmap Execution id: f6ecd1cf-19b8-4488-97f6-00f0924991a3 status: test description: Detects usage of namp/zenmap. Adversaries may attempt to get a listing of services running on remote hosts, including those that may be vulnerable to remote software exploitation references: - https://nmap.org/ - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md#atomic-test-3---port-scan-nmap-for-windows author: frack113 date: 2021-12-10 modified: 2023-12-11 tags: - attack.discovery - attack.t1046 logsource: category: process_creation product: windows detection: selection: - Image|endswith: - \nmap.exe - \zennmap.exe - OriginalFileName: - nmap.exe - zennmap.exe condition: selection falsepositives: - Legitimate administrator activity level: medium
Near-miss passage: Sigma rule: Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration. Logsource: windows / dns_query. Rule: title: DNS Query To Ufile.io id: 1cbbeaaf-3c8c-4e4c-9d72-49485b6a176b related: - id: 090ffaad-c01a-4879-850c-6d57da98452d type: similar status: test description: Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration references: - https://thedfirreport.com/2021/12/13/diavol-ransomware/ author: yatinwad, TheDFIRReport date: 2022-06-23 modified: 2023-09-18 tags: - attack.exfiltration - attack.t1567.002 logsource: product: windows category: dns_query detection: selection: QueryName|contains: ufile.io condition: selection falsepositives: - DNS queries for "ufile" are not malicious by nature necessarily. Investigate the source to determine the necessary actions to take level: low
Query: Encoded PowerShell / command-line abuse matching Purchase Technical Data
Matching passage: T1597.002 Purchase Technical Data. Tactics: reconnaissance. Description: Adversaries may purchase technical information about victims that can be used during targeting. Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets. Adversaries may purchase information about their already identified targets, or use purchased data to discover opportunities for successful breaches. Threat actors may gather various technical details from purchased data, including but not limited to employee contact information, credentials, or specifics regarding a victim’s infrastructure.(Citation: ZDNET Selling Data) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).
Near-miss passage: T1597.001 Threat Intel Vendors. Tactics: reconnaissance. Description: Adversaries may search private data from threat intelligence vendors for information that can be used during targeting. Threat intelligence vendors may offer paid feeds or portals that offer more data than what is publicly reported. Although sensitive details (such as customer names and other identifiers) may be redacted, this information may contain trends regarding breaches such as target industries, attribution claims, and successful TTPs/countermeasures.(Citation: D3Secutrity CTI Feeds) Adversaries may search in private threat intelligence vendor data to gather actionable information. If a threat actor is searching for information on their own activities, that falls under [Search Threat Vendor Data](https://attack.mitre.org/techniques/T1681). Information reported by vendors may also reveal opportunities other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190) or [External Remote Services](https://attack.mitre.org/techniques/T1133)).
Query: write Sigma for Detects DLL sideloading of VMGuestLib.dll by the WmiApSrv service.
Matching passage: Sigma rule: Detects DLL sideloading of VMGuestLib.dll by the WmiApSrv service.. Logsource: windows / image_load. Rule: title: VMGuestLib DLL Sideload id: 70e8e9b4-6a93-4cb7-8cde-da69502e7aff status: test description: Detects DLL sideloading of VMGuestLib.dll by the WmiApSrv service. references: - https://decoded.avast.io/martinchlumecky/png-steganography/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-01 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|contains|all: - \VMware\VMware Tools\vmStatsProvider\win32 - \vmGuestLib.dll Image|endswith: \Windows\System32\wbem\WmiApSrv.exe filter: Signed: 'true' condition: selection and not filter falsepositives: - FP could occur if the legitimate version of vmGuestLib already exists on the system level: medium
Near-miss passage: Sigma rule: Detects a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activit. Logsource: windows / process_creation. Rule: title: Privilege Escalation via Named Pipe Impersonation id: 9bd04a79-dabe-4f1f-a5ff-92430265c96b related: - id: f35c5d71-b489-4e22-a115-f003df287317 type: derived status: test description: Detects a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activity. references: - https://www.elastic.co/guide/en/security/current/privilege-escalation-via-named-pipe-impersonation.html author: Tim Rauch, Elastic (idea) date: 2022-09-27 modified: 2022-12-30 tags: - attack.lateral-movement - attack.t1021 logsource: category: process_creation product: windows detection: selection_name: - Image|endswith: - \cmd.exe - \powershell.exe - OriginalFileName: - Cmd.Exe - PowerShell.EXE selection_args: CommandLine|contains|all: - echo - '>' - \\\\.\\pipe\\ condition: all of selection* falsepositives: - Other programs that cause these patterns (please report) level: high
Query: risk of Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before
Matching passage: CVE-2015-3133. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3117, CVE-2015-3123, CVE-2015-3130, CVE-2015-3134, and CVE-2015-4431.
Near-miss passage: CVE-2015-6080. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6068, CVE-2015-6072, CVE-2015-6073, CVE-2015-6075, CVE-2015-6077, CVE-2015-6079, and CVE-2015-6082.
Query: patch priority for CVE-2015-1537
Matching passage: CVE-2015-1537. CWE: CWE-190. CVSS: 7.800000190734863. Integer overflow in IHDCP.cpp in the media_server component in Android allows remote attackers to execute arbitrary code via a crafted application.
Near-miss passage: CVE-2015-8933. CWE: CWE-190. CVSS: 5.5. Integer overflow in the archive_read_format_tar_skip function in archive_read_support_format_tar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted tar file.
Query: CVE similar to CVE-2015-3125
Matching passage: CVE-2015-3125. CWE: CWE-284. CVSS: 5.0. Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2014-0578, CVE-2015-3115, CVE-2015-3116, and CVE-2015-5116.
Near-miss passage: CVE-2015-1464. CWE: CWE-284. CVSS: 6.400000095367432. RT (aka Request Tracker) before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to hijack sessions via an RSS feed URL.
Query: SOC runbook when seeing Suspicious Exfiltration to Cloud Storage execution detected on endpoint
Matching passage: Playbook for T1567.002 Exfiltration to Cloud Storage. 1) Validate alert telemetry against T1567.002. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: exfiltration. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet. Examples of cloud storage services include Dropbox and Google Docs. Exfiltration to these cloud storage services can provide a significant amount of cove
Near-miss passage: Playbook for T1567 Exfiltration Over Web Service. Different response path focused on exfiltration.
Query: exploit Stack-based buffer overflow in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.
Matching passage: CVE-2015-8407. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8457.
Near-miss passage: CVE-2015-8306. CWE: CWE-119. CVSS: 7.800000190734863. Buffer overflow in the HIFI driver in Huawei P8 phones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230 allows attackers to cause a denial of service (system crash) or execute arbitrary code via an unspecified parameter.
Query: Sigma rule for Detects known sensitive file extensions via Zeek
Matching passage: Sigma rule: Detects known sensitive file extensions via Zeek. Logsource: zeek / smb_files. Rule: title: Suspicious Access to Sensitive File Extensions - Zeek id: 286b47ed-f6fe-40b3-b3a8-35129acd43bc related: - id: 91c945bc-2ad1-4799-a591-4d00198a1215 type: derived status: test description: Detects known sensitive file extensions via Zeek references: - Internal Research author: Samir Bousseaden, @neu5ron date: 2020-04-02 modified: 2025-10-17 tags: - attack.collection logsource: product: zeek service: smb_files detection: selection: name|endswith: - .pst - .ost - .msg - .nst - .oab - .edb - .nsf - .bak - .dmp - .kirbi - .rdp condition: selection falsepositives: - Help Desk operator doing backup or re-imaging end user machine or backup software - Users working with these data types or exchanging message files level: medium
Near-miss passage: Sigma rule: Detects possible Kerberos Replay Attack on the domain controllers when "KRB_AP_ERR_REPEAT" Kerberos response is sent to. Logsource: windows / security. Rule: title: Replay Attack Detected id: 5a44727c-3b85-4713-8c44-4401d5499629 status: test description: Detects possible Kerberos Replay Attack on the domain controllers when "KRB_AP_ERR_REPEAT" Kerberos response is sent to the client references: - https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4649 author: frack113 date: 2022-10-14 tags: - attack.credential-access - attack.t1558 logsource: service: security product: windows detection: selection: EventID: 4649 condition: selection falsepositives: - Unknown level: high
Query: exploit The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 does not perform token comp
Matching passage: CVE-2015-8624. CWE: CWE-352. CVSS: 8.800000190734863. The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 does not perform token comparison in constant time before determining if a debugging message should be logged, which allows remote attackers to guess the edit token and bypass CSRF protection via a timing attack, a different vulnerability than CVE-2015-8623.
Near-miss passage: CVE-2015-3363. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Contact Form Fields module before 6.x-2.3 for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete fields via unspecified vectors.
Query: describe CVE-2015-4383
Matching passage: CVE-2015-4383. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Decisions module for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that remove individual voters via unspecified vectors.
Near-miss passage: CVE-2015-3370. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Node Invite module before 6.x-2.5 for Drupal allows remote attackers to hijack the authentication of users with the "node_invite_can_manage_invite" permission for requests that re-enable node invitations via unspecified vectors.
Query: describe CVE-2015-2993
Matching passage: CVE-2015-2993. CWE: CWE-264. CVSS: 7.5. SysAid Help Desk before 15.2 does not properly restrict access to certain functionality, which allows remote attackers to (1) create administrator accounts via a crafted request to /createnewaccount or (2) write to arbitrary files via the fileName parameter to /userentry.
Near-miss passage: CVE-2015-0767. CWE: CWE-264. CVSS: 7.199999809265137. Cisco Edge 300 software 1.0 and 1.1 on Edge 340 devices allows local users to obtain root privileges via unspecified commands, aka Bug ID CSCur18132.
Query: exploit Stack-based buffer overflow in the OpenForIPCamTest method in the RTSPVIDEO.rtspvideoCtrl.1 (aka SStreamVideo) ActiveX control in Moxa SoftCMS before 1.3 allows remote attackers to
Matching passage: CVE-2015-1000. CWE: CWE-119. CVSS: 6.800000190734863. Stack-based buffer overflow in the OpenForIPCamTest method in the RTSPVIDEO.rtspvideoCtrl.1 (aka SStreamVideo) ActiveX control in Moxa SoftCMS before 1.3 allows remote attackers to execute arbitrary code via the StrRtspPath parameter.
Near-miss passage: CVE-2015-5937. CWE: CWE-119. CVSS: 6.800000190734863. ImageIO in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted metadata in an image, a different vulnerability than CVE-2015-5935, CVE-2015-5936, and CVE-2015-5939.
Query: vulnerability: In Cloudera Hue, there is privilege escalation by a read-only user when CDH 5.x brefore 5.4.9 is used.
Matching passage: CVE-2015-7831. CWE: CWE-269. CVSS: 8.800000190734863. In Cloudera Hue, there is privilege escalation by a read-only user when CDH 5.x brefore 5.4.9 is used.
Near-miss passage: CVE-2015-4719. CWE: CWE-269. CVSS: 9.800000190734863. The client API authentication mechanism in Pexip Infinity before 10 allows remote attackers to gain privileges via a crafted request.
Query: describe CVE-2015-7641
Matching passage: CVE-2015-7641. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7636, CVE-2015-7637, CVE-2015-7638, CVE-2015-7639, CVE-2015-7640, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644.
Near-miss passage: CVE-2015-6011. CWE: UNKNOWN. CVSS: 5.0. Web Reference Database (aka refbase) through 0.9.6 and bleeding-edge before 2015-01-08 allows remote attackers to conduct XML injection attacks via (1) the id parameter to unapi.php or (2) the stylesheet parameter to sru.php.
Query: risk of Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before
Matching passage: CVE-2015-3105. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Near-miss passage: CVE-2015-2379. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Query: describe CVE-2015-1256
Matching passage: CVE-2015-1256. CWE: UNKNOWN. CVSS: 7.5. Use-after-free vulnerability in the SVG implementation in Blink, as used in Google Chrome before 43.0.2357.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document that leverages improper handling of a shadow tree for a use element.
Near-miss passage: CVE-2015-2617. CWE: UNKNOWN. CVSS: 6.5. Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Partition.