alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-6638
Matching passage: CVE-2015-6638. CWE: CWE-264. CVSS: 7.800000190734863. The Imagination Technologies driver in Android 5.x before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to gain privileges via a crafted application, aka internal bug 24673908.
Near-miss passage: CVE-2015-7408. CWE: CWE-264. CVSS: 3.700000047683716. The server in IBM Spectrum Protect (aka Tivoli Storage Manager) 5.5 and 6.x before 6.3.5.1 and 7.x before 7.1.4 does not properly restrict use of the ASNODENAME option, which allows remote attackers to read or write to backup data by leveraging proxy authority.
Query: explain CWE-125
Matching passage: CWE-125 Out-of-bounds Read. The product reads data past the end, or before the beginning, of the intended buffer.
Near-miss passage: CWE-531 Inclusion of Sensitive Information in Test Code. Accessible test applications can pose a variety of security risks. Since developers or administrators rarely consider that someone besides themselves would even know about the existence of these applications, it is common for them to contain sensitive information or functions.
Query: describe CVE-2015-0458
Matching passage: CVE-2015-0458. CWE: UNKNOWN. CVSS: 7.599999904632568. Unspecified vulnerability in in Oracle Java SE 6u91, 7u76, and 8u40 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.
Near-miss passage: CVE-2015-9067. CWE: UNKNOWN. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a potential compiler optimization of memset() is addressed.
Query: describe CVE-2015-2614
Matching passage: CVE-2015-2614. CWE: UNKNOWN. CVSS: 4.900000095367432. Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect availability via vectors related to NVM Express SSD driver.
Near-miss passage: CVE-2015-0455. CWE: UNKNOWN. CVSS: 6.800000190734863. Unspecified vulnerability in the XDB - XML Database component in Oracle Database Server 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality via unknown vectors.
Query: risk of IBM BigFix Remote Control before Interim Fix pack 9.1.2-TIV-IBRC912-IF0001 makes it easier for man-in-the-middle attackers to decrypt traffic by leveraging a weakness in its encryp
Matching passage: CVE-2015-4953. CWE: CWE-326. CVSS: 4.800000190734863. IBM BigFix Remote Control before Interim Fix pack 9.1.2-TIV-IBRC912-IF0001 makes it easier for man-in-the-middle attackers to decrypt traffic by leveraging a weakness in its encryption protocol. IBM X-Force ID: 105197.
Near-miss passage: CVE-2015-0575. CWE: CWE-326. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, insecure ciphersuites were included in the default configuration.
Query: risk of The wp-rollback plugin before 1.2.3 for WordPress has XSS.
Matching passage: CVE-2015-9342. CWE: CWE-79. CVSS: 6.099999904632568. The wp-rollback plugin before 1.2.3 for WordPress has XSS.
Near-miss passage: CVE-2015-4541. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA Archer GRC 5.x before 5.5.3 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Query: vulnerability: Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary
Matching passage: CVE-2015-5260. CWE: CWE-119. CVSS: 7.800000190734863. Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary code on the host via QXL commands related to the surface_id parameter.
Near-miss passage: CVE-2015-5120. CWE: CWE-119. CVSS: 10.0. Adobe Shockwave Player before 12.1.9.159 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5121.
Query: detection rule: Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory re
Matching passage: Sigma rule: Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory re. Logsource: windows / process_creation. Rule: title: HackTool - WinPwn Execution id: d557dc06-62e8-4468-a8e8-7984124908ce related: - id: 851fd622-b675-4d26-b803-14bc7baa517a type: similar status: test description: 'Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation. ' author: Swachchhanda Shrawan Poudel date: 2023-12-04 references: - https://github.com/S3cur3Th1sSh1t/WinPwn - https://www.publicnow.com/view/EB87DB49C654D9B63995FAD4C9DE3D3CC4F6C3ED?1671634841 - https://reconshell.com/winpwn-tool-for-internal-windows-pentesting-and-ad-security/ - https://github.com/redcanaryco/atomic-red-team/blob/4d6c4e8e23d465af7a2388620cfe3f8c76e16cf0/atomics/T1082/T1082.md - https://grep.app/search?q=winpwn&filter[repo][0]=redcanaryco/atomic-red-team tags: - attack.credential-access - attack.discovery - attack.execution - attack.privilege-escalation - attack.t1046 - attack.t1082 - attack.t1106 - attack.t1518 - attack.t1548.002 - attack.t1552.001 - attack.t1555 - attack.t1555.003 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - Offline_Winpwn - 'WinPwn ' - WinPwn.exe - WinPwn.ps1 condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects linux package removal using builtin tools such as "yum", "apt", "apt-get" or "dpkg".. Logsource: linux / process_creation. Rule: title: Linux Package Uninstall id: 95d61234-7f56-465c-6f2d-b562c6fedbc4 status: test description: Detects linux package removal using builtin tools such as "yum", "apt", "apt-get" or "dpkg". references: - https://sysdig.com/blog/mitre-defense-evasion-falco - https://www.tutorialspoint.com/how-to-install-a-software-on-linux-using-yum-command - https://linuxhint.com/uninstall_yum_package/ - https://linuxhint.com/uninstall-debian-packages/ author: Tuan Le (NCSGroup), Nasreddine Bencherchali (Nextron Systems) date: 2023-03-09 tags: - attack.stealth - attack.t1070 logsource: product: linux category: process_creation detection: selection_yum: Image|endswith: /yum CommandLine|contains: - erase - remove selection_apt: Image|endswith: - /apt - /apt-get CommandLine|contains: - remove - purge selection_dpkg: Image|endswith: /dpkg CommandLine|contains: - '--remove ' - ' -r ' selection_rpm: Image|endswith: /rpm CommandLine|contains: ' -e ' condition: 1 of selection_* falsepositives: - Administrator or administrator scripts might delete packages for several reasons (debugging, troubleshooting). level: low
Query: vulnerability: The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a proble
Matching passage: CVE-2015-8103. CWE: CWE-502. CVSS: 9.800000190734863. The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy variant in 'ysoserial'".
Near-miss passage: CVE-2015-2020. CWE: CWE-502. CVSS: 9.800000190734863. The MyScript SDK before 1.3 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.
Query: threat report mentioning Odbcconf
Matching passage: T1218.008 Odbcconf. Tactics: stealth. Description: Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads. Odbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity (ODBC) drivers and data source names.(Citation: Microsoft odbcconf.exe) The Odbcconf.exe binary may be digitally signed by Microsoft. Adversaries may abuse odbcconf.exe to bypass application control solutions that do not account for its potential abuse. Similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010), odbcconf.exe has a <code>REGSVR</code> flag that can be misused to execute DLLs (ex: <code>odbcconf.exe /S /A &lbrace;REGSVR "C:\Users\Public\file.dll"&rbrace;</code>). (Citation: LOLBAS Odbcconf)(Citation: TrendMicro Squiblydoo Aug 2017)(Citation: TrendMicro Cobalt Group Nov 2017)
Near-miss passage: T1218 System Binary Proxy Execution. Tactics: stealth. Description: Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system.(Citation: LOLBAS Project) Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands. Similarly, on Linux systems adversaries may abuse trusted binaries such as <code>split</code> to proxy execution of malicious commands.(Citation: split man page)(Citation: GTFO split)
Query: vulnerability: Unspecified vulnerability in Oracle Sun Solaris 10 and 11 allows local users to affect confidentiality via vectors related to RPC Utility.
Matching passage: CVE-2015-0430. CWE: UNKNOWN. CVSS: 1.899999976158142. Unspecified vulnerability in Oracle Sun Solaris 10 and 11 allows local users to affect confidentiality via vectors related to RPC Utility.
Near-miss passage: CVE-2015-4841. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Siebel Core - Server Framework component in Oracle Siebel CRM IP2014 and IP2015 allows remote attackers to affect confidentiality via unknown vectors related to Services.
Query: rule covering Detects the use of "sw_vers" for system information discovery
Matching passage: Sigma rule: Detects the use of "sw_vers" for system information discovery. Logsource: macos / process_creation. Rule: title: System Information Discovery Using sw_vers id: 5de06a6f-673a-4fc0-8d48-bcfe3837b033 status: test description: Detects the use of "sw_vers" for system information discovery references: - https://www.virustotal.com/gui/file/d3fa64f63563fe958b75238742d1e473800cb5f49f5cb79d38d4aa3c93709026/behavior - https://www.virustotal.com/gui/file/03b71eaceadea05bc0eea5cddecaa05f245126d6b16cfcd0f3ba0442ac58dab3/behavior - https://ss64.com/osx/sw_vers.html author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-12-20 tags: - attack.discovery - attack.t1082 logsource: product: macos category: process_creation detection: selection_image: Image|endswith: /sw_vers selection_options: CommandLine|contains: - -buildVersion - -productName - -productVersion condition: all of selection_* falsepositives: - Legitimate administrative activities level: medium
Near-miss passage: Sigma rule: Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. Which is fairly uncommon and could indicate po. Logsource: windows / process_creation. Rule: title: ConvertTo-SecureString Cmdlet Usage Via CommandLine id: 74403157-20f5-415d-89a7-c505779585cf status: test description: Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. Which is fairly uncommon and could indicate potential suspicious activity references: - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=65 - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/convertto-securestring?view=powershell-7.3#examples author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton date: 2020-10-11 modified: 2023-02-01 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_cli: CommandLine|contains: ConvertTo-SecureString condition: all of selection_* falsepositives: - Legitimate use to pass password to different powershell commands level: medium
Query: CVE similar to CVE-2015-5049
Matching passage: CVE-2015-5049. CWE: CWE-89. CVSS: 5.400000095367432. SQL injection vulnerability in the API in IBM OpenPages GRC Platform 7.0 before 7.0.0.4 IF3 and 7.1 before 7.1.0.1 IF6 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-1616. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3.400 allows remote authenticated ePO users to execute arbitrary SQL commands via unspecified vectors.
Query: mitigate Threat Intel Vendors
Matching passage: T1597.001 Threat Intel Vendors. Tactics: reconnaissance. Description: Adversaries may search private data from threat intelligence vendors for information that can be used during targeting. Threat intelligence vendors may offer paid feeds or portals that offer more data than what is publicly reported. Although sensitive details (such as customer names and other identifiers) may be redacted, this information may contain trends regarding breaches such as target industries, attribution claims, and successful TTPs/countermeasures.(Citation: D3Secutrity CTI Feeds) Adversaries may search in private threat intelligence vendor data to gather actionable information. If a threat actor is searching for information on their own activities, that falls under [Search Threat Vendor Data](https://attack.mitre.org/techniques/T1681). Information reported by vendors may also reveal opportunities other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190) or [External Remote Services](https://attack.mitre.org/techniques/T1133)).
Near-miss passage: T1597.002 Purchase Technical Data. Tactics: reconnaissance. Description: Adversaries may purchase technical information about victims that can be used during targeting. Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets. Adversaries may purchase information about their already identified targets, or use purchased data to discover opportunities for successful breaches. Threat actors may gather various technical details from purchased data, including but not limited to employee contact information, credentials, or specifics regarding a victim’s infrastructure.(Citation: ZDNET Selling Data) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).
Query: rule covering Detects when a user creates a Lambda function URL configuration, which could be used to expose the function to the inter
Matching passage: Sigma rule: Detects when a user creates a Lambda function URL configuration, which could be used to expose the function to the inter. Logsource: aws / cloudtrail. Rule: title: New AWS Lambda Function URL Configuration Created id: ec541962-c05a-4420-b9ea-84de072d18f4 status: experimental description: 'Detects when a user creates a Lambda function URL configuration, which could be used to expose the function to the internet and potentially allow unauthorized access to the function''s IAM role for AWS API calls. This could give an adversary access to the privileges associated with the Lambda service role that is attached to that function. ' references: - https://docs.aws.amazon.com/lambda/latest/dg/API_CreateFunctionUrlConfig.html - https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lambda-privesc - https://www.wiz.io/blog/how-to-set-secure-defaults-on-aws author: Ivan Saakov date: 2024-12-19 tags: - attack.initial-access - attack.privilege-escalation logsource: product: aws service: cloudtrail detection: selection: eventSource: lambda.amazonaws.com eventName: CreateFunctionUrlConfig condition: selection falsepositives: - Creating a Lambda function URL configuration may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Creating a Lambda function URL configuration from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects the deletion of a process's executable by itself. This is usually not possible without workarounds and may be us. Logsource: windows / file_delete. Rule: title: Process Deletion of Its Own Executable id: f01d1f70-cd41-42ec-9c0b-26dd9c22bf29 status: test description: 'Detects the deletion of a process''s executable by itself. This is usually not possible without workarounds and may be used by malware to hide its traces. ' references: - https://github.com/joaoviictorti/RustRedOps/tree/ce04369a246006d399e8c61d9fe0e6b34f988a49/Self_Deletion author: Max Altgelt (Nextron Systems) date: 2024-09-03 tags: - attack.stealth logsource: product: windows category: file_delete detection: selection: TargetFilename|fieldref: Image condition: selection falsepositives: - Some false positives are to be expected from uninstallers. level: medium
Query: exploit Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.
Matching passage: CVE-2015-5561. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5557, CVE-2015-5559, CVE-2015-5563, CVE-2015-5564, and CVE-2015-5565.
Near-miss passage: CVE-2015-0797. CWE: UNKNOWN. CVSS: 6.800000190734863. GStreamer before 1.4.5, as used in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 on Linux, allows remote attackers to cause a denial of service (buffer over-read and application crash) or possibly execute arbitrary code via crafted H.264 video data in an m4v file.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the execution of format.com with an uncommon filesystem selection that could indicate a defense evasion activity. Logsource: windows / process_creation. Rule: title: Uncommon FileSystem Load Attempt By Format.com id: 9fb6b26e-7f9e-4517-a48b-8cac4a1b6c60 status: test description: 'Detects the execution of format.com with an uncommon filesystem selection that could indicate a defense evasion activity in which "format.com" is used to load malicious DLL files or other programs. ' references: - https://twitter.com/0gtweet/status/1477925112561209344 - https://twitter.com/wdormann/status/1478011052130459653?s=20 author: Florian Roth (Nextron Systems) date: 2022-01-04 modified: 2024-05-13 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: Image|endswith: \format.com CommandLine|contains: '/fs:' filter_main_known_fs: CommandLine|contains: - /fs:exFAT - /fs:FAT - /fs:NTFS - /fs:ReFS - /fs:UDF condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often us. Logsource: windows / process_creation. Rule: title: Potential Active Directory Enumeration Using AD Module - ProcCreation id: 70bc5215-526f-4477-963c-a47a5c9ebd12 related: - id: 9e620995-f2d8-4630-8430-4afd89f77604 type: similar - id: 74176142-4684-4d8a-8b0a-713257e7df8e type: similar status: test description: Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often used by attackers to perform AD enumeration. references: - https://github.com/samratashok/ADModule - https://twitter.com/cyb3rops/status/1617108657166061568?s=20 - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/active-directory-enumeration-with-ad-module-without-rsat-or-admin-privileges author: frack113 date: 2023-01-22 tags: - attack.reconnaissance - attack.discovery - attack.impact logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_cmdlet: CommandLine|contains: - 'Import-Module ' - 'ipmo ' selection_dll: CommandLine|contains: Microsoft.ActiveDirectory.Management.dll condition: all of selection_* falsepositives: - Legitimate use of the library for administrative activity level: medium