alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-9451
Matching passage: CVE-2015-9451. CWE: CWE-89. CVSS: 9.800000190734863. The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_mailchimp pmfb_tid parameter.
Near-miss passage: CVE-2015-4109. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in the ratings module in the Users Ultra plugin before 1.5.16 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) data_target or (2) data_vote parameter in a rating_vote (wp_ajax_nopriv_rating_vote) action to wp-admin/admin-ajax.php.
Query: exploit The management interface in Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway before X7.2.4, X8 before X8.1.2, and X8.2 before X8.2.2 and Cisco TelePresence 
Matching passage: CVE-2015-0653. CWE: CWE-287. CVSS: 10.0. The management interface in Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway before X7.2.4, X8 before X8.1.2, and X8.2 before X8.2.2 and Cisco TelePresence Conductor before X2.3.1 and XC2.4 before XC2.4.1 allows remote attackers to bypass authentication via crafted login parameters, aka Bug IDs CSCur02680 and CSCur05556.
Near-miss passage: CVE-2015-2117. CWE: CWE-287. CVSS: 7.5. HP TippingPoint Security Management System (SMS) and TippingPoint Virtual Security Management System (vSMS) before 4.1 patch 3 and 4.2 before patch 1 do not require authentication for JBoss RMI requests, which allows remote attackers to execute arbitrary code by (1) uploading this code within an archive or (2) instantiating a class.
Query: CVE similar to CVE-2015-6144
Matching passage: CVE-2015-6144. CWE: CWE-79. CVSS: 4.300000190734863. Microsoft Internet Explorer 8 through 11 and Microsoft Edge mishandle HTML attributes in HTTP responses, which allows remote attackers to bypass a cross-site scripting (XSS) protection mechanism via unspecified vectors, aka "Microsoft Browser XSS Filter Bypass Vulnerability."
Near-miss passage: CVE-2015-10078. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability, which was classified as problematic, has been found in atwellpub Resend Welcome Email Plugin 1.0.1 on WordPress. This issue affects the function send_welcome_email_url of the file resend-welcome-email.php. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 1.0.2 is able to address this issue. The identifier of the patch is b14c1f66d307783f0ae74f88088a85999107695c. It is recommended to upgrade the affected component. The identifier VDB-220637 was assigned to this vulnerability.
Query: CVE similar to CVE-2015-0606
Matching passage: CVE-2015-0606. CWE: CWE-20. CVSS: 4.900000095367432. The IOS Shell in Cisco IOS allows local users to cause a denial of service (device crash) via unspecified commands, aka Bug ID CSCur59696.
Near-miss passage: CVE-2015-9061. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, playReady DRM failed to check a length potentially leading to unauthorized access to secure memory.
Query: exploit Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 7.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Matching passage: CVE-2015-1566. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 7.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-5481. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in forms/panels.php in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tab parameter in the gdbbpress_attachments page to wp-admin/edit.php.
Query: Sigma YAML for linux / auditd
Matching passage: Sigma rule: Detect attempt to enable auditing of TTY input. Logsource: linux / auditd. Rule: title: Linux Keylogging with Pam.d id: 49aae26c-450e-448b-911d-b3c13d178dfc status: test description: Detect attempt to enable auditing of TTY input references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.001/T1056.001.md - https://linux.die.net/man/8/pam_tty_audit - https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/sec-configuring_pam_for_auditing - https://access.redhat.com/articles/4409591#audit-record-types-2 author: Pawel Mazur date: 2021-05-24 modified: 2022-12-18 tags: - attack.collection - attack.credential-access - attack.t1003 - attack.t1056.001 logsource: product: linux service: auditd detection: selection_path_events: type: PATH name: - /etc/pam.d/system-auth - /etc/pam.d/password-auth selection_tty_events: type: - TTY - USER_TTY condition: 1 of selection_* falsepositives: - Administrative work level: high
Near-miss passage: Sigma rule: Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several. Logsource: windows / ps_script. Rule: title: Dump Credentials from Windows Credential Manager With PowerShell id: 99c49d9c-34ea-45f7-84a7-4751ae6b2cbc status: test description: 'Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555/T1555.md author: frack113 date: 2021-12-20 modified: 2022-12-25 tags: - attack.credential-access - attack.t1555 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_kiddie: ScriptBlockText|contains: - Get-PasswordVaultCredentials - Get-CredManCreds selection_rename_Password: ScriptBlockText|contains|all: - New-Object - Windows.Security.Credentials.PasswordVault selection_rename_credman: ScriptBlockText|contains|all: - New-Object - Microsoft.CSharp.CSharpCodeProvider - '[System.Runtime.InteropServices.RuntimeEnvironment]::GetRuntimeDirectory())' - Collections.ArrayList - System.CodeDom.Compiler.CompilerParameters condition: 1 of selection_* falsepositives: - Unknown level: medium
Query: vulnerability: Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 improperly checks for a user account's read-only attribute, which allows remote authenticated users to execute
Matching passage: CVE-2015-4328. CWE: CWE-20. CVSS: 4.0. Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 improperly checks for a user account's read-only attribute, which allows remote authenticated users to execute arbitrary OS commands via crafted HTTP requests, as demonstrated by read or write operations on the Unified Communications lookup page, aka Bug ID CSCuv12552.
Near-miss passage: CVE-2015-1131. CWE: CWE-20. CVSS: 7.199999809265137. fontd in Apple Type Services (ATS) in Apple OS X before 10.10.3 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-1132, CVE-2015-1133, CVE-2015-1134, and CVE-2015-1135.
Query: adversary uses Security Software Discovery
Matching passage: T1518.001 Security Software Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus. Adversaries may use the information from [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Example commands that can be used to obtain security software information are [netsh](https://attack.mitre.org/software/S0108), <code>reg query</code> with [Reg](https://attack.mitre.org/software/S0075), <code>dir</code> with [cmd](https://attack.mitre.org/software/S0106), and [Tasklist](https://attack.mitre.org/software/S0057), but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for. It is becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software. Adversaries may also utilize the [Cloud API](https://attack.mitre.org/techniques/T1059/009) to discover cloud-native security software installed on compute infrastructure, such as the AWS CloudWatch agent, Azure VM Agent, and Google Cloud Monitor agent. These agents may collect metrics and logs from the VM, which may be centrally aggregated in a cloud-based monitoring platform.
Near-miss passage: T1518.002 Backup Software Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of backup software or configurations that are installed on a system. Adversaries may use this information to shape follow-on behaviors, such as [Data Destruction](https://attack.mitre.org/techniques/T1485), [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490), or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486). Commands that can be used to obtain security software information are [netsh](https://attack.mitre.org/software/S0108), `reg query` with [Reg](https://attack.mitre.org/software/S0075), `dir` with [cmd](https://attack.mitre.org/software/S0106), and [Tasklist](https://attack.mitre.org/software/S0057), but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for, such as Veeam, Acronis, Dropbox, or Paragon.(Citation: Symantec Play Ransomware 2023)
Query: how to detect Local Accounts
Matching passage: T1078.003 Local Accounts. Tactics: stealth, persistence, privilege escalation, initial access. Description: Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. Local Accounts may also be abused to elevate privileges and harvest credentials through [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). Password reuse may allow the abuse of local accounts across a set of machines on a network for the purposes of Privilege Escalation and Lateral Movement.
Near-miss passage: T1078.004 Cloud Accounts. Tactics: stealth, persistence, privilege escalation, initial access. Description: Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.(Citation: AWS Identity Federation)(Citation: Google Federating GC)(Citation: Microsoft Deploying AD Federation) Service or user accounts may be targeted by adversaries through [Brute Force](https://attack.mitre.org/techniques/T1110), [Phishing](https://attack.mitre.org/techniques/T1566), or various other means to gain access to the environment. Federated or synced accounts may be a pathway for the adversary to affect both on-premises systems and cloud environments - for example, by leveraging shared credentials to log onto [Remote Services](https://attack.mitre.org/techniques/T1021). High privileged cloud accounts, whether federated, synced, or cloud-only, may also allow pivoting to on-premises environments by leveraging SaaS-based [Software Deployment Tools](https://attack.mitre.org/techniques/T1072) to run commands on hybrid-joined devices. An adversary may create long lasting [Additional Cloud Credentials](https://attack.mitre.org/techniques/T1098/001) on a compromised cloud account to maintain persistence in the environment. Such credentials may also be used to bypass security controls such as multi-factor authentication. Cloud accounts may also be able to assume [Temporary Elevated Cloud Access](https://attack.mitre.org/techniques/T1548/005) or other privileges through various means within the environment. Misconfigurations in role assignments or role assumption policies may allow an adversar
Query: exploit The DebuggerFunction::InitAgentHost function in browser/extensions/api/debugger/debugger_api.cc in Google Chrome before 41.0.2272.76 does not properly restrict what URLs are availa
Matching passage: CVE-2015-1226. CWE: CWE-264. CVSS: 5.0. The DebuggerFunction::InitAgentHost function in browser/extensions/api/debugger/debugger_api.cc in Google Chrome before 41.0.2272.76 does not properly restrict what URLs are available as debugger targets, which allows remote attackers to bypass intended access restrictions via a crafted extension.
Near-miss passage: CVE-2015-3965. CWE: CWE-264. CVSS: 8.800000190734863. Hospira Symbiq Infusion System 3.13 and earlier allows remote authenticated users to trigger "unanticipated operations" by leveraging "elevated privileges" for an unspecified call to an incorrectly exposed function.
Query: risk of The buffer_slow_realign function in HAProxy 1.5.x before 1.5.14 and 1.6-dev does not properly realign a buffer that is used for pending outgoing data, which allows remote attackers
Matching passage: CVE-2015-3281. CWE: CWE-119. CVSS: 5.0. The buffer_slow_realign function in HAProxy 1.5.x before 1.5.14 and 1.6-dev does not properly realign a buffer that is used for pending outgoing data, which allows remote attackers to obtain sensitive information (uninitialized memory contents of previous requests) via a crafted request.
Near-miss passage: CVE-2015-3868. CWE: CWE-119. CVSS: 10.0. libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23270724.
Query: explain T1560 Archive Collected Data
Matching passage: T1560 Archive Collected Data. Tactics: collection. Description: An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network.(Citation: DOJ GRU Indictment Jul 2018) Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender. Both compression and encryption are done prior to exfiltration, and can be performed using a utility, 3rd party library, or custom method.
Near-miss passage: T1560.003 Archive via Custom Method. Tactics: collection. Description: An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival methods, such as encryption with XOR or stream ciphers implemented with no external library or utility references. Custom implementations of well-known compression algorithms have also been used.(Citation: ESET Sednit Part 2)
Query: risk of Multiple use-after-free vulnerabilities in the DOM implementation in Blink, as used in Google Chrome before 41.0.2272.76, allow remote attackers to cause a denial of service or pos
Matching passage: CVE-2015-1218. CWE: UNKNOWN. CVSS: 7.5. Multiple use-after-free vulnerabilities in the DOM implementation in Blink, as used in Google Chrome before 41.0.2272.76, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger movement of a SCRIPT element to different documents, related to (1) the HTMLScriptElement::didMoveToNewDocument function in core/html/HTMLScriptElement.cpp and (2) the SVGScriptElement::didMoveToNewDocument function in core/svg/SVGScriptElement.cpp.
Near-miss passage: CVE-2015-4802. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition, a different vulnerability than CVE-2015-4792.
Query: EDR alert: possible Office Application Startup (T1137)
Matching passage: T1137 Office Application Startup. Tactics: persistence. Description: Adversaries may leverage Microsoft Office-based applications for persistence between startups. Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins. A variety of features have been discovered in Outlook that can be abused to obtain persistence, such as Outlook rules, forms, and Home Page.(Citation: SensePost Ruler GitHub) These persistence mechanisms can work within Outlook or be used through Office 365.(Citation: TechNet O365 Outlook Rules)
Near-miss passage: T1137.004 Outlook Home Page. Tactics: persistence. Description: Adversaries may abuse Microsoft Outlook's Home Page feature to obtain persistence on a compromised system. Outlook Home Page is a legacy feature used to customize the presentation of Outlook folders. This feature allows for an internal or external URL to be loaded and presented whenever a folder is opened. A malicious HTML page can be crafted that will execute code when loaded by Outlook Home Page.(Citation: SensePost Outlook Home Page) Once malicious home pages have been added to the user’s mailbox, they will be loaded when Outlook is started. Malicious Home Pages will execute when the right Outlook folder is loaded/reloaded.(Citation: SensePost Outlook Home Page)
Query: exploit In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, if a file extension is changed from .jp
Matching passage: CVE-2015-9228. CWE: CWE-434. CVSS: 8.800000190734863. In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, if a file extension is changed from .jpg to .php.
Near-miss passage: CVE-2015-4455. CWE: CWE-434. CVSS: 9.800000190734863. Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor Add-on For Gravity Forms plugin 3.0 beta for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/uploads/gform_aviary.
Query: describe CVE-2015-2859
Matching passage: CVE-2015-2859. CWE: CWE-310. CVSS: 5.800000190734863. Intel McAfee ePolicy Orchestrator (ePO) 4.x through 4.6.9 and 5.x through 5.1.2 does not validate server names and Certification Authority names in X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Near-miss passage: CVE-2015-1453. CWE: CWE-310. CVSS: 5.0. The qm class in Fortinet FortiClient 5.2.3.091 for Android uses a hardcoded encryption key of FoRtInEt!AnDrOiD, which makes it easier for attackers to obtain passwords and possibly other sensitive data by leveraging the key to decrypt data in the Shared Preferences.
Query: Sigma rule for Triggers on any Sysmon "FileBlockExecutable" event, which indicates a violation of the configured block policy
Matching passage: Sigma rule: Triggers on any Sysmon "FileBlockExecutable" event, which indicates a violation of the configured block policy. Logsource: windows / sysmon. Rule: title: Sysmon Blocked Executable id: 23b71bc5-953e-4971-be4c-c896cda73fc2 status: test description: Triggers on any Sysmon "FileBlockExecutable" event, which indicates a violation of the configured block policy references: - https://medium.com/@olafhartong/sysmon-14-0-fileblockexecutable-13d7ba3dff3e author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-16 modified: 2023-09-16 tags: - attack.defense-impairment logsource: product: windows service: sysmon detection: selection: EventID: 27 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects potential DLL sideloading of "DbgModel.dll". Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Of DbgModel.DLL id: fef394cd-f44d-4040-9b18-95d92fe278c0 status: test description: Detects potential DLL sideloading of "DbgModel.dll" references: - https://hijacklibs.net/entries/microsoft/built-in/dbgmodel.html author: Gary Lobermier date: 2024-07-11 modified: 2024-07-22 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: product: windows category: image_load detection: selection: ImageLoaded|endswith: \dbgmodel.dll filter_main_generic: ImageLoaded|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ filter_optional_windbg: ImageLoaded|startswith: C:\Program Files\WindowsApps\Microsoft.WinDbg_ filter_optional_windows_kits: ImageLoaded|startswith: - C:\Program Files (x86)\Windows Kits\ - C:\Program Files\Windows Kits\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate applications loading their own versions of the DLL mentioned in this rule level: medium
Query: incident response steps for Persistence mechanism resembling PowerShell Profile
Matching passage: Playbook for T1546.013 PowerShell Profile. 1) Validate alert telemetry against T1546.013. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: privilege escalation, persistence. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may gain persistence and elevate privileges by executing malicious content triggered by PowerShell profiles. A PowerShell profile (<code>profile.ps1</code>) is a script that runs when [PowerShell](https://attack.mitre.org/techniques/T1059/001) starts and can be used as a logon script to customize user environments. [PowerShell](https://attack.mitre.org/techniques/T1059/001) supports se
Near-miss passage: Playbook for T1546.008 Accessibility Features. Different response path focused on privilege escalation, persistence.
Query: CVE similar to CVE-2015-0125
Matching passage: CVE-2015-0125. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Rational DOORS Next Generation 4.x before 4.0.7 iFix3 and 5.x before 5.0.2 and Rational Requirements Composer 4.x before 4.0.7 iFix3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-9436. CWE: CWE-79. CVSS: 5.400000095367432. The dynamic-widgets plugin before 1.5.11 for WordPress has XSS via the wp-admin/admin-ajax.php?action=term_tree prefix or widget_id parameter.