alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-4352
Matching passage: CVE-2015-4352. CWE: CWE-352. CVSS: 5.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Spider Video Player module for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete videos via unspecified vectors.
Near-miss passage: CVE-2015-5188. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Web Console (web-console) in Red Hat Enterprise Application Platform before 6.4.4 and WildFly (formerly JBoss Application Server) before 2.0.0.CR9 allows remote attackers to hijack the authentication of administrators for requests that make arbitrary changes to an instance via vectors involving a file upload using a multipart/form-data submission.
Query: exploit Unspecified vulnerability in the Oracle WebCenter Portal component in Oracle Fusion Middleware 11.1.1.8.0 allows remote attackers to affect integrity via unknown vectors related to
Matching passage: CVE-2015-0450. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle WebCenter Portal component in Oracle Fusion Middleware 11.1.1.8.0 allows remote attackers to affect integrity via unknown vectors related to WebCenter Spaces Application.
Near-miss passage: CVE-2015-8449. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in the MovieClip object implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via a crafted lineTo method call, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: intelligence brief on T1010
Matching passage: T1010 Application Window Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.(Citation: Prevailion DarkWatchman 2021) For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ([Security Software Discovery](https://attack.mitre.org/techniques/T1518/001)) to evade.(Citation: ESET Grandoreiro April 2020) Adversaries typically abuse system features for this type of enumeration. For example, they may gather information through native system features such as [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) commands and [Native API](https://attack.mitre.org/techniques/T1106) functions.
Near-miss passage: T1201 Password Policy Discovery. Tactics: discovery. Description: Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies are a way to enforce complex passwords that are difficult to guess or crack through [Brute Force](https://attack.mitre.org/techniques/T1110). This information may help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts). Password policies can be set and discovered on Windows, Linux, and macOS systems via various command shell utilities such as <code>net accounts (/domain)</code>, <code>Get-ADDefaultDomainPasswordPolicy</code>, <code>chage -l <username></code>, <code>cat /etc/pam.d/common-password</code>, and <code>pwpolicy getaccountpolicies</code> (Citation: Superuser Linux Password Policies) (Citation: Jamf User Password Policies). Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to discover password policy information (e.g. <code>show aaa</code>, <code>show aaa common-criteria policy all</code>).(Citation: US-CERT-TA18-106A) Password policies can be discovered in cloud environments using available APIs such as <code>GetAccountPasswordPolicy</code> in AWS (Citation: AWS GetPasswordPolicy).
Query: describe CVE-2015-4306
Matching passage: CVE-2015-4306. CWE: CWE-264. CVSS: 8.5. The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended login-session read restrictions, and impersonate administrators of arbitrary tenant domains, by discovering a session identifier and constructing a crafted URL, aka Bug IDs CSCus88343 and CSCus88334.
Near-miss passage: CVE-2015-3143. CWE: CWE-264. CVSS: 5.0. cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users via an unauthenticated request, a similar issue to CVE-2014-0015.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in Nucleus CMS allows remote attackers to inject arbitrary web script or HTML via the title parameter when adding a new item.
Matching passage: CVE-2015-5454. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Nucleus CMS allows remote attackers to inject arbitrary web script or HTML via the title parameter when adding a new item.
Near-miss passage: CVE-2015-1422. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) horder[], (2) jak_catid, (3) jak_content, (4) jak_css, (5) jak_delete_log[], (6) jak_email, (7) jak_extfile, (8) jak_file, (9) jak_hookshow[], (10) jak_img, (11) jak_javascript, (12) jak_lcontent, (13) jak_name, (14) jak_password, (15) jak_showcontact, (16) jak_tags, (17) jak_title, (18) jak_url, (19) jak_username, (20) real_hook_id[], (21) sp, (22) sreal_plugin_id[], (23) ssp, or (24) sssp parameter to admin/index.php or the (25) editor, (26) field_id, (27) fldr, (28) lang, (29) popup, (30) subfolder, or (31) type parameter to js/editor/plugins/filemanager/dialog.php.
Query: detection rule: Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose thei
Matching passage: Sigma rule: Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose thei. Logsource: azure / signinlogs. Rule: title: Applications That Are Using ROPC Authentication Flow id: 55695bc0-c8cf-461f-a379-2535f563c854 status: test description: 'Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly. The application then uses those credentials to authenticate the user against the identity provider. ' references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-authentication-flows author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik' date: 2022-06-01 tags: - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation - attack.initial-access logsource: product: azure service: signinlogs detection: selection: properties.message: ROPC condition: selection falsepositives: - Applications that are being used as part of automated testing or a legacy application that cannot use any other modern authentication flow level: medium
Near-miss passage: Sigma rule: Detects when a Microsoft Cloud App Security reported for users whose account were terminated in Azure AD, but still perf. Logsource: m365 / threat_management. Rule: title: Activity Performed by Terminated User id: 2e669ed8-742e-4fe5-b3c4-5a59b486c2ee status: test description: 'Detects when a Microsoft Cloud App Security reported for users whose account were terminated in Azure AD, but still perform activities in other platforms such as AWS or Salesforce. This is especially relevant for users who use another account to manage resources, since these accounts are often not terminated when a user leaves the company. ' references: - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference author: Austin Songer @austinsonger date: 2021-08-23 modified: 2022-10-09 tags: - attack.impact logsource: service: threat_management product: m365 detection: selection: eventSource: SecurityComplianceCenter eventName: Activity performed by terminated user status: success condition: selection falsepositives: - Unknown level: medium
Query: SIEM correlation: execution activity consistent with Container Orchestration Job
Matching passage: T1053.007 Container Orchestration Job. Tactics: execution, persistence, privilege escalation. Description: Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to schedule deployment of containers configured to execute malicious code. Container orchestration jobs run these automated tasks at a specific date and time, similar to cron jobs on a Linux system. Deployments of this type can also be configured to maintain a quantity of containers over time, automating the process of maintaining persistence within a cluster. In Kubernetes, a CronJob may be used to schedule a Job that runs one or more containers to perform specific tasks.(Citation: Kubernetes Jobs)(Citation: Kubernetes CronJob) An adversary therefore may utilize a CronJob to schedule deployment of a Job that executes malicious code in various nodes within a cluster.(Citation: Threat Matrix for Kubernetes)
Near-miss passage: T1053.003 Cron. Tactics: execution, persistence, privilege escalation. Description: Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code.(Citation: 20 macOS Common Tools and Techniques) The <code>cron</code> utility is a time-based job scheduler for Unix-like operating systems. The <code> crontab</code> file contains the schedule of cron entries to be run and the specified times for execution. Any <code>crontab</code> files are stored in operating system-specific file paths. An adversary may use <code>cron</code> in Linux or Unix environments to execute programs at system startup or on a scheduled basis for [Persistence](https://attack.mitre.org/tactics/TA0003). In ESXi environments, cron jobs must be created directly via the crontab file (e.g., `/var/spool/cron/crontabs/root`).(Citation: CloudSEK ESXiArgs 2023)
Query: detection rule: Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.
Matching passage: Sigma rule: Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.. Logsource: macos / process_creation. Rule: title: System Shutdown/Reboot - MacOs id: 40b1fbe2-18ea-4ee7-be47-0294285811de status: test description: Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1529/T1529.md author: Igor Fits, Mikhail Larin, oscd.community date: 2020-10-19 modified: 2022-11-26 tags: - attack.impact - attack.t1529 logsource: product: macos category: process_creation detection: selection: Image|endswith: - /shutdown - /reboot - /halt condition: selection falsepositives: - Legitimate administrative activity level: informational
Near-miss passage: Sigma rule: Detects when a process tries to access the memory of svchost to potentially dump credentials.. Logsource: windows / process_access. Rule: title: Credential Dumping Attempt Via Svchost id: 174afcfa-6e40-4ae9-af64-496546389294 status: test description: Detects when a process tries to access the memory of svchost to potentially dump credentials. references: - Internal Research author: Florent Labouyrie date: 2021-04-30 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.t1548 logsource: product: windows category: process_access detection: selection: TargetImage|endswith: \svchost.exe GrantedAccess: '0x143a' filter_main_known_processes: SourceImage|endswith: - \services.exe - \msiexec.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: exploit libxpc in launchd in Apple OS X before 10.11 does not restrict the creation of processes for network connections, which allows remote attackers to cause a denial of service (resour
Matching passage: CVE-2015-7760. CWE: CWE-399. CVSS: 5.0. libxpc in launchd in Apple OS X before 10.11 does not restrict the creation of processes for network connections, which allows remote attackers to cause a denial of service (resource consumption) by repeatedly connecting to the SSH port, a different vulnerability than CVE-2015-7761.
Near-miss passage: CVE-2015-0771. CWE: CWE-399. CVSS: 6.300000190734863. The IKE implementation in the WS-IPSEC-3 service module in Cisco IOS 12.2 on Catalyst 6500 devices allows remote authenticated users to cause a denial of service (device reload) by sending a crafted message during IPsec tunnel setup, aka Bug ID CSCur70505.
Query: vulnerability: The XML parser in the Reference Data Management component in the server in IBM InfoSphere Master Data Management (MDM) 10.1 before IF1, 11.0 before FP3, 11.3, and 11.4 before FP2 a
Matching passage: CVE-2015-1909. CWE: CWE-200. CVSS: 5.0. The XML parser in the Reference Data Management component in the server in IBM InfoSphere Master Data Management (MDM) 10.1 before IF1, 11.0 before FP3, 11.3, and 11.4 before FP2 allows remote attackers to read arbitrary files, and consequently obtain administrative access, via an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Near-miss passage: CVE-2015-1870. CWE: CWE-200. CVSS: 5.5. The event scripts in Automatic Bug Reporting Tool (ABRT) uses world-readable permission on a copy of sosreport file in problem directories, which allows local users to obtain sensitive information from /var/log/messages via unspecified vectors.
Query: intelligence brief on T1601
Matching passage: T1601 Modify System Image. Tactics: defense impairment. Description: Adversaries may make changes to the operating system of embedded network devices to weaken defenses and provide new capabilities for themselves. On such devices, the operating systems are typically monolithic and most of the device functionality and capabilities are contained within a single file. To change the operating system, the adversary typically only needs to affect this one file, replacing or modifying it. This can either be done live in memory during system runtime for immediate effect, or in storage to implement the change on the next boot of the network device.
Near-miss passage: T1601.001 Patch System Image. Tactics: defense impairment. Description: Adversaries may modify the operating system of a network device to introduce new capabilities or weaken existing defenses.(Citation: Killing the myth of Cisco IOS rootkits) (Citation: Killing IOS diversity myth) (Citation: Cisco IOS Shellcode) (Citation: Cisco IOS Forensics Developments) (Citation: Juniper Netscreen of the Dead) Some network devices are built with a monolithic architecture, where the entire operating system and most of the functionality of the device is contained within a single file. Adversaries may change this file in storage, to be loaded in a future boot, or in memory during runtime. To change the operating system in storage, the adversary will typically use the standard procedures available to device operators. This may involve downloading a new file via typical protocols used on network devices, such as TFTP, FTP, SCP, or a console connection. The original file may be overwritten, or a new file may be written alongside of it and the device reconfigured to boot to the compromised image. To change the operating system in memory, the adversary typically can use one of two methods. In the first, the adversary would make use of native debug commands in the original, unaltered running operating system that allow them to directly modify the relevant memory addresses containing the running operating system. This method typically requires administrative level access to the device. In the second method for changing the operating system in memory, the adversary would make use of the boot loader. The boot loader is the first piece of software that loads when the device starts that, in turn, will launch the operating system. Adversaries may use malicious code previously implanted in the boot loader, such as through the [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) method, to directly manipulate running operating system code in memory. This malicious code in the bootloader provides the capability of direct memory manipulation to the adversary,
Query: CVE similar to CVE-2015-0733
Matching passage: CVE-2015-0733. CWE: CWE-113. CVSS: 4.300000190734863. CRLF injection vulnerability in the HTTP Header Handler in Digital Broadband Delivery System in Cisco Headend System Release allows remote attackers to inject arbitrary HTTP headers, and conduct HTTP response splitting attacks or cross-site scripting (XSS) attacks, via a crafted request, aka Bug ID CSCur25580.
Near-miss passage: CVE-2015-1445. CWE: CWE-113. CVSS: 7.199999809265137. HTTP header injection in the httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30.
Query: explain CWE-669
Matching passage: CWE-669 Incorrect Resource Transfer Between Spheres. The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.
Near-miss passage: CWE-208 Observable Timing Discrepancy. Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Query: write Sigma for Identifies when a new cloudshell is created inside of Azure portal.
Matching passage: Sigma rule: Identifies when a new cloudshell is created inside of Azure portal.. Logsource: azure / activitylogs. Rule: title: Azure New CloudShell Created id: 72af37e2-ec32-47dc-992b-bc288a2708cb status: test description: Identifies when a new cloudshell is created inside of Azure portal. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer date: 2021-09-21 modified: 2022-08-23 tags: - attack.execution - attack.t1059 logsource: product: azure service: activitylogs detection: selection: operationName: MICROSOFT.PORTAL/CONSOLES/WRITE condition: selection falsepositives: - A new cloudshell may be created by a system administrator. level: medium
Near-miss passage: Sigma rule: Detects persistence registry keys for Recycle Bin. Logsource: windows / registry_event. Rule: title: Registry Persistence Mechanisms in Recycle Bin id: 277efb8f-60be-4f10-b4d3-037802f37167 status: test description: Detects persistence registry keys for Recycle Bin references: - https://github.com/vxunderground/VXUG-Papers/blob/751edb8d50f95bd7baa730adf2c6c3bb1b034276/The%20Persistence%20Series/Persistence%20via%20Recycle%20Bin/Persistence_via_Recycle_Bin.pdf - https://persistence-info.github.io/Data/recyclebin.html - https://www.hexacorn.com/blog/2018/05/28/beyond-good-ol-run-key-part-78-2/ author: frack113 date: 2021-11-18 modified: 2022-12-06 tags: - attack.privilege-escalation - attack.persistence - attack.t1547 logsource: category: registry_event product: windows detection: selection_create: EventType: RenameKey NewName|contains: \CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\open selection_set: EventType: SetValue TargetObject|contains: \CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\open\command\(Default) condition: 1 of selection_* falsepositives: - Unknown level: high
Query: rule covering Detects SILENTTRINITY stager use via PE metadata
Matching passage: Sigma rule: Detects SILENTTRINITY stager use via PE metadata. Logsource: windows / process_creation. Rule: title: HackTool - SILENTTRINITY Stager Execution id: 03552375-cc2c-4883-bbe4-7958d5a980be related: - id: 75c505b1-711d-4f68-a357-8c3fe37dbf2d type: derived status: test description: Detects SILENTTRINITY stager use via PE metadata references: - https://github.com/byt3bl33d3r/SILENTTRINITY author: Aleksey Potapov, oscd.community date: 2019-10-22 modified: 2023-02-13 tags: - attack.command-and-control - attack.t1071 logsource: category: process_creation product: windows detection: selection: Description|contains: st2stager condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects usage of "MSOHTMED" to download arbitrary files. Logsource: windows / process_creation. Rule: title: Arbitrary File Download Via MSOHTMED.EXE id: 459f2f98-397b-4a4a-9f47-6a5ec2f1c69d status: test description: Detects usage of "MSOHTMED" to download arbitrary files references: - https://github.com/LOLBAS-Project/LOLBAS/pull/238/files author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-19 modified: 2023-11-09 tags: - attack.execution - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \MSOHTMED.exe - OriginalFileName: MsoHtmEd.exe selection_cli: CommandLine|contains: - ftp:// - http:// - https:// condition: all of selection_* falsepositives: - Unknown level: medium
Query: describe CVE-2015-4604
Matching passage: CVE-2015-4604. CWE: CWE-20. CVSS: 7.5. The mget function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, does not properly maintain a certain pointer relationship, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string that is mishandled by a "Python script text executable" rule.
Near-miss passage: CVE-2015-1131. CWE: CWE-20. CVSS: 7.199999809265137. fontd in Apple Type Services (ATS) in Apple OS X before 10.10.3 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-1132, CVE-2015-1133, CVE-2015-1134, and CVE-2015-1135.