alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: SQL injection vulnerability in userprofile.lib.php in Pragyan CMS 3.0 allows remote attackers to execute arbitrary SQL commands via the user parameter to the default URI.
Matching passage: CVE-2015-1471. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in userprofile.lib.php in Pragyan CMS 3.0 allows remote attackers to execute arbitrary SQL commands via the user parameter to the default URI.
Near-miss passage: CVE-2015-1467. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in Translations in Fork CMS before 3.8.6 allow remote authenticated users to execute arbitrary SQL commands via the (1) language[] or (2) type[] parameter to private/en/locale/index.
Query: patch priority for CVE-2015-7643
Matching passage: CVE-2015-7643. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via a Video object with a crafted deblocking property, a different vulnerability than CVE-2015-7629, CVE-2015-7631, and CVE-2015-7644.
Near-miss passage: CVE-2015-4497. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in the CanvasRenderingContext2D implementation in Mozilla Firefox before 40.0.3 and Firefox ESR 38.x before 38.2.1 allows remote attackers to execute arbitrary code by leveraging improper interaction between resize events and changes to Cascading Style Sheets (CSS) token sequences for a CANVAS element.
Query: describe CVE-2015-9042
Matching passage: CVE-2015-9042. CWE: CWE-119. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists when processing a QMI message.
Near-miss passage: CVE-2015-6147. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6149.
Query: incident response steps for Outbound C2 pattern associated with Written Content
Matching passage: Playbook for T1683.001 Written Content. 1) Validate alert telemetry against T1683.001. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: resource development. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may create or tailor written materials to support targeting and malicious operations. Content may include phishing lures, fraudulent financial communications, fabricated job postings, fabricated employment credentials and documentation, decoy documents, social media persona content, and supporting narratives used to sustain fabricated personas over time.(Citation: GenAI Phishing)(Citat
Near-miss passage: Playbook for T1683.002 Audio-Visual Content. Different response path focused on resource development.
Query: Lateral movement indicators for Domain Generation Algorithms
Matching passage: T1568.002 Domain Generation Algorithms. Tactics: command and control. Description: Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destination domain for command and control traffic rather than relying on a list of static IP addresses or domains. This has the advantage of making it much harder for defenders to block, track, or take over the command and control channel, as there potentially could be thousands of domains that malware can check for instructions.(Citation: Cybereason Dissecting DGAs)(Citation: Cisco Umbrella DGA)(Citation: Unit 42 DGA Feb 2019) DGAs can take the form of apparently random or “gibberish” strings (ex: istgmxdejdnxuyla.ru) when they construct domain names by generating each letter. Alternatively, some DGAs employ whole words as the unit by concatenating words together instead of letters (ex: cityjulydish.net). Many DGAs are time-based, generating a different domain for each time period (hourly, daily, monthly, etc). Others incorporate a seed value as well to make predicting future domains more difficult for defenders.(Citation: Cybereason Dissecting DGAs)(Citation: Cisco Umbrella DGA)(Citation: Talos CCleanup 2017)(Citation: Akamai DGA Mitigation) Adversaries may use DGAs for the purpose of [Fallback Channels](https://attack.mitre.org/techniques/T1008). When contact is lost with the primary command and control server malware may employ a DGA as a means to reestablishing command and control.(Citation: Talos CCleanup 2017)(Citation: FireEye POSHSPY April 2017)(Citation: ESET Sednit 2017 Activity)
Near-miss passage: T1568 Dynamic Resolution. Tactics: command and control. Description: Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control. Adversaries may use dynamic resolution for the purpose of [Fallback Channels](https://attack.mitre.org/techniques/T1008). When contact is lost with the primary command and control server malware may employ dynamic resolution as a means to reestablishing command and control.(Citation: Talos CCleanup 2017)(Citation: FireEye POSHSPY April 2017)(Citation: ESET Sednit 2017 Activity)
Query: patch priority for CVE-2015-1328
Matching passage: CVE-2015-1328. CWE: CWE-264. CVSS: 7.800000190734863. The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does not properly check permissions for file creation in the upper filesystem directory, which allows local users to obtain root access by leveraging a configuration in which overlayfs is permitted in an arbitrary mount namespace.
Near-miss passage: CVE-2015-7425. CWE: CWE-264. CVSS: 10.0. The Data Protection component in the VMware vSphere GUI in IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware (aka Spectrum Protect for Virtual Environments) 6.3 before 6.3.2.5, 6.4 before 6.4.3.1, and 7.1 before 7.1.4 and Tivoli Storage FlashCopy Manager for VMware (aka Spectrum Protect Snapshot) 3.1 before 3.1.1.3, 3.2 before 3.2.0.6, and 4.1 before 4.1.4 allows remote attackers to obtain administrative privileges via a crafted URL that triggers back-end function execution.
Query: exploit Multiple heap-based buffer overflows in 3S-Smart CODESYS Gateway Server before 2.3.9.34 allow remote attackers to execute arbitrary code via opcode (1) 0x3ef or (2) 0x3f0.
Matching passage: CVE-2015-6460. CWE: CWE-119. CVSS: 7.5. Multiple heap-based buffer overflows in 3S-Smart CODESYS Gateway Server before 2.3.9.34 allow remote attackers to execute arbitrary code via opcode (1) 0x3ef or (2) 0x3f0.
Near-miss passage: CVE-2015-3684. CWE: CWE-119. CVSS: 6.800000190734863. The HTTPAuthentication implementation in CFNetwork in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted credentials in a URL.
Query: vulnerability: The dissect_dcom_OBJREF function in epan/dissectors/packet-dcom.c in the DCOM dissector in Wireshark 1.12.x before 1.12.9 does not initialize a certain IPv4 data structure, which a
Matching passage: CVE-2015-8714. CWE: CWE-20. CVSS: 5.5. The dissect_dcom_OBJREF function in epan/dissectors/packet-dcom.c in the DCOM dissector in Wireshark 1.12.x before 1.12.9 does not initialize a certain IPv4 data structure, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Near-miss passage: CVE-2015-8476. CWE: CWE-20. CVSS: 5.0. Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP commands via CRLF sequences in an (1) email address to the validateAddress function in class.phpmailer.php or (2) SMTP command to the sendCommand function in class.smtp.php, a different vulnerability than CVE-2012-0796.
Query: incident response steps for EDR alert: possible Identify Business Tempo (T1591.003)
Matching passage: Playbook for T1591.003 Identify Business Tempo. 1) Validate alert telemetry against T1591.003. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: reconnaissance. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may gather information about the victim's business tempo that can be used during targeting. Information about an organization’s business tempo may include a variety of details, including operational hours/days of the week. This information may also reveal times/dates of purchases and shipments of the victim’s hardware and software resources. Adversaries may gather this information in v
Near-miss passage: Playbook for T1591 Gather Victim Org Information. Different response path focused on reconnaissance.
Query: patch priority for CVE-2015-0235
Matching passage: CVE-2015-0235. CWE: CWE-787. CVSS: 10.0. Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."
Near-miss passage: CVE-2015-0569. CWE: CWE-787. CVSS: 7.800000190734863. Heap-based buffer overflow in the private wireless extensions IOCTL implementation in wlan_hdd_wext.c in the WLAN (aka Wi-Fi) driver for the Linux kernel 3.x and 4.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges via a crafted application that establishes a packet filter.
Query: write Sigma for Detects user account creation on ESXi system via esxcli
Matching passage: Sigma rule: Detects user account creation on ESXi system via esxcli. Logsource: linux / process_creation. Rule: title: ESXi Account Creation Via ESXCLI id: b28e4eb3-8bbc-4f0c-819f-edfe8e2f25db status: test description: Detects user account creation on ESXi system via esxcli references: - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html author: Cedric Maurugeon date: 2023-08-22 tags: - attack.persistence - attack.execution - attack.t1136 - attack.t1059.012 logsource: category: process_creation product: linux detection: selection: Image|endswith: /esxcli CommandLine|contains|all: - 'system ' - 'account ' - 'add ' condition: selection falsepositives: - Legitimate administration activities level: medium
Near-miss passage: Sigma rule: Detects execution of "odbcconf" with the "INSTALLDRIVER" action where the driver doesn't contain a ".dll" extension. Thi. Logsource: windows / process_creation. Rule: title: Suspicious Driver/DLL Installation Via Odbcconf.EXE id: cb0fe7c5-f3a3-484d-aa25-d350a7912729 related: - id: 3f5491e2-8db8-496b-9e95-1029fce852d4 type: derived status: test description: Detects execution of "odbcconf" with the "INSTALLDRIVER" action where the driver doesn't contain a ".dll" extension. This is often used as a defense evasion method. references: - https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/ - https://web.archive.org/web/20191023232753/https://twitter.com/Hexacorn/status/1187143326673330176 - https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-23 tags: - attack.stealth - attack.t1218.008 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \odbcconf.exe - OriginalFileName: odbcconf.exe selection_cli: CommandLine|contains: 'INSTALLDRIVER ' filter_main_dll_ext: CommandLine|contains: .dll condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unlikely level: high
Query: containment actions for Persistence mechanism resembling Software Deployment Tools
Matching passage: Playbook for T1072 Software Deployment Tools. 1) Validate alert telemetry against T1072. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: execution, lateral movement. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may gain access to and use centralized software suites installed within an enterprise to execute commands and move laterally through the network. Configuration management and software deployment applications may be used in an enterprise network or cloud environment for routine administration purposes. These systems may also be integrated into CI/CD pipelines. Examples of such solutions
Near-miss passage: Playbook for T1563.001 SSH Hijacking. Different response path focused on lateral movement.
Query: detect Detects when when a mounted share is removed. Adversaries may remove share connections that are no longer useful in orde in logs
Matching passage: Sigma rule: Detects when when a mounted share is removed. Adversaries may remove share connections that are no longer useful in orde. Logsource: windows / ps_script. Rule: title: PowerShell Deleted Mounted Share id: 66a4d409-451b-4151-94f4-a55d559c49b0 status: test description: Detects when when a mounted share is removed. Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.005/T1070.005.md author: oscd.community, @redcanary, Zach Stanford @svch0st date: 2020-10-08 modified: 2025-10-07 tags: - attack.stealth - attack.t1070.005 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - Remove-SmbShare - Remove-FileShare filter_main_module_load: ScriptBlockText|contains|all: - FileShare.cdxml - Microsoft.PowerShell.Core\Export-ModuleMember - ROOT/Microsoft/Windows/Storage/MSFT_FileShare - ObjectModelWrapper - Cmdletization.MethodParameter condition: selection and not 1 of filter_main_* falsepositives: - Administrators or Power users may remove their shares via cmd line level: medium
Near-miss passage: Sigma rule: Detects SyncAppvPublishingServer process execution which usually utilized by adversaries to bypass PowerShell execution. Logsource: windows / ps_module. Rule: title: SyncAppvPublishingServer Bypass Powershell Restriction - PS Module id: fe5ce7eb-dad8-467c-84a9-31ec23bd644a related: - id: fde7929d-8beb-4a4c-b922-be9974671667 type: derived - id: 9f7aa113-9da6-4a8d-907c-5f1a4b908299 type: derived status: test description: Detects SyncAppvPublishingServer process execution which usually utilized by adversaries to bypass PowerShell execution restrictions. references: - https://lolbas-project.github.io/lolbas/Binaries/Syncappvpublishingserver/ author: Ensar Şamil, @sblmsrsn, OSCD Community date: 2020-10-05 modified: 2022-12-02 tags: - attack.stealth - attack.t1218 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection: ContextInfo|contains: SyncAppvPublishingServer.exe condition: selection falsepositives: - App-V clients level: medium
Query: CVE similar to CVE-2015-0996
Matching passage: CVE-2015-0996. CWE: CWE-200. CVSS: 2.0999999046325684. Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 rely on a hardcoded cleartext password to control read access to Project files and Project Configuration files, which makes it easier for local users to obtain sensitive information by discovering this password.
Near-miss passage: CVE-2015-7763. CWE: CWE-200. CVSS: 5.0. rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not properly initialize padding at the end of an Rx acknowledgement (ACK) packet, which allows remote attackers to obtain sensitive information by (1) conducting a replay attack or (2) sniffing the network.
Query: vulnerability: Google Chrome before 41.0.2272.76, when Instant Extended mode is used, does not properly consider the interaction between the "1993 search" features and restore-from-disk RELOAD tr
Matching passage: CVE-2015-2239. CWE: CWE-19. CVSS: 4.300000190734863. Google Chrome before 41.0.2272.76, when Instant Extended mode is used, does not properly consider the interaction between the "1993 search" features and restore-from-disk RELOAD transitions, which makes it easier for remote attackers to spoof the address bar for a search-results page by leveraging (1) a compromised search engine or (2) an XSS vulnerability in a search engine, a different vulnerability than CVE-2015-1231.
Near-miss passage: CVE-2015-0560. CWE: CWE-19. CVSS: 5.0. The dissect_wccp2r1_address_table_info function in epan/dissectors/packet-wccp.c in the WCCP dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 does not initialize certain data structures, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Query: alert when Detects overwriting (effectively wiping/deleting) of a file.
Matching passage: Sigma rule: Detects overwriting (effectively wiping/deleting) of a file.. Logsource: linux / auditd. Rule: title: Overwriting the File with Dev Zero or Null id: 37222991-11e9-4b6d-8bdf-60fbe48f753e status: stable description: Detects overwriting (effectively wiping/deleting) of a file. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md author: Jakob Weinzettl, oscd.community date: 2019-10-23 tags: - attack.impact - attack.t1485 logsource: product: linux service: auditd detection: selection: type: EXECVE a0|contains: dd a1|contains: - if=/dev/null - if=/dev/zero condition: selection falsepositives: - Appending null bytes to files. - Legitimate overwrite of files. level: low
Near-miss passage: Sigma rule: Detects scheduled task creation events that include suspicious actions, and is run once at 00:00. Logsource: windows / process_creation. Rule: title: Uncommon One Time Only Scheduled Task At 00:00 id: 970823b7-273b-460a-8afc-3a6811998529 status: test description: Detects scheduled task creation events that include suspicious actions, and is run once at 00:00 references: - https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbyte author: pH-T (Nextron Systems) date: 2022-07-15 modified: 2023-02-03 tags: - attack.execution - attack.persistence - attack.privilege-escalation - attack.t1053.005 logsource: category: process_creation product: windows detection: selection_img: - Image|contains: \schtasks.exe - OriginalFileName: schtasks.exe selection_cli: CommandLine|contains: - wscript - vbscript - cscript - 'wmic ' - wmic.exe - regsvr32.exe - powershell - \AppData\ selection_time: CommandLine|contains|all: - once - 00:00 condition: all of selection_* falsepositives: - Software installation level: high
Query: vulnerability: A vulnerability was found in tiredtyrant flairbot. It has been declared as critical. This vulnerability affects unknown code of the file flair.py. The manipulation leads to sql inj
Matching passage: CVE-2015-10026. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability was found in tiredtyrant flairbot. It has been declared as critical. This vulnerability affects unknown code of the file flair.py. The manipulation leads to sql injection. The patch is identified as 5e112b68c6faad1d4699d02c1ebbb7daf48ef8fb. It is recommended to apply a patch to fix this issue. VDB-217618 is the identifier assigned to this vulnerability.
Near-miss passage: CVE-2015-0916. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in graph.php in Cacti before 0.8.6f allows remote authenticated users to execute arbitrary SQL commands via the local_graph_id parameter, a different vulnerability than CVE-2007-6035.
Query: write Sigma for Detect set UseActionCenterExperience to 0 to disable the Windows security center notification
Matching passage: Sigma rule: Detect set UseActionCenterExperience to 0 to disable the Windows security center notification. Logsource: windows / registry_set. Rule: title: Disable Windows Security Center Notifications id: 3ae1a046-f7db-439d-b7ce-b8b366b81fa6 status: test description: Detect set UseActionCenterExperience to 0 to disable the Windows security center notification references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1112/T1112.md author: frack113 date: 2022-08-19 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: Windows\CurrentVersion\ImmersiveShell\UseActionCenterExperience Details: DWORD (0x00000000) condition: selection falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_disable_security_center_notifications/info.yml simulation: - type: atomic-red-team name: Disable Windows Security Center Notifications technique: T1112 atomic_guid: 45914594-8df6-4ea9-b3cc-7eb9321a807e
Near-miss passage: Sigma rule: Detects Baby Shark C2 Framework default communication patterns. Logsource: proxy. Rule: title: HackTool - BabyShark Agent Default URL Pattern id: 304810ed-8853-437f-9e36-c4975c3dfd7e status: test description: Detects Baby Shark C2 Framework default communication patterns references: - https://nasbench.medium.com/understanding-detecting-c2-frameworks-babyshark-641be4595845 author: Florian Roth (Nextron Systems) date: 2021-06-09 modified: 2024-02-15 tags: - attack.command-and-control - attack.t1071.001 logsource: category: proxy detection: selection: c-uri|contains: momyshark\?key= condition: selection falsepositives: - Unlikely level: critical
Query: exploit Use-after-free vulnerability in the Update Manager service in Avira Management Console allows remote attackers to execute arbitrary code via a large header.
Matching passage: CVE-2015-7303. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in the Update Manager service in Avira Management Console allows remote attackers to execute arbitrary code via a large header.
Near-miss passage: CVE-2015-1243. CWE: UNKNOWN. CVSS: 7.5. Use-after-free vulnerability in the MutationObserver::disconnect function in core/dom/MutationObserver.cpp in the DOM implementation in Blink, as used in Google Chrome before 42.0.2311.135, allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering an attempt to unregister a MutationObserver object that is not currently registered.