alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-0232
Matching passage: CVE-2015-0232. CWE: UNKNOWN. CVSS: 6.800000190734863. The exif_process_unicode function in ext/exif/exif.c in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized pointer free and application crash) via crafted EXIF data in a JPEG image.
Near-miss passage: CVE-2015-6986. CWE: UNKNOWN. CVSS: 9.300000190734863. com.apple.driver.AppleVXD393 in the Graphics Driver subsystem in Apple iOS before 9.1 allows attackers to execute arbitrary code via a crafted app that leverages an unspecified "type confusion."
Query: exploit IBM WebSphere Application Server 7.x before 7.0.0.39, 8.0.x before 8.0.0.11, and 8.5.x before 8.5.5.7 and WebSphere Virtual Enterprise before 7.0.0.7 allow remote attackers to obta
Matching passage: CVE-2015-1932. CWE: CWE-200. CVSS: 5.0. IBM WebSphere Application Server 7.x before 7.0.0.39, 8.0.x before 8.0.0.11, and 8.5.x before 8.5.5.7 and WebSphere Virtual Enterprise before 7.0.0.7 allow remote attackers to obtain potentially sensitive information about the proxy-server software by reading the HTTP Via header.
Near-miss passage: CVE-2015-8280. CWE: CWE-200. CVSS: 7.5. Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to discover credentials by reading detailed error messages.
Query: risk of Memory leak in Cisco IOS 12.2, 12.4, 15.0, 15.2, and 15.3 allows remote attackers to cause a denial of service (memory consumption) via crafted Common Industrial Protocol (CIP) TCP
Matching passage: CVE-2015-0648. CWE: CWE-399. CVSS: 7.800000190734863. Memory leak in Cisco IOS 12.2, 12.4, 15.0, 15.2, and 15.3 allows remote attackers to cause a denial of service (memory consumption) via crafted Common Industrial Protocol (CIP) TCP packets, aka Bug ID CSCun49658.
Near-miss passage: CVE-2015-0283. CWE: CWE-399. CVSS: 7.800000190734863. The slapi-nis plug-in before 0.54.2 does not properly reallocate memory when processing user accounts, which allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a request for a (1) group with a large number of members or (2) user that belongs to a large number of groups.
Query: detect Identifies when a device or device configuration in azure is modified or deleted. in logs
Matching passage: Sigma rule: Identifies when a device or device configuration in azure is modified or deleted.. Logsource: azure / activitylogs. Rule: title: Azure Device or Configuration Modified or Deleted id: 46530378-f9db-4af9-a9e5-889c177d3881 status: test description: Identifies when a device or device configuration in azure is modified or deleted. references: - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory author: Austin Songer @austinsonger date: 2021-09-03 modified: 2022-10-09 tags: - attack.impact - attack.t1485 - attack.t1565.001 logsource: product: azure service: activitylogs detection: selection: properties.message: - Delete device - Delete device configuration - Update device - Update device configuration condition: selection falsepositives: - Device or device configuration being modified or deleted may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Device or device configuration modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects suspicious child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execu. Logsource: windows / process_creation. Rule: title: Suspicious Child Process Of BgInfo.EXE id: 811f459f-9231-45d4-959a-0266c6311987 related: - id: aaf46cdc-934e-4284-b329-34aa701e3771 type: similar status: test description: Detects suspicious child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Bginfo/ - https://oddvar.moe/2017/05/18/bypassing-application-whitelisting-with-bginfo/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-16 tags: - attack.execution - attack.stealth - attack.t1059.005 - attack.t1218 - attack.t1202 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \bginfo.exe - \bginfo64.exe selection_child: - Image|endswith: - \calc.exe - \cmd.exe - \cscript.exe - \mshta.exe - \notepad.exe - \powershell.exe - \pwsh.exe - \wscript.exe - Image|contains: - \AppData\Local\ - \AppData\Roaming\ - :\Users\Public\ - :\Temp\ - :\Windows\Temp\ - :\PerfLogs\ condition: all of selection_* falsepositives: - Unknown level: high
Query: alert when Detects suspicious child process creations of VMware Tools process which may indicate persistence setup
Matching passage: Sigma rule: Detects suspicious child process creations of VMware Tools process which may indicate persistence setup. Logsource: windows / process_creation. Rule: title: VMToolsd Suspicious Child Process id: 5687f942-867b-4578-ade7-1e341c46e99a status: test description: Detects suspicious child process creations of VMware Tools process which may indicate persistence setup references: - https://bohops.com/2021/10/08/analyzing-and-detecting-a-vmtools-persistence-technique/ - https://user-images.githubusercontent.com/61026070/136518004-b68cce7d-f9b8-4e9a-9b7b-53b1568a9a94.png - https://github.com/vmware/open-vm-tools/blob/master/open-vm-tools/tools.conf author: bohops, Bhabesh Raj date: 2021-10-08 modified: 2023-07-25 tags: - attack.execution - attack.persistence - attack.t1059 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \vmtoolsd.exe selection_img: - Image|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe - OriginalFileName: - Cmd.Exe - cscript.exe - MSHTA.EXE - PowerShell.EXE - pwsh.dll - REGSVR32.EXE - RUNDLL32.EXE - wscript.exe filter_main_vmwaretools_script: Image|endswith: \cmd.exe CommandLine|contains: - \VMware\VMware Tools\poweron-vm-default.bat - \VMware\VMware Tools\poweroff-vm-default.bat - \VMware\VMware Tools\resume-vm-default.bat - \VMware\VMware Tools\suspend-vm-default.bat filter_main_empty: Image|endswith: \cmd.exe CommandLine: '' filter_main_null: Image|endswith: \cmd.exe CommandLine: null condition: all of selection* and not 1 of filter_main_* falsepositives: - Legitimate use by VM administrator level: high
Near-miss passage: Sigma rule: Detects network connections to Cloudflared tunnels domains initiated by a process on the system. Attackers can abuse tha. Logsource: windows / network_connection. Rule: title: Network Connection Initiated To Cloudflared Tunnels Domains id: 7cd1dcdc-6edf-4896-86dc-d1f19ad64903 related: - id: a1d9eec5-33b2-4177-8d24-27fe754d0812 type: derived status: test description: 'Detects network connections to Cloudflared tunnels domains initiated by a process on the system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine. ' references: - https://defr0ggy.github.io/research/Abusing-Cloudflared-A-Proxy-Service-To-Host-Share-Applications/ - https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/ - Internal Research author: Kamran Saifullah, Nasreddine Bencherchali (Nextron Systems) date: 2024-05-27 tags: - attack.exfiltration - attack.command-and-control - attack.t1567 - attack.t1572 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' DestinationHostname|endswith: - .v2.argotunnel.com - protocol-v2.argotunnel.com - trycloudflare.com - update.argotunnel.com condition: selection falsepositives: - Legitimate use of cloudflare tunnels will also trigger this. level: medium
Query: Encoded PowerShell / command-line abuse matching Use Alternate Authentication Material
Matching passage: T1550 Use Alternate Authentication Material. Tactics: lateral movement. Description: Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls. Authentication processes generally require a valid identity (e.g., username) along with one or more authentication factors (e.g., password, pin, physical smart card, token generator, etc.). Alternate authentication material is legitimately generated by systems after a user or application successfully authenticates by providing a valid identity and the required authentication factor(s). Alternate authentication material may also be generated during the identity creation process.(Citation: NIST Authentication)(Citation: NIST MFA) Caching alternate authentication material allows the system to verify an identity has successfully authenticated without asking the user to reenter authentication factor(s). Because the alternate authentication must be maintained by the system—either in memory or on disk—it may be at risk of being stolen through [Credential Access](https://attack.mitre.org/tactics/TA0006) techniques. By stealing alternate authentication material, adversaries are able to bypass system access controls and authenticate to systems without knowing the plaintext password or any additional authentication factors.
Near-miss passage: T1550.004 Web Session Cookie. Tactics: lateral movement. Description: Adversaries can use stolen session cookies to authenticate to web applications and services. This technique bypasses some multi-factor authentication protocols since the session is already authenticated.(Citation: Pass The Cookie) Authentication cookies are commonly used in web applications, including cloud-based services, after a user has authenticated to the service so credentials are not passed and re-authentication does not need to occur as frequently. Cookies are often valid for an extended period of time, even if the web application is not actively used. After the cookie is obtained through [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539) or [Web Cookies](https://attack.mitre.org/techniques/T1606/001), the adversary may then import the cookie into a browser they control and is then able to use the site or application as the user for as long as the session cookie is active. Once logged into the site, an adversary can access sensitive information, read email, or perform actions that the victim account has permissions to perform. There have been examples of malware targeting session cookies to bypass multi-factor authentication systems.(Citation: Unit 42 Mac Crypto Cookies January 2019)
Query: CVE similar to CVE-2015-4233
Matching passage: CVE-2015-4233. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in Cisco Unified MeetingPlace 8.6(1.2) allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuu54037.
Near-miss passage: CVE-2015-1605. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in Dell ScriptLogic Asset Manager (aka Quest Workspace Asset Manager) before 9.5 allow remote attackers to execute arbitrary SQL commands via unspecified vectors to (1) GetClientPackage.aspx or (2) GetProcessedPackage.aspx.
Query: vulnerability: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, SD 210/SD 212/SD 205, SD 41
Matching passage: CVE-2015-9187. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, lack of buffer length validation in pvr_cmd_handler leads to unauthorized access to secure memory.
Near-miss passage: CVE-2015-7896. CWE: CWE-119. CVSS: 6.5. LibQJpeg in the Samsung Galaxy S6 before the October 2015 MR allows remote attackers to cause a denial of service (memory corruption and SIGSEGV) via a crafted image file.
Query: describe CVE-2015-5617
Matching passage: CVE-2015-5617. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in pub/m_pending_news/delete_pending_news.jsp in Enorth Webpublisher CMS allows remote attackers to execute arbitrary SQL commands via the cbNewsId parameter.
Near-miss passage: CVE-2015-1442. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in views/zero_transact_user.php in the administrative backend in ZeroCMS 1.3.3, 1.3.2, and earlier allows remote authenticated users to execute arbitrary SQL commands via the user_id parameter in a Modify Account action. NOTE: The article_id parameter to zero_view_article.php vector is already covered by CVE-2014-4034.
Query: exploit The IsDriveLetterAvailable method in Driver/Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows, does not properly validate drive letter sym
Matching passage: CVE-2015-7358. CWE: CWE-264. CVSS: 7.800000190734863. The IsDriveLetterAvailable method in Driver/Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows, does not properly validate drive letter symbolic links, which allows local users to mount an encrypted volume over an existing drive letter and gain privileges via an entry in the /GLOBAL?? directory.
Near-miss passage: CVE-2015-1248. CWE: CWE-264. CVSS: 4.300000190734863. The FileSystem API in Google Chrome before 40.0.2214.91 allows remote attackers to bypass the SafeBrowsing for Executable Files protection mechanism by creating a .exe file in a temporary filesystem and then referencing this file with a filesystem:http: URL.
Query: common weakness: Incomplete Design Documentation
Matching passage: CWE-1110 Incomplete Design Documentation. The product's design documentation does not adequately describe control flow, data flow, system initialization, relationships between tasks, components, rationales, or other important aspects of the design.
Near-miss passage: CWE-1116 Inaccurate Source Code Comments. The source code contains comments that do not accurately describe or explain aspects of the portion of the code with which the comment is associated.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects a suspicious child process spawning from Outlook where the image is located in a remote location (SMB/WebDav sha. Logsource: windows / process_creation. Rule: title: Suspicious Remote Child Process From Outlook id: e212d415-0e93-435f-9e1a-f29005bb4723 related: - id: 208748f7-881d-47ac-a29c-07ea84bf691d type: similar status: test description: Detects a suspicious child process spawning from Outlook where the image is located in a remote location (SMB/WebDav shares). references: - https://github.com/sensepost/ruler - https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=49 author: Markus Neis, Nasreddine Bencherchali (Nextron Systems) date: 2018-12-27 modified: 2023-02-09 tags: - attack.execution - attack.stealth - attack.t1059 - attack.t1202 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \outlook.exe Image|startswith: \\\\ condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the creation of a symbolic link between "cmd.exe" and the accessibility on-screen keyboard binary (osk.exe) usin. Logsource: windows / process_creation. Rule: title: Potential Privilege Escalation Using Symlink Between Osk and Cmd id: e9b61244-893f-427c-b287-3e708f321c6b status: test description: Detects the creation of a symbolic link between "cmd.exe" and the accessibility on-screen keyboard binary (osk.exe) using "mklink". This technique provides an elevated command prompt to the user from the login screen without the need to log in. references: - https://github.com/redcanaryco/atomic-red-team/blob/5c1e6f1b4fafd01c8d1ece85f510160fc1275fbf/atomics/T1546.008/T1546.008.md - https://ss64.com/nt/mklink.html author: frack113 date: 2022-12-11 modified: 2022-12-20 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.008 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \cmd.exe - OriginalFileName: Cmd.Exe selection_cli: CommandLine|contains|all: - mklink - \osk.exe - \cmd.exe condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_cmd_mklink_osk_cmd/info.yml
Query: CWE for Singleton Class Instance Creation without Proper Locking or Synchronization
Matching passage: CWE-1096 Singleton Class Instance Creation without Proper Locking or Synchronization. The product implements a Singleton design pattern but does not use appropriate locking or other synchronization mechanism to ensure that the singleton class is only instantiated once.
Near-miss passage: CWE-692 Incomplete Denylist to Cross-Site Scripting. The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete, allowing XSS variants to succeed.
Query: detection engineering for Cloud Instance Metadata API
Matching passage: T1552.005 Cloud Instance Metadata API. Tactics: credential access. Description: Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data. Most cloud service providers support a Cloud Instance Metadata API which is a service provided to running virtual instances that allows applications to access information about the running virtual instance. Available information generally includes name, security group, and additional metadata including sensitive data such as credentials and UserData scripts that may contain additional secrets. The Instance Metadata API is provided as a convenience to assist in managing applications and is accessible by anyone who can access the instance.(Citation: AWS Instance Metadata API) A cloud metadata API has been used in at least one high profile compromise.(Citation: Krebs Capital One August 2019) If adversaries have a presence on the running virtual instance, they may query the Instance Metadata API directly to identify credentials that grant access to additional resources. Additionally, adversaries may exploit a Server-Side Request Forgery (SSRF) vulnerability in a public facing web proxy that allows them to gain access to the sensitive information via a request to the Instance Metadata API.(Citation: RedLock Instance Metadata API 2018) The de facto standard across cloud service providers is to host the Instance Metadata API at <code>http[:]//169.254.169.254</code>.
Near-miss passage: T1552.003 Shell History. Tactics: credential access. Description: Adversaries may search the command history on compromised systems for insecurely stored credentials. On Linux and macOS systems, shells such as Bash and Zsh keep track of the commands users type on the command-line with the "history" utility. Once a user logs out, the history is flushed to the user's history file. For each user, this file resides at the same location: for example, `~/.bash_history` or `~/.zsh_history`. Typically, these files keeps track of the user's last 1000 commands. On Windows, PowerShell has both a command history that is wiped after the session ends, and one that contains commands used in all sessions and is persistent. The default location for persistent history can be found in `%userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt`, but command history can also be accessed with `Get-History`. Command Prompt (CMD) on Windows does not have persistent history.(Citation: Microsoft about_History)(Citation: Medium) Users often type usernames and passwords on the command-line as parameters to programs, which then get saved to this file when they log out. Adversaries can abuse this by looking through the file for potential credentials.(Citation: External to DA, the OS X Way)
Query: vulnerability: The ADB (formerly Pirelli Broadband Solutions) P.DGA4001N router with firmware PDG_TEF_SP_4.06L.6 does not properly restrict access to the web interface, which allows remote attack
Matching passage: CVE-2015-0554. CWE: CWE-264. CVSS: 9.399999618530273. The ADB (formerly Pirelli Broadband Solutions) P.DGA4001N router with firmware PDG_TEF_SP_4.06L.6 does not properly restrict access to the web interface, which allows remote attackers to obtain sensitive information or cause a denial of service (device restart) as demonstrated by a direct request to (1) wlsecurity.html or (2) resetrouter.html.
Near-miss passage: CVE-2015-6638. CWE: CWE-264. CVSS: 7.800000190734863. The Imagination Technologies driver in Android 5.x before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to gain privileges via a crafted application, aka internal bug 24673908.
Query: exploit The Navigate module for Drupal does not properly check permissions, which allows remote authenticated users to modify custom widgets and create widget database records by leveragin
Matching passage: CVE-2015-5499. CWE: CWE-264. CVSS: 4.0. The Navigate module for Drupal does not properly check permissions, which allows remote authenticated users to modify custom widgets and create widget database records by leveraging the "navigate view" permission.
Near-miss passage: CVE-2015-8967. CWE: CWE-264. CVSS: 7.800000190734863. arch/arm64/kernel/sys.c in the Linux kernel before 4.0 allows local users to bypass the "strict page permissions" protection mechanism and modify the system-call table, and consequently gain privileges, by leveraging write access.
Query: risk of The Data Protection component in the VMware vSphere GUI in IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware (aka Spectrum Protect for Virtual Environ
Matching passage: CVE-2015-7425. CWE: CWE-264. CVSS: 10.0. The Data Protection component in the VMware vSphere GUI in IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware (aka Spectrum Protect for Virtual Environments) 6.3 before 6.3.2.5, 6.4 before 6.4.3.1, and 7.1 before 7.1.4 and Tivoli Storage FlashCopy Manager for VMware (aka Spectrum Protect Snapshot) 3.1 before 3.1.1.3, 3.2 before 3.2.0.6, and 4.1 before 4.1.4 allows remote attackers to obtain administrative privileges via a crafted URL that triggers back-end function execution.
Near-miss passage: CVE-2015-5989. CWE: CWE-264. CVSS: 9.800000190734863. Belkin F9K1102 2 devices with firmware 2.10.17 rely on client-side JavaScript code for authorization, which allows remote attackers to obtain administrative privileges via certain changes to LockStatus and Login_Success values.
Query: exploit The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a craf
Matching passage: CVE-2015-3253. CWE: CWE-74. CVSS: 9.800000190734863. The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.
Near-miss passage: CVE-2015-3154. CWE: CWE-74. CVSS: 6.099999904632568. CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.