alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: CVE similar to CVE-2015-5727
Matching passage: CVE-2015-5727. CWE: CWE-399. CVSS: 7.5. The BER decoder in Botan 1.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, related to a length field.
Near-miss passage: CVE-2015-0044. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-8967 and CVE-2015-0050.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects changes to Internet Explorer's (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS. Logsource: windows / process_creation. Rule: title: IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols Via CLI id: 10344bb3-7f65-46c2-b915-2d00d47be5b0 related: - id: 3fd4c8d7-8362-4557-a8e6-83b29cc0d724 type: similar status: test description: 'Detects changes to Internet Explorer''s (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS" protocols to point to the "My Computer" zone. This allows downloaded files from the Internet to be granted the same level of trust as files stored locally. ' references: - https://twitter.com/M_haggis/status/1699056847154725107 - https://twitter.com/JAMESWT_MHT/status/1699042827261391247 - https://learn.microsoft.com/en-us/troubleshoot/developer/browsers/security-privacy/ie-security-zones-registry-entries - https://www.virustotal.com/gui/file/339ff720c74dc44265b917b6d3e3ba0411d61f3cd3c328e9a2bae81592c8a6e5/content author: Nasreddine Bencherchali (Nextron Systems) date: 2023-09-05 tags: - attack.execution - attack.stealth logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - \Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults - http - ' 0' condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects usage of "appcmd" to create new global URL rewrite rules. This behaviour has been observed being used by threat. Logsource: windows / process_creation. Rule: title: Suspicious IIS URL GlobalRules Rewrite Via AppCmd id: 7c8af9b2-dcae-41a2-a9db-b28c288b5f08 status: test description: Detects usage of "appcmd" to create new global URL rewrite rules. This behaviour has been observed being used by threat actors to add new rules so they can access their webshells. references: - https://twitter.com/malmoeb/status/1616702107242971144 - https://learn.microsoft.com/en-us/answers/questions/739120/how-to-add-re-write-global-rule-with-action-type-r author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-22 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \appcmd.exe - OriginalFileName: appcmd.exe selection_cli: CommandLine|contains|all: - set - config - section:system.webServer/rewrite/globalRules - 'commit:' condition: all of selection_* falsepositives: - Legitimate usage of appcmd to add new URL rewrite rules level: medium
Query: alert when Detects SILENTTRINITY stager dll loading activity
Matching passage: Sigma rule: Detects SILENTTRINITY stager dll loading activity. Logsource: windows / image_load. Rule: title: HackTool - SILENTTRINITY Stager DLL Load id: 75c505b1-711d-4f68-a357-8c3fe37dbf2d related: - id: 03552375-cc2c-4883-bbe4-7958d5a980be type: derived status: test description: Detects SILENTTRINITY stager dll loading activity references: - https://github.com/byt3bl33d3r/SILENTTRINITY author: Aleksey Potapov, oscd.community date: 2019-10-22 modified: 2023-02-17 tags: - attack.command-and-control - attack.t1071 logsource: category: image_load product: windows detection: selection: Description|contains: st2stager condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are. Logsource: windows / ps_script. Rule: title: Detected Windows Software Discovery - PowerShell id: 2650dd1a-eb2a-412d-ac36-83f06c4f2282 status: test description: Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518/T1518.md - https://github.com/harleyQu1nn/AggressorScripts author: Nikita Nazarov, oscd.community date: 2020-10-16 modified: 2022-12-02 tags: - attack.discovery - attack.t1518 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - get-itemProperty - \software\ - select-object - format-table condition: selection falsepositives: - Legitimate administration activities level: medium
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects a regedit started with TrustedInstaller privileges or by ProcessHacker.exe. Logsource: windows / process_creation. Rule: title: Regedit as Trusted Installer id: 883835a7-df45-43e4-bf1d-4268768afda4 status: test description: Detects a regedit started with TrustedInstaller privileges or by ProcessHacker.exe references: - https://twitter.com/1kwpeter/status/1397816101455765504 author: Florian Roth (Nextron Systems) date: 2021-05-27 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.t1548 logsource: category: process_creation product: windows detection: selection: Image|endswith: \regedit.exe ParentImage|endswith: - \TrustedInstaller.exe - \ProcessHacker.exe condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects execution of netsh with the "advfirewall" and the "set" option in order to set new values for properties of a ex. Logsource: windows / process_creation. Rule: title: Firewall Rule Update Via Netsh.EXE id: a70dcb37-3bee-453a-99df-d0c683151be6 status: test description: Detects execution of netsh with the "advfirewall" and the "set" option in order to set new values for properties of a existing rule references: - https://ss64.com/nt/netsh.html author: X__Junior (Nextron Systems) date: 2023-07-18 tags: - attack.defense-impairment logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \netsh.exe - OriginalFileName: netsh.exe selection_cli: CommandLine|contains|all: - ' firewall ' - ' set ' condition: all of selection_* falsepositives: - Legitimate administration activity - Software installations and removal level: medium
Query: describe CVE-2015-0604
Matching passage: CVE-2015-0604. CWE: CWE-20. CVSS: 5.0. The web framework on Cisco Unified IP 9900 phones with firmware 9.4(.1) and earlier allows remote attackers to upload files to arbitrary locations on a phone's filesystem via crafted HTTP requests, aka Bug ID CSCup90424.
Near-miss passage: CVE-2015-4393. CWE: CWE-20. CVSS: 6.0. The resource/endpoint for uploading files in the Services module 7.x-3.x before 7.x-3.12 for Drupal allows remote authenticated users with the "Save file information" permission to execute arbitrary code via a crafted filename.
Query: patch priority for CVE-2015-1822
Matching passage: CVE-2015-1822. CWE: CWE-17. CVSS: 6.5. chrony before 1.31.1 does not initialize the last "next" pointer when saving unacknowledged replies to command requests, which allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and daemon crash) or possibly execute arbitrary code via a large number of command requests.
Near-miss passage: CVE-2015-6760. CWE: CWE-17. CVSS: 7.5. The Image11::map function in renderer/d3d/d3d11/Image11.cpp in libANGLE, as used in Google Chrome before 46.0.2490.71, mishandles mapping failures after device-lost events, which allows remote attackers to cause a denial of service (invalid read or write) or possibly have unspecified other impact via vectors involving a removed device.
Query: patch priority for CVE-2015-0496
Matching passage: CVE-2015-0496. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53 and 8.54 allows remote authenticated users to affect confidentiality via vectors related to PIA Search Functionality.
Near-miss passage: CVE-2015-4905. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via vectors related to Server : DML.
Query: risk of Insecure default configuration in Progress Software OpenEdge 10.2x and 11.x allows unauthenticated remote attackers to specify arbitrary URLs from which to load and execute malicio
Matching passage: CVE-2015-9245. CWE: CWE-284. CVSS: 9.800000190734863. Insecure default configuration in Progress Software OpenEdge 10.2x and 11.x allows unauthenticated remote attackers to specify arbitrary URLs from which to load and execute malicious Java classes via port 20931.
Near-miss passage: CVE-2015-2959. CWE: CWE-284. CVSS: 7.5. Zoho NetFlow Analyzer build 10250 and earlier does not check for administrative authorization, which allows remote attackers to obtain sensitive information, modify passwords, or remove accounts by leveraging the guest role.
Query: vulnerability: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, A
Matching passage: CVE-2015-7639. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7636, CVE-2015-7637, CVE-2015-7638, CVE-2015-7640, CVE-2015-7641, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644.
Near-miss passage: CVE-2015-0350. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0347, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, CVE-2015-3042, and CVE-2015-3043.
Query: explain CWE-590
Matching passage: CWE-590 Free of Memory not on the Heap. The product calls free() on a pointer to memory that was not allocated using associated heap allocation functions such as malloc(), calloc(), or realloc().
Near-miss passage: CWE-46 Path Equivalence: 'filename ' (Trailing Space). The product accepts path input in the form of trailing space ('filedir ') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
Query: mitigate Confluence
Matching passage: T1213.001 Confluence. Tactics: collection. Description: Adversaries may leverage Confluence repositories to mine valuable information. Often found in development environments alongside Atlassian JIRA, Confluence is generally used to store development-related documentation, however, in general may contain more diverse categories of useful information, such as: * Policies, procedures, and standards * Physical / logical network diagrams * System architecture diagrams * Technical system documentation * Testing / development credentials (i.e., [Unsecured Credentials](https://attack.mitre.org/techniques/T1552)) * Work / project schedules * Source code snippets * Links to network shares and other internal resources
Near-miss passage: T1213.005 Messaging Applications. Tactics: collection. Description: Adversaries may leverage chat and messaging applications, such as Microsoft Teams, Google Chat, and Slack, to mine valuable information. The following is a brief list of example information that may hold potential value to an adversary and may also be found on messaging applications: * Testing / development credentials (i.e., [Chat Messages](https://attack.mitre.org/techniques/T1552/008)) * Source code snippets * Links to network shares and other internal resources * Proprietary data(Citation: Guardian Grand Theft Auto Leak 2022) * Discussions about ongoing incident response efforts(Citation: SC Magazine Ragnar Locker 2021)(Citation: Microsoft DEV-0537) In addition to exfiltrating data from messaging applications, adversaries may leverage data from chat messages in order to improve their targeting - for example, by learning more about an environment or evading ongoing incident response efforts.(Citation: Sentinel Labs NullBulge 2024)(Citation: Permiso Scattered Spider 2023)
Query: detect Detects installation or execution of services in logs
Matching passage: Sigma rule: Detects installation or execution of services. Logsource: windows / system. Rule: title: HackTool Service Registration or Execution id: d26ce60c-2151-403c-9a42-49420d87b5e4 status: test description: Detects installation or execution of services references: - Internal Research author: Florian Roth (Nextron Systems) date: 2022-03-21 modified: 2023-08-07 tags: - attack.execution - attack.t1569.002 - attack.s0029 logsource: product: windows service: system detection: selection_eid: Provider_Name: Service Control Manager EventID: - 7045 - 7036 selection_service_name: ServiceName|contains: - cachedump - DumpSvc - gsecdump - pwdump - UACBypassedService - WCE SERVICE - WCESERVICE - winexesvc selection_service_image: ImagePath|contains: bypass condition: selection_eid and 1 of selection_service_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when full data export is attempted an unauthorized user.. Logsource: bitbucket / audit. Rule: title: Bitbucket Unauthorized Full Data Export Triggered id: 34d81081-03c9-4a7f-91c9-5e46af625cde status: test description: Detects when full data export is attempted an unauthorized user. references: - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html - https://confluence.atlassian.com/bitbucketserver/secret-scanning-1157471613.html author: Muhammad Faisal (@faisalusuf) date: 2024-02-25 tags: - attack.collection - attack.resource-development - attack.t1213.003 - attack.t1586 logsource: product: bitbucket service: audit definition: 'Requirements: "Advance" log level is required to receive these audit events.' detection: selection: auditType.category: Data pipeline auditType.action: Unauthorized full data export triggered condition: selection falsepositives: - Unlikely level: critical
Query: what is T1115
Matching passage: T1115 Clipboard Data. Tactics: collection. Description: Adversaries may collect data stored in the clipboard from users copying information within or between applications. For example, on Windows adversaries can access clipboard data by using <code>clip.exe</code> or <code>Get-Clipboard</code>.(Citation: MSDN Clipboard)(Citation: clip_win_server)(Citation: CISA_AA21_200B) Additionally, adversaries may monitor then replace users’ clipboard with their data (e.g., [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002)).(Citation: mining_ruby_reversinglabs) macOS and Linux also have commands, such as <code>pbpaste</code>, to grab clipboard contents.(Citation: Operating with EmPyre)
Near-miss passage: T1560.003 Archive via Custom Method. Tactics: collection. Description: An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival methods, such as encryption with XOR or stream ciphers implemented with no external library or utility references. Custom implementations of well-known compression algorithms have also been used.(Citation: ESET Sednit Part 2)
Query: exploit The MemcmpLowercase function in Suricata before 2.0.6 improperly excludes the first byte from comparisons, which might allow remote attackers to bypass intrusion-prevention functio
Matching passage: CVE-2015-8954. CWE: CWE-264. CVSS: 9.800000190734863. The MemcmpLowercase function in Suricata before 2.0.6 improperly excludes the first byte from comparisons, which might allow remote attackers to bypass intrusion-prevention functionality via a crafted HTTP request.
Near-miss passage: CVE-2015-1885. CWE: CWE-264. CVSS: 9.300000190734863. WebSphereOauth20SP.ear in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, 8.5 Liberty Profile before 8.5.5.5, and 8.5 Full Profile before 8.5.5.6, when the OAuth grant type requires sending a password, allows remote attackers to gain privileges via unspecified vectors.
Query: ATT&CK technique for Data from Configuration Repository
Matching passage: T1602 Data from Configuration Repository. Tactics: collection. Description: Adversaries may collect data related to managed devices from configuration repositories. Configuration repositories are used by management systems in order to configure, manage, and control data on remote systems. Configuration repositories may also facilitate remote access and administration of devices. Adversaries may target these repositories in order to collect large quantities of sensitive system administration data. Data from configuration repositories may be exposed by various protocols and software and can store a wide variety of data, much of which may align with adversary Discovery objectives.(Citation: US-CERT-TA18-106A)(Citation: US-CERT TA17-156A SNMP Abuse 2017)
Near-miss passage: T1602.002 Network Device Configuration Dump. Tactics: collection. Description: Adversaries may access network configuration files to collect sensitive data about the device and the network. The network configuration is a file containing parameters that determine the operation of the device. The device typically stores an in-memory copy of the configuration while operating, and a separate configuration on non-volatile storage to load after device reset. Adversaries can inspect the configuration files to reveal information about the target network and its layout, the network device and its software, or identifying legitimate accounts and credentials for later use. Adversaries can use common management tools and protocols, such as Simple Network Management Protocol (SNMP) and Smart Install (SMI), to access network configuration files.(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)(Citation: Cisco Blog Legacy Device Attacks) These tools may be used to query specific data from a configuration repository or configure the device to export the configuration for later analysis.
Query: patch priority for CVE-2015-2154
Matching passage: CVE-2015-2154. CWE: CWE-119. CVSS: 5.0. The osi_print_cksum function in print-isoclns.c in the ethernet printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted (1) length, (2) offset, or (3) base pointer checksum value.
Near-miss passage: CVE-2015-7547. CWE: CWE-119. CVSS: 8.100000381469727. Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response that triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6 address family, related to performing "dual A/AAAA DNS queries" and the libnss_dns.so.2 NSS module.
Query: vulnerability: App/HelperFunctions.pm in Shutter through 0.93.1 allows user-assisted remote attackers to execute arbitrary commands via a crafted image name that is mishandled during a "Show in F
Matching passage: CVE-2015-0854. CWE: CWE-19. CVSS: 7.800000190734863. App/HelperFunctions.pm in Shutter through 0.93.1 allows user-assisted remote attackers to execute arbitrary commands via a crafted image name that is mishandled during a "Show in Folder" action.
Near-miss passage: CVE-2015-7575. CWE: CWE-19. CVSS: 5.900000095367432. Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof servers by triggering a collision.
Query: collection using Databases
Matching passage: T1213.006 Databases. Tactics: collection. Description: Adversaries may leverage databases to mine valuable information. These databases may be hosted on-premises or in the cloud (both in platform-as-a-service and software-as-a-service environments). Examples of databases from which information may be collected include MySQL, PostgreSQL, MongoDB, Amazon Relational Database Service, Azure SQL Database, Google Firebase, and Snowflake. Databases may include a variety of information of interest to adversaries, such as usernames, hashed passwords, personally identifiable information, and financial data. Data collected from databases may be used for [Lateral Movement](https://attack.mitre.org/tactics/TA0008), [Command and Control](https://attack.mitre.org/tactics/TA0011), or [Exfiltration](https://attack.mitre.org/tactics/TA0010). Data exfiltrated from databases may also be used to extort victims or may be sold for profit.(Citation: Google Cloud Threat Intelligence UNC5537 Snowflake 2024)
Near-miss passage: T1213.004 Customer Relationship Management Software. Tactics: collection. Description: Adversaries may leverage Customer Relationship Management (CRM) software to mine valuable information. CRM software is used to assist organizations in tracking and managing customer interactions, as well as storing customer data. Once adversaries gain access to a victim organization, they may mine CRM software for customer data. This may include personally identifiable information (PII) such as full names, emails, phone numbers, and addresses, as well as additional details such as purchase histories and IT support interactions. By collecting this data, an adversary may be able to send personalized [Phishing](https://attack.mitre.org/techniques/T1566) emails, engage in SIM swapping, or otherwise target the organization’s customers in ways that enable financial gain or the compromise of additional organizations.(Citation: Bleeping Computer US Cellular Hack 2022)(Citation: Bleeping Computer Mint Mobile Hack 2021)(Citation: Bleeping Computer Bank Hack 2020) CRM software may be hosted on-premises or in the cloud. Information stored in these solutions may vary based on the specific instance or environment. Examples of CRM software include Microsoft Dynamics 365, Salesforce, Zoho, Zendesk, and HubSpot.
Query: describe CVE-2015-8150
Matching passage: CVE-2015-8150. CWE: CWE-264. CVSS: 7.800000190734863. Symantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows local users to obtain root access by modifying a batch file.
Near-miss passage: CVE-2015-3028. CWE: CWE-264. CVSS: 5.5. McAfee Advanced Threat Defense (MATD) before 3.4.4.63 allows remote authenticated users to bypass intended restrictions and change or update configuration settings via crafted parameters.