alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: SQL injection vulnerability in the EQ Event Calendar component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to eqfullevent.
Matching passage: CVE-2015-4654. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the EQ Event Calendar component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to eqfullevent.
Near-miss passage: CVE-2015-5148. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in LivelyCart 1.2.0 allows remote attackers to execute arbitrary SQL commands via the search_query parameter to product/search.
Query: exploit The login page of the server on Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with software before V100R003C00SPC503, XH628 V3 with 
Matching passage: CVE-2015-7841. CWE: CWE-77. CVSS: 9.800000190734863. The login page of the server on Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with software before V100R003C00SPC503, XH628 V3 with software before V100R003C00SPC602, RH1288 V3 with software before V100R003C00SPC602, RH2288A V2 with software before V100R002C00SPC701, RH1288A V2 with software before V100R002C00SPC502, RH8100 V3 with software before V100R003C00SPC110, CH222 V3 with software before V100R001C00SPC161, CH220 V3 with software before V100R001C00SPC161, and CH121 V3 with software before V100R001C00SPC161 allows remote attackers to bypass access restrictions and enter commands via unspecified parameters, as demonstrated by a "user creation command."
Near-miss passage: CVE-2015-5474. CWE: CWE-77. CVSS: 9.300000190734863. BitTorrent and uTorrent allow remote attackers to inject command line parameters and execute arbitrary commands via a crafted URL using the (1) bittorrent or (2) magnet protocol.
Query: SOC alert related to Revert Cloud Instance
Matching passage: T1578.004 Revert Cloud Instance. Tactics: defense impairment. Description: An adversary may revert changes made to a cloud instance after they have performed malicious activities in attempt to evade detection and remove evidence of their presence. In highly virtualized environments, such as cloud-based infrastructure, this may be accomplished by restoring virtual machine (VM) or data storage snapshots through the cloud management dashboard or cloud APIs. Another variation of this technique is to utilize temporary storage attached to the compute instance. Most cloud providers provide various types of storage including persistent, local, and/or ephemeral, with the ephemeral types often reset upon stop/restart of the VM.(Citation: Tech Republic - Restore AWS Snapshots)(Citation: Google - Restore Cloud Snapshot)
Near-miss passage: T1578.002 Create Cloud Instance. Tactics: defense impairment. Description: An adversary may create a new instance or virtual machine (VM) within the compute service of a cloud account to evade defenses. Creating a new instance may allow an adversary to bypass firewall rules and permissions that exist on instances currently residing within an account. An adversary may [Create Snapshot](https://attack.mitre.org/techniques/T1578/001) of one or more volumes in an account, create a new instance, mount the snapshots, and then apply a less restrictive security policy to collect [Data from Local System](https://attack.mitre.org/techniques/T1005) or for [Remote Data Staging](https://attack.mitre.org/techniques/T1074/002).(Citation: Mandiant M-Trends 2020) Creating a new instance may also allow an adversary to carry out malicious activity within an environment without affecting the execution of current running instances.
Query: patch priority for CVE-2015-2000
Matching passage: CVE-2015-2000. CWE: CWE-118. CVSS: 9.800000190734863. The Jumio SDK before 1.5.0 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.
Near-miss passage: CVE-2015-2003. CWE: CWE-118. CVSS: 9.800000190734863. The PJSIP PJSUA2 SDK before SVN Changeset 51322 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.
Query: patch priority for CVE-2015-9469
Matching passage: CVE-2015-9469. CWE: CWE-79. CVSS: 4.800000190734863. The content-grabber plugin 1.0 for WordPress has XSS via obj_field_name or obj_field_id.
Near-miss passage: CVE-2015-0156. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.6.0 and WebSphere Lombardi Edition (WLE) 7.2.x through 7.2.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Query: SOC alert related to Process Discovery
Matching passage: T1057 Process Discovery. Tactics: discovery. Description: Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from [Process Discovery](https://attack.mitre.org/techniques/T1057) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. In Windows environments, adversaries could obtain details on running processes using the [Tasklist](https://attack.mitre.org/software/S0057) utility via [cmd](https://attack.mitre.org/software/S0106) or <code>Get-Process</code> via [PowerShell](https://attack.mitre.org/techniques/T1059/001). Information about processes can also be extracted from the output of [Native API](https://attack.mitre.org/techniques/T1106) calls such as <code>CreateToolhelp32Snapshot</code>. In Mac and Linux, this is accomplished with the <code>ps</code> command. Adversaries may also opt to enumerate processes via `/proc`. ESXi also supports use of the `ps` command, as well as `esxcli system process list`.(Citation: Sygnia ESXi Ransomware 2025)(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021) On network devices, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `show processes` can be used to display current running processes.(Citation: US-CERT-TA18-106A)(Citation: show_processes_cisco_cmd)
Near-miss passage: T1069.002 Domain Groups. Tactics: discovery. Description: Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators. Commands such as <code>net group /domain</code> of the [Net](https://attack.mitre.org/software/S0039) utility, <code>dscacheutil -q group</code> on macOS, and <code>ldapsearch</code> on Linux can list domain-level groups.
Query: CVE similar to CVE-2015-3333
Matching passage: CVE-2015-3333. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in Google V8 before 4.2.77.14, as used in Google Chrome before 42.0.2311.90, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Near-miss passage: CVE-2015-6988. CWE: UNKNOWN. CVSS: 10.0. The kernel in Apple iOS before 9.1 and OS X before 10.11.1 does not initialize an unspecified data structure, which allows remote attackers to execute arbitrary code via vectors involving an unknown network-connectivity requirement.
Query: exploit Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 3.0.1 and 3.1.2 allows remote attackers to affect confidentiality, integrity, and ava
Matching passage: CVE-2015-0396. CWE: UNKNOWN. CVSS: 7.5. Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 3.0.1 and 3.1.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Admin Console.
Near-miss passage: CVE-2015-0476. CWE: UNKNOWN. CVSS: 5.5. Unspecified vulnerability in the SQL Trace Analyzer component in Oracle Support Tools before 12.1.11 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
Query: CVE similar to CVE-2015-9035
Matching passage: CVE-2015-9035. CWE: CWE-119. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a memory buffer fails to be freed after it is no longer needed potentially resulting in memory exhaustion.
Near-miss passage: CVE-2015-5120. CWE: CWE-119. CVSS: 10.0. Adobe Shockwave Player before 12.1.9.159 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5121.
Query: CVE similar to CVE-2015-1755
Matching passage: CVE-2015-1755. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1731, CVE-2015-1736, and CVE-2015-1737.
Near-miss passage: CVE-2015-0591. CWE: CWE-399. CVSS: 5.0. Cisco Unified Communications Domain Manager (UCDM) 10 allows remote attackers to cause a denial of service (daemon hang and GUI outage) via a flood of malformed TCP packets, aka Bug ID CSCur44177.
Query: patch priority for CVE-2015-10114
Matching passage: CVE-2015-10114. CWE: CWE-601. CVSS: 6.099999904632568. A vulnerability, which was classified as problematic, has been found in WooSidebars Plugin up to 1.4.1 on WordPress. Affected by this issue is the function enable_custom_post_sidebars of the file classes/class-woo-sidebars.php. The manipulation of the argument sendback leads to open redirect. The attack may be launched remotely. Upgrading to version 1.4.2 is able to address this issue. The patch is identified as 1ac6d6ac26e185673f95fc1ccc56a392169ba601. It is recommended to upgrade the affected component. VDB-230654 is the identifier assigned to this vulnerability.
Near-miss passage: CVE-2015-0697. CWE: CWE-601. CVSS: 5.800000190734863. Open redirect vulnerability in the login page in Cisco TC Software before 6.3-26 and 7.x before 7.3.0 on Cisco TelePresence Collaboration Desk and Room Endpoints devices allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, aka Bug ID CSCuq94980.
Query: Sigma YAML for windows / dns_query
Matching passage: Sigma rule: Detects DNS query requests to "update.onelaunch.com". This domain is associated with the OneLaunch adware application. W. Logsource: windows / dns_query. Rule: title: DNS Query Request To OneLaunch Update Service id: df68f791-ad95-447f-a271-640a0dab9cf8 status: test description: 'Detects DNS query requests to "update.onelaunch.com". This domain is associated with the OneLaunch adware application. When the OneLaunch application is installed it will attempt to get updates from this domain. ' references: - https://www.malwarebytes.com/blog/detections/pup-optional-onelaunch-silentcf - https://www.myantispyware.com/2020/12/14/how-to-uninstall-onelaunch-browser-removal-guide/ - https://malware.guide/browser-hijacker/remove-onelaunch-virus/ author: Josh Nickels date: 2024-02-26 tags: - attack.credential-access - attack.collection - attack.t1056 logsource: category: dns_query product: windows detection: selection: QueryName: update.onelaunch.com Image|endswith: \OneLaunch.exe condition: selection falsepositives: - Unlikely level: low
Near-miss passage: Sigma rule: Detects python spawning a pretty tty. Logsource: windows / process_creation. Rule: title: Python Spawning Pretty TTY on Windows id: 480e7e51-e797-47e3-8d72-ebfce65b6d8d related: - id: 899133d5-4d7c-4a7f-94ee-27355c879d90 type: derived status: test description: Detects python spawning a pretty tty references: - https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/ author: Nextron Systems date: 2022-06-03 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: - python.exe - python3.exe - python2.exe selection_cli_1: CommandLine|contains|all: - import pty - .spawn( selection_cli_2: CommandLine|contains: from pty import spawn condition: selection_img and 1 of selection_cli_* falsepositives: - Unknown level: high
Query: exploit EMC Secure Remote Services Virtual Edition (ESRS VE) 3.x before 3.06 does not properly generate random values for session cookies, which makes it easier for remote attackers to hij
Matching passage: CVE-2015-0544. CWE: UNKNOWN. CVSS: 9.300000190734863. EMC Secure Remote Services Virtual Edition (ESRS VE) 3.x before 3.06 does not properly generate random values for session cookies, which makes it easier for remote attackers to hijack sessions by predicting a value.
Near-miss passage: CVE-2015-2014. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in the web server in IBM Domino 8.5 before 8.5.3 FP6 IF9 and 9.0 before 9.0.1 FP4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or cross-site scripting (XSS) attacks via a crafted URL, aka SPR SJAR9DNGDA.
Query: CWE for Asymmetric Resource Consumption (Amplification)
Matching passage: CWE-405 Asymmetric Resource Consumption (Amplification). The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is asymmetric.
Near-miss passage: CWE-824 Access of Uninitialized Pointer. The product accesses or uses a pointer that has not been initialized.
Query: exploit Microsoft Edge misparses HTTP responses, which allows remote attackers to redirect users to arbitrary web sites via unspecified vectors, aka "Microsoft Edge Spoofing Vulnerability.
Matching passage: CVE-2015-6169. CWE: CWE-20. CVSS: 4.300000190734863. Microsoft Edge misparses HTTP responses, which allows remote attackers to redirect users to arbitrary web sites via unspecified vectors, aka "Microsoft Edge Spoofing Vulnerability."
Near-miss passage: CVE-2015-2923. CWE: CWE-20. CVSS: 6.5. The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in FreeBSD through 10.1 allows remote attackers to reconfigure a hop-limit setting via a small hop_limit value in a Router Advertisement (RA) message.
Query: vulnerability: Remote file upload vulnerability in wordpress plugin csv2wpec-coupon v1.1
Matching passage: CVE-2015-1000013. CWE: CWE-434. CVSS: 7.800000190734863. Remote file upload vulnerability in wordpress plugin csv2wpec-coupon v1.1
Near-miss passage: CVE-2015-9263. CWE: CWE-434. CVSS: 9.800000190734863. An issue was discovered in post2file.php in Up.Time Monitoring Station 7.5.0 (build 16) and 7.4.0 (build 13). It allows an attacker to upload an arbitrary file, such as a .php file that can execute arbitrary OS commands.
Query: CVE similar to CVE-2015-20019
Matching passage: CVE-2015-20019. CWE: CWE-79. CVSS: 5.400000095367432. The Content text slider on post WordPress plugin before 6.9 does not sanitise and escape the Title and Message/Content settings, which could lead to Cross-Site Scripting issues
Near-miss passage: CVE-2015-9260. CWE: CWE-79. CVSS: 5.400000095367432. An issue was discovered in BEdita before 3.7.0. A cross-site scripting (XSS) attack occurs via a crafted pages/showObjects URI, as demonstrated by appending a payload to a pages/showObjects/2/0/0/leafs URI.
Query: exploit The RADIUS functionality on Cisco Wireless LAN Controller (WLC) devices with software 7.0(250.0) and 7.0(252.0) allows remote attackers to disconnect arbitrary sessions via crafted
Matching passage: CVE-2015-6302. CWE: CWE-399. CVSS: 5.0. The RADIUS functionality on Cisco Wireless LAN Controller (WLC) devices with software 7.0(250.0) and 7.0(252.0) allows remote attackers to disconnect arbitrary sessions via crafted Disconnect-Request UDP packets, aka Bug ID CSCuw29419.
Near-miss passage: CVE-2015-6287. CWE: CWE-399. CVSS: 5.0. Cisco Web Security Appliance (WSA) 8.0.6-078 and 8.0.6-115 allows remote attackers to cause a denial of service (service outage) via a flood of TCP traffic that leads to DNS resolution delays, aka Bug IDs CSCur32005 and CSCur07907.
Query: describe CVE-2015-8535
Matching passage: CVE-2015-8535. CWE: CWE-22. CVSS: 7.800000190734863. MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A directory traversal vulnerability was discovered (fixed and publicly disclosed in 2015) in Lenovo Solution Center (LSC) prior to version 3.3.002 that could allow a user to execute arbitrary code with elevated privileges.
Near-miss passage: CVE-2015-8798. CWE: CWE-22. CVSS: 8.0. Directory traversal vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedded Security: Critical System Protection for Controllers and Devices (SES:CSP) 6.5.0 before MP1, Critical System Protection (SCSP) before 5.2.9 MP6, Data Center Security: Server Advanced Server (DCS:SA) 6.x before 6.5 MP1 and 6.6 before MP1, and Data Center Security: Server Advanced Server and Agents (DCS:SA) through 6.6 MP1 allows remote authenticated users to execute arbitrary code via unspecified vectors.
Query: explain T1497.002 User Activity Based Checks
Matching passage: T1497.002 User Activity Based Checks. Tactics: stealth, discovery. Description: Adversaries may employ various user activity checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness) Adversaries may search for user activity on the host based on variables such as the speed/frequency of mouse movements and clicks (Citation: Sans Virtual Jan 2016) , browser history, cache, bookmarks, or number of files in common directories such as home or the desktop. Other methods may rely on specific user interaction with the system before the malicious code is activated, such as waiting for a document to close before activating a macro (Citation: Unit 42 Sofacy Nov 2018) or waiting for a user to double click on an embedded image to activate.(Citation: FireEye FIN7 April 2017)
Near-miss passage: T1497.003 Time Based Checks. Tactics: stealth, discovery. Description: Adversaries may employ various time-based methods to detect virtualization and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time. This may include enumerating time-based properties, such as uptime or the system clock. Adversaries may use calls like `GetTickCount` and `GetSystemTimeAsFileTime` to discover if they are operating within a virtual machine or sandbox, or may be able to identify a sandbox accelerating time by sampling and calculating the expected value for an environment's timestamp before and after execution of a sleep function.(Citation: ISACA Malware Tricks)
Query: describe CVE-2015-2102
Matching passage: CVE-2015-2102. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in view_item.php in ClipBucket 2.7 RC3 (2.7.0.4.v2929-rc3) allows remote attackers to execute arbitrary SQL commands via the item parameter.
Near-miss passage: CVE-2015-8334. CWE: CWE-89. CVSS: 8.800000190734863. SQL injection vulnerability in the Operation and Maintenance Unit (OMU) in Huawei VCN500 before V100R002C00SPC201 allows remote authenticated users to execute arbitrary SQL commands via a crafted HTTP request.
Query: rule covering Detects successful authentication from potential clients using legacy authentication via user agent strings. This could
Matching passage: Sigma rule: Detects successful authentication from potential clients using legacy authentication via user agent strings. This could. Logsource: azure / signinlogs. Rule: title: Potential MFA Bypass Using Legacy Client Authentication id: 53bb4f7f-48a8-4475-ac30-5a82ddfdf6fc status: test description: Detects successful authentication from potential clients using legacy authentication via user agent strings. This could be a sign of MFA bypass using a password spray attack. references: - https://web.archive.org/web/20230217071802/https://blooteem.com/march-2022 - https://www.microsoft.com/en-us/security/blog/2021/10/26/protect-your-business-from-password-sprays-with-microsoft-dart-recommendations/ author: Harjot Singh, '@cyb3rjy0t' date: 2023-03-20 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.credential-access - attack.stealth - attack.t1078.004 - attack.t1110 logsource: product: azure service: signinlogs detection: selection: Status: Success userAgent|contains: - BAV2ROPC - CBAinPROD - CBAinTAR condition: selection falsepositives: - Known Legacy Accounts level: high
Near-miss passage: Sigma rule: Detects the use of grep to identify information about the operating system architecture. Often combined beforehand with. Logsource: linux / process_creation. Rule: title: OS Architecture Discovery Via Grep id: d27ab432-2199-483f-a297-03633c05bae6 status: test description: 'Detects the use of grep to identify information about the operating system architecture. Often combined beforehand with the execution of "uname" or "cat /proc/cpuinfo" ' references: - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/ - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-06-02 tags: - attack.discovery - attack.t1082 logsource: category: process_creation product: linux detection: selection_process: Image|endswith: /grep selection_architecture: CommandLine|endswith: - aarch64 - arm - i386 - i686 - mips - x86_64 condition: all of selection_* falsepositives: - Unknown level: low