alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explore
Matching passage: CVE-2015-1738. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2388.
Near-miss passage: CVE-2015-8455. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, and CVE-2015-8451.
Query: vulnerability: Multiple SQL injection vulnerabilities in the Huge-IT Slider (slider-image) plugin before 2.7.0 for WordPress allow remote administrators to execute arbitrary SQL commands via the 
Matching passage: CVE-2015-2062. CWE: CWE-89. CVSS: 7.199999809265137. Multiple SQL injection vulnerabilities in the Huge-IT Slider (slider-image) plugin before 2.7.0 for WordPress allow remote administrators to execute arbitrary SQL commands via the removeslide parameter in a popup_posts or edit_cat action in the sliders_huge_it_slider page to wp-admin/admin.php.
Near-miss passage: CVE-2015-4627. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in Pragyan CMS 3.0.
Query: vulnerability: Multiple stack-based buffer overflows in WebGate eDVR Manager allow remote attackers to execute arbitrary code via unspecified vectors to the (1) Connect, (2) ConnectEx, or (3) Con
Matching passage: CVE-2015-2098. CWE: CWE-120. CVSS: 8.800000190734863. Multiple stack-based buffer overflows in WebGate eDVR Manager allow remote attackers to execute arbitrary code via unspecified vectors to the (1) Connect, (2) ConnectEx, or (3) ConnectEx2 function in the WESPEvent.WESPEventCtrl.1 control; (4) AudioOnlySiteChannel function in the WESPPlayback.WESPPlaybackCtrl.1 control; (5) Connect or (6) ConnectEx function in the WESPPTZ.WESPPTZCtrl.1 control; (7) SiteChannel property in the WESPPlayback.WESPPlaybackCtrl.1 control; (8) SiteName property in the WESPPlayback.WESPPlaybackCtrl.1 control; or (9) OpenDVrSSite function in the WESPPTZ.WESPPTZCtrl.1 control.
Near-miss passage: CVE-2015-6458. CWE: CWE-120. CVSS: 8.800000190734863. Moxa SoftCMS 1.3 and prior is susceptible to a buffer overflow condition that may crash or allow remote code execution. Moxa released SoftCMS version 1.4 on June 1, 2015, to address the vulnerability.
Query: CVE similar to CVE-2015-9105
Matching passage: CVE-2015-9105. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in Synology Video Station 1.2 before 1.2-0455, 1.5 before 1.5-0772, and 1.6 before 1.6-0847 allow remote authenticated attackers to inject arbitrary web script or HTML via the (1) file name or (2) collection name of videos.
Near-miss passage: CVE-2015-0655. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Unified Web Interaction Manager in Cisco Unified Web and E-Mail Interaction Manager allows remote attackers to inject arbitrary web script or HTML via vectors related to a POST request, aka Bug ID CSCus74184.
Query: patch priority for CVE-2015-3167
Matching passage: CVE-2015-3167. CWE: CWE-200. CVSS: 7.5. contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses different error responses when an incorrect key is used, which makes it easier for attackers to obtain the key via a brute force attack.
Near-miss passage: CVE-2015-0783. CWE: CWE-200. CVSS: 6.5. The FileViewer class in Novell ZENworks Configuration Management (ZCM) allows remote authenticated users to read arbitrary files via the filename variable.
Query: CWE for Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
Matching passage: CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection'). The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.
Near-miss passage: CWE-925 Improper Verification of Intent by Broadcast Receiver. The Android application uses a Broadcast Receiver that receives an Intent but does not properly verify that the Intent came from an authorized source.
Query: exploit Cisco Videoscape Distribution Suite Service Broker (aka VDS-SB), when a VDSM configuration on UCS is used, and Videoscape Distribution Suite for Internet Streaming (aka VDS-IS or C
Matching passage: CVE-2015-0725. CWE: CWE-20. CVSS: 7.800000190734863. Cisco Videoscape Distribution Suite Service Broker (aka VDS-SB), when a VDSM configuration on UCS is used, and Videoscape Distribution Suite for Internet Streaming (aka VDS-IS or CDS-IS) before 3.3.1 R7 and 4.x before 4.0.0 R4 allow remote attackers to cause a denial of service (device reload) via a crafted HTTP request, aka Bug IDs CSCus79834 and CSCuu63409.
Near-miss passage: CVE-2015-7750. CWE: CWE-20. CVSS: 5.0. The L2TP packet processing functionality in Juniper Netscreen and ScreenOS Firewall products with ScreenOS before 6.3.0r13-dnd1, 6.3.0r14 through 6.3.0r18 before 6.3.0r18-dnc1, and 6.3.0r19 allows remote attackers to cause a denial of service via a crafted L2TP packet.
Query: hunt for Standard Encoding activity
Matching passage: T1132.001 Standard Encoding. Tactics: command and control. Description: Adversaries may encode data with a standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system that adheres to existing protocol specifications. Common data encoding schemes include ASCII, Unicode, hexadecimal, Base64, and MIME.(Citation: Wikipedia Binary-to-text Encoding)(Citation: Wikipedia Character Encoding) Some data encoding systems may also result in data compression, such as gzip.
Near-miss passage: T1132 Data Encoding. Tactics: command and control. Description: Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems.(Citation: Wikipedia Binary-to-text Encoding) (Citation: Wikipedia Character Encoding) Some data encoding systems may also result in data compression, such as gzip.
Query: describe CVE-2015-2927
Matching passage: CVE-2015-2927. CWE: CWE-399. CVSS: 6.5. node 0.3.2 and URONode before 1.0.5r3 allows remote attackers to cause a denial of service (bandwidth consumption).
Near-miss passage: CVE-2015-6321. CWE: CWE-399. CVSS: 7.800000190734863. Cisco AsyncOS before 8.5.7-042, 9.x before 9.1.0-032, 9.1.x before 9.1.1-023, and 9.5.x and 9.6.x before 9.6.0-042 on Email Security Appliance (ESA) devices; before 9.1.0-032, 9.1.1 before 9.1.1-005, and 9.5.x before 9.5.0-025 on Content Security Management Appliance (SMA) devices; and before 7.7.0-725 and 8.x before 8.0.8-113 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (memory consumption) via a flood of TCP packets, aka Bug IDs CSCus79774, CSCus79777, and CSCzv95795.
Query: exploit The image signature algorithm in OpenStack Glance 11.0.0 allows remote attackers to bypass the signature verification process via a crafted image, which triggers an MD5 collision.
Matching passage: CVE-2015-8234. CWE: CWE-310. CVSS: 5.5. The image signature algorithm in OpenStack Glance 11.0.0 allows remote attackers to bypass the signature verification process via a crafted image, which triggers an MD5 collision.
Near-miss passage: CVE-2015-0010. CWE: CWE-310. CVSS: 1.899999976158142. The CryptProtectMemory function in cng.sys (aka the Cryptography Next Generation driver) in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1, when the CRYPTPROTECTMEMORY_SAME_LOGON option is used, does not check an impersonation token's level, which allows local users to bypass intended decryption restrictions by leveraging a service that (1) has a named-pipe planting vulnerability or (2) uses world-readable shared memory for encrypted data, aka "CNG Security Feature Bypass Vulnerability" or MSRC ID 20707.
Query: vulnerability: The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by
Matching passage: CVE-2015-9097. CWE: CWE-93. CVSS: 6.099999904632568. The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring.
Near-miss passage: CVE-2015-9096. CWE: CWE-93. CVSS: 6.099999904632568. Net::SMTP in Ruby before 2.4.0 is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring.
Query: write Sigma for Detects service principal name (SPN) enumeration used for Kerberoasting
Matching passage: Sigma rule: Detects service principal name (SPN) enumeration used for Kerberoasting. Logsource: windows / process_creation. Rule: title: Potential SPN Enumeration Via Setspn.EXE id: 1eeed653-dbc8-4187-ad0c-eeebb20e6599 status: test description: Detects service principal name (SPN) enumeration used for Kerberoasting references: - https://web.archive.org/web/20200329173843/https://p16.praetorian.com/blog/how-to-use-kerberoasting-t1208-for-privilege-escalation - https://www.praetorian.com/blog/how-to-use-kerberoasting-t1208-for-privilege-escalation/?edition=2019 author: Markus Neis, keepwatch date: 2018-11-14 modified: 2023-10-23 tags: - attack.credential-access - attack.t1558.003 logsource: category: process_creation product: windows detection: selection_pe: - Image|endswith: \setspn.exe - OriginalFileName: setspn.exe - Description|contains|all: - Query or reset the computer - SPN attribute selection_cli: CommandLine|contains: - ' -q ' - ' /q ' condition: all of selection_* falsepositives: - Administration activity level: medium
Near-miss passage: Sigma rule: Detects execution of the "mofcomp" utility as a child of a suspicious shell or script running utility or by having a sus. Logsource: windows / process_creation. Rule: title: Potential Suspicious Mofcomp Execution id: 1dd05363-104e-4b4a-b963-196a534b03a1 status: test description: 'Detects execution of the "mofcomp" utility as a child of a suspicious shell or script running utility or by having a suspicious path in the commandline. The "mofcomp" utility parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. Attackers abuse this utility to install malicious MOF scripts ' references: - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/ - https://github.com/The-DFIR-Report/Sigma-Rules/blob/75260568a7ffe61b2458ca05f6f25914efb44337/win_mofcomp_execution.yml - https://learn.microsoft.com/en-us/windows/win32/wmisdk/mofcomp author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-12 modified: 2023-04-11 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \mofcomp.exe - OriginalFileName: mofcomp.exe selection_case: - ParentImage|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe - \wsl.exe - \wscript.exe - \cscript.exe - CommandLine|contains: - \AppData\Local\Temp - \Users\Public\ - \WINDOWS\Temp\ - '%temp%' - '%tmp%' - '%appdata%' filter_main_wmiprvse: ParentImage: C:\Windows\System32\wbem\WmiPrvSE.exe CommandLine|contains: C:\Windows\TEMP\ CommandLine|endswith: .mof filter_optional_null_parent: CommandLine|contains: C:\Windows\TEMP\ CommandLine|endswith: .mof condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-3634
Matching passage: CVE-2015-3634. CWE: CWE-200. CVSS: 7.5. The SlideshowPluginSlideshowStylesheet::loadStylesheetByAJAX function in the Slideshow plugin 2.2.8 through 2.2.21 for Wordpress allows remote attackers to read arbitrary Wordpress option values.
Near-miss passage: CVE-2015-4519. CWE: CWE-200. CVSS: 4.300000190734863. Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow user-assisted remote attackers to bypass intended access restrictions and discover a redirect's target URL via crafted JavaScript code that executes after a drag-and-drop action of an image into a TEXTBOX element.
Query: detection rule: Detects .NET Framework CLR and .NET Core CLR "cor_enable_profiling" and "cor_profiler" variables being set and configure
Matching passage: Sigma rule: Detects .NET Framework CLR and .NET Core CLR "cor_enable_profiling" and "cor_profiler" variables being set and configure. Logsource: windows / registry_set. Rule: title: Enabling COR Profiler Environment Variables id: ad89044a-8f49-4673-9a55-cbd88a1b374f status: test description: Detects .NET Framework CLR and .NET Core CLR "cor_enable_profiling" and "cor_profiler" variables being set and configured. references: - https://twitter.com/jamieantisocial/status/1304520651248668673 - https://www.slideshare.net/JamieWilliams130/started-from-the-bottom-exploiting-data-sources-to-uncover-attck-behaviors - https://www.sans.org/cyber-security-summit/archives - https://learn.microsoft.com/en-us/dotnet/core/runtime-config/debugging-profiling author: Jose Rodriguez (@Cyb3rPandaH), OTR (Open Threat Research), Jimmy Bayne (@bohops) date: 2020-09-10 modified: 2023-11-24 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.012 logsource: category: registry_set product: windows detection: selection_1: TargetObject|endswith: - \COR_ENABLE_PROFILING - \COR_PROFILER - \CORECLR_ENABLE_PROFILING selection_2: TargetObject|contains: \CORECLR_PROFILER_PATH condition: 1 of selection_* level: medium
Near-miss passage: Sigma rule: Detects changes to the "DisableHypervisorEnforcedPagingTranslation" registry value. Where the it is set to "1" in order. Logsource: windows / registry_set. Rule: title: Hypervisor Enforced Paging Translation Disabled id: 7f2954d2-99c2-4d42-a065-ca36740f187b status: test description: 'Detects changes to the "DisableHypervisorEnforcedPagingTranslation" registry value. Where the it is set to "1" in order to disable the Hypervisor Enforced Paging Translation feature. ' references: - https://twitter.com/standa_t/status/1808868985678803222 - https://github.com/AaLl86/WindowsInternals/blob/070dc4f317726dfb6ffd2b7a7c121a33a8659b5e/Slides/Hypervisor-enforced%20Paging%20Translation%20-%20The%20end%20of%20non%20data-driven%20Kernel%20Exploits%20(Recon2024).pdf author: Nasreddine Bencherchali (Nextron Systems) date: 2024-07-05 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \DisableHypervisorEnforcedPagingTranslation Details: DWORD (0x00000001) condition: selection falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-5245
Matching passage: CVE-2015-5245. CWE: UNKNOWN. CVSS: 4.300000190734863. CRLF injection vulnerability in the Ceph Object Gateway (aka radosgw or RGW) in Ceph before 0.94.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted bucket name.
Near-miss passage: CVE-2015-8566. CWE: UNKNOWN. CVSS: 7.5. The Session package 1.x before 1.3.1 for Joomla! Framework allows remote attackers to execute arbitrary code via unspecified session values.
Query: Sigma YAML for azure / activitylogs
Matching passage: Sigma rule: Identifies when a service account is modified or deleted.. Logsource: azure / activitylogs. Rule: title: Azure Kubernetes Service Account Modified or Deleted id: 12d027c3-b48c-4d9d-8bb6-a732200034b2 status: test description: Identifies when a service account is modified or deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/ - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1 author: Austin Songer @austinsonger date: 2021-08-07 modified: 2022-08-23 tags: - attack.impact - attack.t1531 - attack.t1485 - attack.t1496 - attack.t1489 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/SERVICEACCOUNTS/WRITE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/SERVICEACCOUNTS/DELETE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/SERVICEACCOUNTS/IMPERSONATE/ACTION condition: selection falsepositives: - Service account being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Service account modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects the execution GMER tool based on image and hash fields.. Logsource: windows / process_creation. Rule: title: HackTool - GMER Rootkit Detector and Remover Execution id: 9082ff1f-88ab-4678-a3cc-5bcff99fc74d status: test description: Detects the execution GMER tool based on image and hash fields. references: - http://www.gmer.net/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-05 modified: 2024-11-23 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \gmer.exe selection_sysmon_hash: Hashes|contains: - MD5=E9DC058440D321AA17D0600B3CA0AB04 - SHA1=539C228B6B332F5AA523E5CE358C16647D8BBE57 - SHA256=E8A3E804A96C716A3E9B69195DB6FFB0D33E2433AF871E4D4E1EAB3097237173 condition: 1 of selection_* falsepositives: - Unlikely level: high
Query: risk of A Denial of Service vulnerability exists in ircd-ratbox 3.0.9 in the MONITOR Command Handler.
Matching passage: CVE-2015-5290. CWE: CWE-119. CVSS: 7.5. A Denial of Service vulnerability exists in ircd-ratbox 3.0.9 in the MONITOR Command Handler.
Near-miss passage: CVE-2015-2444. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2442.
Query: vulnerability: A vulnerability was found in Custom-Content-Width 1.0. It has been declared as problematic. Affected by this vulnerability is the function override_content_width/register_settings 
Matching passage: CVE-2015-10075. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability was found in Custom-Content-Width 1.0. It has been declared as problematic. Affected by this vulnerability is the function override_content_width/register_settings of the file custom-content-width.php. The manipulation leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.1 is able to address this issue. The patch is named e05e0104fc42ad13b57e2b2cb2d1857432624d39. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220219. NOTE: This attack is not very likely.
Near-miss passage: CVE-2015-9303. CWE: CWE-79. CVSS: 6.099999904632568. The simple-share-buttons-adder plugin before 6.0.0 for WordPress has XSS.
Query: playbook for alert: Encoded PowerShell / command-line abuse matching Domains
Matching passage: Playbook for T1583.001 Domains. 1) Validate alert telemetry against T1583.001. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: resource development. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free. Adversaries may use acquired domains for a variety of purposes, including for [Phishing](https://attack.mitre.org/techniques/T1566), [Drive-by Compromise](https://attack.mitre.org/techniq
Near-miss passage: Playbook for T1583.004 Server. Different response path focused on resource development.