alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-10128
Matching passage: CVE-2015-10128. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability was found in rt-prettyphoto Plugin up to 1.2 on WordPress and classified as problematic. Affected by this issue is the function royal_prettyphoto_plugin_links of the file rt-prettyphoto.php. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.3 is able to address this issue. The patch is identified as 0d3d38cfa487481b66869e4212df1cefc281ecb7. It is recommended to upgrade the affected component. VDB-249422 is the identifier assigned to this vulnerability.
Near-miss passage: CVE-2015-8350. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in the Calls to Action plugin before 2.5.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) open-tab parameter in a wp_cta_global_settings action to wp-admin/edit.php or (2) wp-cta-variation-id parameter to ab-testing-call-to-action-example/.
Query: rule covering Detects the execution of "wmic" with the "group" flag. Adversaries may attempt to find local system groups and permissio
Matching passage: Sigma rule: Detects the execution of "wmic" with the "group" flag. Adversaries may attempt to find local system groups and permissio. Logsource: windows / process_creation. Rule: title: Local Groups Reconnaissance Via Wmic.EXE id: 164eda96-11b2-430b-85ff-6a265c15bf32 status: test description: 'Detects the execution of "wmic" with the "group" flag. Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.001/T1069.001.md author: frack113 date: 2021-12-12 modified: 2023-02-14 tags: - attack.discovery - attack.t1069.001 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \wmic.exe - OriginalFileName: wmic.exe selection_cli: CommandLine|contains: ' group' condition: all of selection* falsepositives: - Unknown level: low regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_group/info.yml
Near-miss passage: Sigma rule: Detects the execution of a renamed office binary. Logsource: windows / process_creation. Rule: title: Renamed Office Binary Execution id: 0b0cd537-fc77-4e6e-a973-e53495c1083d status: test description: Detects the execution of a renamed office binary references: - https://infosec.exchange/@sbousseaden/109542254124022664 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-20 modified: 2025-12-09 tags: - attack.stealth - attack.t1036.003 logsource: category: process_creation product: windows detection: selection: - OriginalFileName: - Excel.exe - MSACCESS.EXE - MSPUB.EXE - OneNote.exe - OneNoteM.exe - OUTLOOK.EXE - POWERPNT.EXE - WinWord.exe - Olk.exe - Description: - Microsoft Access - Microsoft Excel - Microsoft OneNote - Microsoft Outlook - Microsoft PowerPoint - Microsoft Publisher - Microsoft Word - Sent to OneNote Tool filter_main_legit_names: Image|endswith: - \EXCEL.exe - \excelcnv.exe - \MSACCESS.exe - \MSPUB.EXE - \ONENOTE.EXE - \ONENOTEM.EXE - \OUTLOOK.EXE - \POWERPNT.EXE - \WINWORD.exe - \OLK.EXE condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: common weakness: Improper Neutralization of Input Used for LLM Prompting
Matching passage: CWE-1427 Improper Neutralization of Input Used for LLM Prompting. The product uses externally-provided data to build prompts provided to large language models (LLMs), but the way these prompts are constructed causes the LLM to fail to distinguish between user-supplied inputs and developer provided system directives.
Near-miss passage: CWE-209 Generation of Error Message Containing Sensitive Information. The product generates an error message that includes sensitive information about its environment, users, or associated data.
Query: vulnerability: Cross-site request forgery (CSRF) vulnerability on Cisco DPQ3925 devices with EDVA 5.5.2 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuv05
Matching passage: CVE-2015-6378. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability on Cisco DPQ3925 devices with EDVA 5.5.2 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuv05943.
Near-miss passage: CVE-2015-2701. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in CS-Cart 4.2.4 allows remote attackers to hijack the authentication of users for requests that change a user password via a request to profiles-update/.
Query: Sigma rule for Detects applications or users re-enabling old TLS versions by setting the "Enabled" value to "1" for the "Protocols" reg
Matching passage: Sigma rule: Detects applications or users re-enabling old TLS versions by setting the "Enabled" value to "1" for the "Protocols" reg. Logsource: windows / registry_set. Rule: title: Old TLS1.0/TLS1.1 Protocol Version Enabled id: 439957a7-ad86-4a8f-9705-a28131c6821b status: test description: Detects applications or users re-enabling old TLS versions by setting the "Enabled" value to "1" for the "Protocols" registry key. references: - https://techcommunity.microsoft.com/t5/windows-it-pro-blog/tls-1-0-and-tls-1-1-soon-to-be-disabled-in-windows/ba-p/3887947 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-09-05 tags: - attack.stealth logsource: category: registry_set product: windows detection: selection: TargetObject|contains: - \Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\ - \Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\ TargetObject|endswith: \Enabled Details: DWORD (0x00000001) condition: selection falsepositives: - Legitimate enabling of the old tls versions due to incompatibility level: medium
Near-miss passage: Sigma rule: Detects the use of the 'Launch-VsDevShell.ps1' Microsoft signed script to execute commands.. Logsource: windows / process_creation. Rule: title: Launch-VsDevShell.PS1 Proxy Execution id: 45d3a03d-f441-458c-8883-df101a3bb146 status: test description: Detects the use of the 'Launch-VsDevShell.ps1' Microsoft signed script to execute commands. references: - https://twitter.com/nas_bench/status/1535981653239255040 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-19 tags: - attack.stealth - attack.t1216.001 logsource: category: process_creation product: windows detection: selection_script: CommandLine|contains: Launch-VsDevShell.ps1 selection_flags: CommandLine|contains: - 'VsWherePath ' - 'VsInstallationPath ' condition: all of selection_* falsepositives: - Legitimate usage of the script by a developer level: medium
Query: risk of The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20, 7 before SR9 FP30, and 7 R1 before SR3 FP30 allows remote attackers to obtain sensitive inf
Matching passage: CVE-2015-5041. CWE: CWE-200. CVSS: 9.100000381469727. The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20, 7 before SR9 FP30, and 7 R1 before SR3 FP30 allows remote attackers to obtain sensitive information or inject data by invoking non-public interface methods.
Near-miss passage: CVE-2015-1883. CWE: CWE-200. CVSS: 4.0. IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote authenticated users to read certain administrative files via crafted use of an automated-maintenance policy stored procedure.
Query: playbook for alert: Suspicious Device Registration execution detected on endpoint
Matching passage: Playbook for T1098.005 Device Registration. 1) Validate alert telemetry against T1098.005. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: persistence, privilege escalation. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance. MFA systems, such as Duo or Okta, allow users to associate devices with their accounts in order to complete MFA requirements. An advers
Near-miss passage: Playbook for T1098.006 Additional Container Cluster Roles. Different response path focused on persistence, privilege escalation.
Query: detection rule: Detects usage of system utilities (only grep for now) to discover security software discovery
Matching passage: Sigma rule: Detects usage of system utilities (only grep for now) to discover security software discovery. Logsource: macos / process_creation. Rule: title: Security Software Discovery - MacOs id: 0ed75b9c-c73b-424d-9e7d-496cd565fbe0 status: test description: Detects usage of system utilities (only grep for now) to discover security software discovery references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518.001/T1518.001.md author: Daniil Yugoslavskiy, oscd.community date: 2020-10-19 modified: 2022-11-27 tags: - attack.discovery - attack.t1518.001 logsource: category: process_creation product: macos detection: image: Image: /usr/bin/grep selection_cli_1: CommandLine|contains: - nessusd - santad - CbDefense - falcond - td-agent - packetbeat - filebeat - auditbeat - osqueryd - BlockBlock - LuLu selection_cli_2: CommandLine|contains|all: - Little - Snitch condition: image and 1 of selection_cli_* falsepositives: - Legitimate activities level: medium
Near-miss passage: Sigma rule: Detects addition of users to the local administrator group via "Net" or "Add-LocalGroupMember".. Logsource: windows / process_creation. Rule: title: User Added to Local Administrators Group id: ad720b90-25ad-43ff-9b5e-5c841facc8e5 related: - id: ffa28e60-bdb1-46e0-9f82-05f7a61cc06e type: similar - id: 10fb649c-3600-4d37-b1e6-56ea90bb7e09 type: similar status: test description: Detects addition of users to the local administrator group via "Net" or "Add-LocalGroupMember". references: - https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1 author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-08-12 modified: 2023-03-02 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: category: process_creation product: windows detection: selection_main: - CommandLine|contains|all: - 'localgroup ' - ' /add' - CommandLine|contains|all: - 'Add-LocalGroupMember ' - ' -Group ' selection_group: CommandLine|contains: - ' administrators ' - ' administrateur' condition: all of selection_* falsepositives: - Administrative activity level: medium
Query: risk of The boot manager in Cisco Application Policy Infrastructure Controller (APIC) 1.1(0.920a) allows local users to bypass intended access restrictions and obtain single-user-mode root
Matching passage: CVE-2015-6424. CWE: CWE-255. CVSS: 7.199999809265137. The boot manager in Cisco Application Policy Infrastructure Controller (APIC) 1.1(0.920a) allows local users to bypass intended access restrictions and obtain single-user-mode root access via unspecified vectors, aka Bug ID CSCuu83985.
Near-miss passage: CVE-2015-6846. CWE: CWE-255. CVSS: 6.800000190734863. EMC SourceOne Email Supervisor before 7.2 uses hardcoded encryption keys, which makes it easier for attackers to obtain access by examining how a program's code conducts cryptographic operations.
Query: Persistence mechanism resembling Clear Linux or Mac System Logs
Matching passage: T1685.006 Clear Linux or Mac System Logs. Tactics: defense impairment. Description: Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the `/var/log/` directory. Subfolders in this directory categorize logs by their related functions, such as:(Citation: Linux Logs) * `/var/log/messages:`: General and system-related messages * `/var/log/secure or /var/log/auth.log`: Authentication logs * `/var/log/utmp or /var/log/wtmp`: Login records * `/var/log/kern.log`: Kernel logs * `/var/log/cron.log`: Crond logs * `/var/log/maillog`: Mail server logs * `/var/log/httpd/`: Web server access and error logs
Near-miss passage: T1685.001 Disable or Modify Windows Event Log. Tactics: defense impairment. Description: Adversaries may disable or modify the Windows Event Log to limit data that can be leveraged for detections and audits. Windows Event Log records user and system activity such as login attempts and process creation.(Citation: EventLog_Core_Technologies) This data is used by security tools and analysts to generate detections. The EventLog service maintains event logs from various system components and applications. By default, the service automatically starts when a system powers on. An audit policy, maintained by the Local Security Policy (secpol.msc), defines which system events the EventLog service logs. Security audit policy settings can be changed by running secpol.msc, then navigating to `Security Settings\Local Policies\Audit Policy` for basic audit policy settings or `Security Settings\Advanced Audit Policy Configuration` for advanced audit policy settings.(Citation: Microsoft Audit Policy)(Citation: Microsoft Adv Security Settings) `auditpol.exe` may also be used to set audit policies.(Citation: Microsoft auditpol) Adversaries may target system-wide logging or just that of a particular application. For example, the Windows EventLog service may be disabled using the `Set-Service -Name EventLog -Status Stopped` or `sc config eventlog start=disabled` commands (followed by manually stopping the service using `Stop-Service -Name EventLog`). Additionally, the service may be disabled by modifying the "Start" value in `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog` then restarting the system for the change to take effect.(Citation: Disable_Win_Event_Logging)(Citation: disable_win_evt_logging) There are several ways to disable the EventLog service via registry key modification. Without Administrator privileges, adversaries may modify the "Start" value in the key `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Security`, then reboot the system to disable the Security EventLog.(Citation: winser19_file_overwrite_bug_twitter) W
Query: intelligence brief on T1559.001
Matching passage: T1559.001 Component Object Model. Tactics: execution. Description: Adversaries may use the Windows Component Object Model (COM) for local code execution. COM is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.(Citation: Fireeye Hunting COM June 2019) Through COM, a client object can call methods of server objects, which are typically binary Dynamic Link Libraries (DLL) or executables (EXE).(Citation: Microsoft COM) Remote COM execution is facilitated by [Remote Services](https://attack.mitre.org/techniques/T1021) such as [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) (DCOM).(Citation: Fireeye Hunting COM June 2019) Various COM interfaces are exposed that can be abused to invoke arbitrary execution via a variety of programming languages such as C, C++, Java, and [Visual Basic](https://attack.mitre.org/techniques/T1059/005).(Citation: Microsoft COM) Specific COM objects also exist to directly perform functions beyond code execution, such as creating a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), fileless download/execution, and other adversary behaviors related to privilege escalation and persistence.(Citation: Fireeye Hunting COM June 2019)(Citation: ProjectZero File Write EoP Apr 2018)
Near-miss passage: T1559.003 XPC Services. Tactics: execution. Description: Adversaries can provide malicious content to an XPC service daemon for local code execution. macOS uses XPC services for basic inter-process communication between various processes, such as between the XPC Service daemon and third-party application privileged helper tools. Applications can send messages to the XPC Service daemon, which runs as root, using the low-level XPC Service <code>C API</code> or the high level <code>NSXPCConnection API</code> in order to handle tasks that require elevated privileges (such as network connections). Applications are responsible for providing the protocol definition which serves as a blueprint of the XPC services. Developers typically use XPC Services to provide applications stability and privilege separation between the application client and the daemon.(Citation: creatingXPCservices)(Citation: Designing Daemons Apple Dev) Adversaries can abuse XPC services to execute malicious content. Requests for malicious execution can be passed through the application's XPC Services handler.(Citation: CVMServer Vuln)(Citation: Learn XPC Exploitation) This may also include identifying and abusing improper XPC client validation and/or poor sanitization of input parameters to conduct [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068).
Query: describe CVE-2015-5605
Matching passage: CVE-2015-5605. CWE: CWE-17. CVSS: 5.0. The regular-expression implementation in Google V8, as used in Google Chrome before 44.0.2403.89, mishandles interrupts, which allows remote attackers to cause a denial of service (application crash) via crafted JavaScript code, as demonstrated by an error in garbage collection during allocation of a stack-overflow exception message.
Near-miss passage: CVE-2015-1262. CWE: CWE-17. CVSS: 7.5. platform/fonts/shaping/HarfBuzzShaper.cpp in Blink, as used in Google Chrome before 43.0.2357.65, does not initialize a certain width field, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted Unicode text.
Query: detect Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately in logs
Matching passage: Sigma rule: Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately. Logsource: azure / activitylogs. Rule: title: Azure Subscription Permission Elevation Via ActivityLogs id: 09438caa-07b1-4870-8405-1dbafe3dad95 status: test description: 'Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn''t planned. This setting could allow an attacker access to Azure subscriptions in your environment. ' references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftauthorization author: Austin Songer @austinsonger date: 2021-11-26 modified: 2022-08-23 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078.004 logsource: product: azure service: activitylogs detection: selection: operationName: MICROSOFT.AUTHORIZATION/ELEVATEACCESS/ACTION condition: selection falsepositives: - If this was approved by System Administrator. level: high
Near-miss passage: Sigma rule: Detects remote RPC calls to possibly abuse remote encryption service via MS-SRVS. Logsource: rpc_firewall / application. Rule: title: Remote Server Service Abuse id: b6ea3cc7-542f-43ef-bbe4-980fbed444c7 status: test description: Detects remote RPC calls to possibly abuse remote encryption service via MS-SRVS references: - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/accf23b0-0f57-441c-9185-43041f1b0ee9 - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-SRVS.md - https://github.com/zeronetworks/rpcfirewall - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/ author: Sagie Dulce, Dekel Paz date: 2022-01-01 tags: - attack.lateral-movement logsource: product: rpc_firewall category: application definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:4b324fc8-1670-01d3-1278-5a47bf6ee188' detection: selection: EventLog: RPCFW EventID: 3 InterfaceUuid: 4b324fc8-1670-01d3-1278-5a47bf6ee188 condition: selection falsepositives: - Legitimate remote share creation level: high
Query: weakness Comparing instead of Assigning
Matching passage: CWE-482 Comparing instead of Assigning. The code uses an operator for comparison when the intention was to perform an assignment.
Near-miss passage: CWE-407 Inefficient Algorithmic Complexity. An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
Query: hunt for LSA Secrets activity
Matching passage: T1003.004 LSA Secrets. Tactics: credential access. Description: Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.(Citation: Passcape LSA Secrets)(Citation: Microsoft AD Admin Tier Model)(Citation: Tilbury Windows Credentials) LSA secrets are stored in the registry at <code>HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets</code>. LSA secrets can also be dumped from memory.(Citation: ired Dumping LSA Secrets) [Reg](https://attack.mitre.org/software/S0075) can be used to extract from the Registry. [Mimikatz](https://attack.mitre.org/software/S0002) can be used to extract secrets from memory.(Citation: ired Dumping LSA Secrets)
Near-miss passage: T1003.006 DCSync. Tactics: credential access. Description: Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API)(Citation: Microsoft DRSR Dec 2017) (Citation: Microsoft GetNCCChanges) (Citation: Samba DRSUAPI) (Citation: Wine API samlib.dll) to simulate the replication process from a remote domain controller using a technique called DCSync. Members of the Administrators, Domain Admins, and Enterprise Admin groups or computer accounts on the domain controller are able to run DCSync to pull password data(Citation: ADSecurity Mimikatz DCSync) from Active Directory, which may include current and historical hashes of potentially useful accounts such as KRBTGT and Administrators. The hashes can then in turn be used to create a [Golden Ticket](https://attack.mitre.org/techniques/T1558/001) for use in [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003)(Citation: Harmj0y Mimikatz and DCSync) or change an account's password as noted in [Account Manipulation](https://attack.mitre.org/techniques/T1098).(Citation: InsiderThreat ChangeNTLM July 2017) DCSync functionality has been included in the "lsadump" module in [Mimikatz](https://attack.mitre.org/software/S0002).(Citation: GitHub Mimikatz lsadump Module) Lsadump also includes NetSync, which performs DCSync over a legacy replication protocol.(Citation: Microsoft NRPC Dec 2017)