alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit Unspecified vulnerability in Oracle Sun Solaris 10 and 11 allows remote attackers to affect confidentiality via unknown vectors related to Network.
Matching passage: CVE-2015-0375. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Sun Solaris 10 and 11 allows remote attackers to affect confidentiality via unknown vectors related to Network.
Near-miss passage: CVE-2015-5551. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5556, CVE-2015-5557, CVE-2015-5559, CVE-2015-5561, CVE-2015-5563, CVE-2015-5564, and CVE-2015-5565.
Query: risk of SQL injection vulnerability in the GetReRequestData method of the GetStoredResult class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to execute arbitra
Matching passage: CVE-2015-0780. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in the GetReRequestData method of the GetStoredResult class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-1423. CWE: CWE-89. CVSS: 6.5. Multiple SQL injection vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote administrators to execute arbitrary SQL commands via the (1) jak_delete_log[] or (2) ssp parameter to admin/index.php.
Query: common weakness: Doubled Character XSS Manipulations
Matching passage: CWE-85 Doubled Character XSS Manipulations. The web application does not filter user-controlled input for executable script disguised using doubling of the involved characters.
Near-miss passage: CWE-30 Path Traversal: 'dir..filename'. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize 'dir..filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory.
Query: patch priority for CVE-2015-0063
Matching passage: CVE-2015-0063. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Excel 2007 SP3; the proofing tools in Office 2010 SP2; Excel 2010 SP2; Excel 2013 Gold, SP1, and RT; Excel Viewer; and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Excel Remote Code Execution Vulnerability."
Near-miss passage: CVE-2015-8003. CWE: CWE-399. CVSS: 6.800000190734863. MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not throttle file uploads, which allows remote authenticated users to have unspecified impact via multiple file uploads.
Query: Encoded PowerShell / command-line abuse matching Symmetric Cryptography
Matching passage: T1573.001 Symmetric Cryptography. Tactics: command and control. Description: Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.
Near-miss passage: T1573.002 Asymmetric Cryptography. Tactics: command and control. Description: Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private. Due to how the keys are generated, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key. This ensures that only the intended recipient can read the encrypted data. Common public key encryption algorithms include RSA and ElGamal. For efficiency, many protocols (including SSL/TLS) use symmetric cryptography once a connection is established, but use asymmetric cryptography to establish or transmit a key. As such, these protocols are classified as [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002).
Query: secure coding against Reliance on Untrusted Inputs in a Security Decision
Matching passage: CWE-807 Reliance on Untrusted Inputs in a Security Decision. The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.
Near-miss passage: CWE-1272 Sensitive Information Uncleared Before Debug/Power State Transition. The product performs a power or debug state transition, but it does not clear sensitive information that should no longer be accessible due to changes to information access restrictions.
Query: patch priority for CVE-2015-6237
Matching passage: CVE-2015-6237. CWE: CWE-287. CVSS: 9.800000190734863. The RPC service in Tripwire (formerly nCircle) IP360 VnE Manager 7.2.2 before 7.2.6 allows remote attackers to bypass authentication and (1) enumerate users, (2) reset passwords, or (3) manipulate IP filter restrictions via crafted "privileged commands."
Near-miss passage: CVE-2015-3442. CWE: CWE-287. CVSS: 9.800000190734863. Soreco Xpert.Line 3.0 allows local users to spoof users and consequently gain privileges by intercepting a Windows API call.
Query: vulnerability: The API in the WebKit Plug-ins component in Apple Safari before 9 does not provide notification of an HTTP Redirection (aka 3xx) status code to a plugin, which allows remote attack
Matching passage: CVE-2015-5828. CWE: CWE-20. CVSS: 4.300000190734863. The API in the WebKit Plug-ins component in Apple Safari before 9 does not provide notification of an HTTP Redirection (aka 3xx) status code to a plugin, which allows remote attackers to bypass intended request restrictions via a crafted web site.
Near-miss passage: CVE-2015-8489. CWE: CWE-20. CVSS: 6.5. customapp in Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to cause a denial of service (excessive database locking) via a crafted CSV file, a different vulnerability than CVE-2016-1153.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects when a share is mounted using the "net.exe" utility. Logsource: windows / process_creation. Rule: title: Windows Share Mount Via Net.EXE id: f117933c-980c-4f78-b384-e3d838111165 related: - id: 3abd6094-7027-475f-9630-8ab9be7b9725 type: similar status: test description: Detects when a share is mounted using the "net.exe" utility references: - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-02 modified: 2023-02-21 tags: - attack.lateral-movement - attack.t1021.002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \net.exe - \net1.exe - OriginalFileName: - net.exe - net1.exe selection_cli: CommandLine|contains: - ' use ' - ' \\\\' condition: all of selection_* falsepositives: - Legitimate activity by administrators and scripts level: low
Near-miss passage: Sigma rule: VisualUiaVerifyNative.exe is a Windows SDK that can be used for AWL bypass and is listed in Microsoft's recommended bloc. Logsource: windows / process_creation. Rule: title: Use of VisualUiaVerifyNative.exe id: b30a8bc5-e21b-4ca2-9420-0a94019ac56a status: test description: VisualUiaVerifyNative.exe is a Windows SDK that can be used for AWL bypass and is listed in Microsoft's recommended block rules. references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/VisualUiaVerifyNative/ - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac - https://bohops.com/2020/10/15/exploring-the-wdac-microsoft-recommended-block-rules-visualuiaverifynative/ - https://github.com/MicrosoftDocs/windows-itpro-docs/commit/937db704b9148e9cee7c7010cad4d00ce9c4fdad author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io date: 2022-06-01 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \VisualUiaVerifyNative.exe - OriginalFileName: VisualUiaVerifyNative.exe condition: selection falsepositives: - Legitimate testing of Microsoft UI parts. level: medium
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects commandline arguments for executing a child process via dotnet-trace.exe. Logsource: windows / process_creation. Rule: title: Binary Proxy Execution Via Dotnet-Trace.EXE id: 9257c05b-4a4a-48e5-a670-b7b073cf401b status: test description: Detects commandline arguments for executing a child process via dotnet-trace.exe references: - https://twitter.com/bohops/status/1740022869198037480 author: Jimmy Bayne (@bohops) date: 2024-01-02 tags: - attack.execution - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \dotnet-trace.exe - OriginalFileName: dotnet-trace.dll selection_cli: CommandLine|contains|all: - '-- ' - collect condition: all of selection_* falsepositives: - Legitimate usage of the utility in order to debug and trace a program. level: medium
Near-miss passage: Sigma rule: Detects the creation of the "accepteula" key related to the Sysinternals tools being created from executables with the w. Logsource: windows / registry_set. Rule: title: Suspicious Execution Of Renamed Sysinternals Tools - Registry id: f50f3c09-557d-492d-81db-9064a8d4e211 related: - id: 25ffa65d-76d8-4da5-a832-3f2b0136e133 type: derived - id: 8023f872-3f1d-4301-a384-801889917ab4 type: similar status: test description: Detects the creation of the "accepteula" key related to the Sysinternals tools being created from executables with the wrong name (e.g. a renamed Sysinternals tool) references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-24 modified: 2026-06-29 tags: - attack.resource-development - attack.t1588.002 logsource: product: windows category: registry_set detection: selection: TargetObject|contains: - \Active Directory Explorer - \Handle - \LiveKd - \ProcDump - \Process Explorer - \PsExec - \PsLoggedon - \PsLoglist - \PsPasswd - \PsPing - \PsService - \SDelete TargetObject|endswith: \EulaAccepted filter: Image|endswith: - \ADExplorer.exe - \ADExplorer64.exe - \ADExplorer64a.exe - \handle.exe - \handle64.exe - \handle64a.exe - \livekd.exe - \livekd64.exe - \procdump.exe - \procdump64.exe - \procdump64a.exe - \procexp.exe - \procexp64.exe - \procexp64a.exe - \PsExec.exe - \PsExec64.exe - \PsExec64a.exe - \PsLoggedon.exe - \PsLoggedon64.exe - \psloglist.exe - \psloglist64.exe - \psloglist64a.exe - \pspasswd.exe - \pspasswd64.exe - \pspasswd64a.exe - \PsPing.exe - \PsPing64.exe - \PsPing64a.exe - \PsService.exe - \PsService64.exe - \PsService64a.exe - \sdelete.exe condition: selection and not filter falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_pua_sysinternals_renamed_execution_via_eula/info.yml
Query: common weakness: Reliance on Package-level Scope
Matching passage: CWE-487 Reliance on Package-level Scope. Java packages are not inherently closed; therefore, relying on them for code security is not a good practice.
Near-miss passage: CWE-1331 Improper Isolation of Shared Resources in Network On Chip (NoC). The Network On Chip (NoC) does not isolate or incorrectly isolates its on-chip-fabric and internal resources such that they are shared between trusted and untrusted agents, creating timing channels.
Query: patch priority for CVE-2015-6396
Matching passage: CVE-2015-6396. CWE: CWE-78. CVSS: 7.800000190734863. The CLI command parser on Cisco RV110W, RV130W, and RV215W devices allows local users to execute arbitrary shell commands as an administrator via crafted parameters, aka Bug IDs CSCuv90134, CSCux58161, and CSCux73567.
Near-miss passage: CVE-2015-7901. CWE: CWE-78. CVSS: 6.5. Infinite Automation Mango Automation 2.5.x and 2.6.x through 2.6.0 build 430 allows remote authenticated users to execute arbitrary OS commands via unspecified vectors.
Query: patch priority for CVE-2015-3372
Matching passage: CVE-2015-3372. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Node Invite module before 6.x-2.5 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a node title.
Near-miss passage: CVE-2015-3257. CWE: CWE-79. CVSS: 6.099999904632568. Zend/Diactoros/Uri::filterPath in zend-diactoros before 1.0.4 does not properly sanitize path input, which allows remote attackers to perform cross-site scripting (XSS) or open redirect attacks.
Query: SOC runbook when seeing SIEM correlation: stealth activity consistent with MSBuild
Matching passage: Playbook for T1127.001 MSBuild. 1) Validate alert telemetry against T1127.001. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth, execution. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio. It handles XML formatted project files that define requirements for loading and building various platforms and configurations.(Citation: MSDN MSBuild) Adversaries can abuse MSBuild to proxy execution of malicious code. Th
Near-miss passage: Playbook for T1127.003 JamPlus. Different response path focused on stealth, execution.
Query: Sigma rule for Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows t
Matching passage: Sigma rule: Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows t. Logsource: windows / ps_script. Rule: title: Suspicious PowerShell WindowStyle Option id: 313fbb0a-a341-4682-848d-6d6f8c4fab7c status: test description: 'Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.003/T1564.003.md author: frack113, Tim Shelton (fp AWS) date: 2021-10-20 modified: 2023-01-03 tags: - attack.stealth - attack.t1564.003 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - powershell - WindowStyle - Hidden filter: ScriptBlockText|contains|all: - :\Program Files\Amazon\WorkSpacesConfig\Scripts\ - $PSScriptRoot\Module\WorkspaceScriptModule\WorkspaceScriptModule condition: selection and not filter falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects overwriting (effectively wiping/deleting) of a file.. Logsource: linux / auditd. Rule: title: Overwriting the File with Dev Zero or Null id: 37222991-11e9-4b6d-8bdf-60fbe48f753e status: stable description: Detects overwriting (effectively wiping/deleting) of a file. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md author: Jakob Weinzettl, oscd.community date: 2019-10-23 tags: - attack.impact - attack.t1485 logsource: product: linux service: auditd detection: selection: type: EXECVE a0|contains: dd a1|contains: - if=/dev/null - if=/dev/zero condition: selection falsepositives: - Appending null bytes to files. - Legitimate overwrite of files. level: low
Query: weakness Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Matching passage: CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection'). The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.
Near-miss passage: CWE-1251 Mirrored Regions with Different Values. The product's architecture mirrors regions without ensuring that their contents always stay in sync.
Query: vulnerability: Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and A
Matching passage: CVE-2015-5099. CWE: CWE-416. CVSS: 10.0. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-4448, CVE-2015-5095, CVE-2015-5101, CVE-2015-5111, CVE-2015-5113, and CVE-2015-5114.
Near-miss passage: CVE-2015-6687. CWE: CWE-416. CVSS: 10.0. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5586, CVE-2015-6683, CVE-2015-6684, CVE-2015-6688, CVE-2015-6689, CVE-2015-6690, CVE-2015-6691, CVE-2015-7615, CVE-2015-7617, and CVE-2015-7621.
Query: vulnerability: Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via vectors re
Matching passage: CVE-2015-4809. CWE: UNKNOWN. CVSS: 1.5. Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via vectors related to Outside In PDF Export SDK, a different vulnerability than CVE-2015-4811.
Near-miss passage: CVE-2015-5566. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5557, CVE-2015-5559, CVE-2015-5561, CVE-2015-5563, CVE-2015-5564, and CVE-2015-5565.
Query: CVE similar to CVE-2015-7434
Matching passage: CVE-2015-7434. CWE: CWE-200. CVSS: 7.800000190734863. IBM Capacity Management Analytics 2.1.0.0 allows local users to discover encrypted usernames and passwords by leveraging access to the CMA install machine. IBM X-Force ID: 107863.
Near-miss passage: CVE-2015-3277. CWE: CWE-200. CVSS: 7.5. The mod_nss module before 1.0.11 in Fedora allows remote attackers to obtain cipher lists due to incorrect parsing of multi-keyword cipherstring.
Query: playbook for alert: Lateral movement indicators for Software Extensions
Matching passage: Playbook for T1176 Software Extensions. 1) Validate alert telemetry against T1176. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: persistence. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may abuse software extensions to establish persistent access to victim systems. Software extensions are modular components that enhance or customize the functionality of software applications, including web browsers, Integrated Development Environments (IDEs), and other platforms.(Citation: Chrome Extension C2 Malware)(Citation: Abramovsky VSCode Security) Extensions are typically inst
Near-miss passage: Playbook for T1176.002 IDE Extensions. Different response path focused on persistence.
Query: vulnerability: Use-after-free vulnerability in the ff_h264_free_tables function in libavcodec/h264.c in FFmpeg before 2.3.6 allows remote attackers to cause a denial of service or possibly have u
Matching passage: CVE-2015-3417. CWE: UNKNOWN. CVSS: 6.800000190734863. Use-after-free vulnerability in the ff_h264_free_tables function in libavcodec/h264.c in FFmpeg before 2.3.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted H.264 data in an MP4 file, as demonstrated by an HTML VIDEO element that references H.264 data.
Near-miss passage: CVE-2015-6011. CWE: UNKNOWN. CVSS: 5.0. Web Reference Database (aka refbase) through 0.9.6 and bleeding-edge before 2015-01-08 allows remote attackers to conduct XML injection attacks via (1) the id parameter to unapi.php or (2) the stylesheet parameter to sru.php.
Query: describe CVE-2015-0089
Matching passage: CVE-2015-0089. CWE: CWE-200. CVSS: 5.0. Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to obtain sensitive information from kernel memory, and possibly bypass the KASLR protection mechanism, via a crafted font, aka "Adobe Font Driver Information Disclosure Vulnerability," a different vulnerability than CVE-2015-0087.
Near-miss passage: CVE-2015-3782. CWE: CWE-200. CVSS: 4.300000190734863. CloudKit in Apple iOS before 8.4.1 and OS X before 10.10.5 allows attackers to access an iCloud user record associated with a previous user's login session via a crafted app.