alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-8983
Matching passage: CVE-2015-8983. CWE: CWE-190. CVSS: 8.100000381469727. Integer overflow in the _IO_wstr_overflow function in libio/wstrops.c in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors related to computing a size in bytes, which triggers a heap-based buffer overflow.
Near-miss passage: CVE-2015-2519. CWE: CWE-190. CVSS: 9.300000190734863. Integer overflow in Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to execute arbitrary code via a crafted .jnt file, aka "Windows Journal Integer Overflow RCE Vulnerability."
Query: risk of Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 12.1.3, 12.2.3, and 12.2.4 allows remote authenticated users to affect confident
Matching passage: CVE-2015-4865. CWE: UNKNOWN. CVSS: 2.0999999046325684. Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 12.1.3, 12.2.3, and 12.2.4 allows remote authenticated users to affect confidentiality via vectors related to Business Objects - BC4J.
Near-miss passage: CVE-2015-8483. CWE: UNKNOWN. CVSS: 7.400000095367432. Open redirect vulnerability in Cybozu Office 10.2.0 through 10.3.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL.
Query: rule covering Detects when the "index" value of a scheduled task is removed or deleted from the registry. Which effectively hides it f
Matching passage: Sigma rule: Detects when the "index" value of a scheduled task is removed or deleted from the registry. Which effectively hides it f. Logsource: windows / registry_delete. Rule: title: Removal Of Index Value to Hide Schedule Task - Registry id: 526cc8bc-1cdc-48ad-8b26-f19bff969cec related: - id: acd74772-5f88-45c7-956b-6a7b36c294d2 type: similar - id: 5b16df71-8615-4f7f-ac9b-6c43c0509e61 type: similar status: test description: Detects when the "index" value of a scheduled task is removed or deleted from the registry. Which effectively hides it from any tooling such as "schtasks /query" references: - https://blog.qualys.com/vulnerabilities-threat-research/2022/06/20/defending-against-scheduled-task-attacks-in-windows-environments author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-26 modified: 2025-10-25 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: registry_delete detection: selection: TargetObject|contains|all: - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ - Index condition: selection falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/registry/registry_delete/registry_delete_schtasks_hide_task_via_index_value_removal/info.yml
Near-miss passage: Sigma rule: Identifies when a Firewall Policy is Modified or Deleted.. Logsource: azure / activitylogs. Rule: title: Azure Network Firewall Policy Modified or Deleted id: 83c17918-746e-4bd9-920b-8e098bf88c23 status: test description: Identifies when a Firewall Policy is Modified or Deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer @austinsonger date: 2021-09-02 modified: 2022-08-23 tags: - attack.impact - attack.defense-impairment - attack.t1686.001 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.NETWORK/FIREWALLPOLICIES/WRITE - MICROSOFT.NETWORK/FIREWALLPOLICIES/JOIN/ACTION - MICROSOFT.NETWORK/FIREWALLPOLICIES/CERTIFICATES/ACTION - MICROSOFT.NETWORK/FIREWALLPOLICIES/DELETE condition: selection falsepositives: - Firewall Policy being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Firewall Policy modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: patch priority for CVE-2015-5350
Matching passage: CVE-2015-5350. CWE: CWE-284. CVSS: 7.5. In Garden versions 0.22.0-0.329.0, a vulnerability has been discovered in the garden-linux nstar executable that allows access to files on the host system. By staging an application on Cloud Foundry using Diego and Garden installations with a malicious custom buildpack an end user could read files on the host system that the BOSH-created vcap user has permissions to read and then package them into their app droplet.
Near-miss passage: CVE-2015-6867. CWE: CWE-284. CVSS: 7.5. The vertica-udx-zygote process in HP Vertica 7.1.1 UDx does not require authentication, which allows remote attackers to execute arbitrary commands via a crafted packet, aka ZDI-CAN-2914.
Query: patch priority for CVE-2015-8282
Matching passage: CVE-2015-8282. CWE: CWE-255. CVSS: 9.800000190734863. SeaWell Networks Spectrum SDC 02.05.00 has a default password of "admin" for the "admin" account.
Near-miss passage: CVE-2015-0930. CWE: CWE-255. CVSS: 10.0. The web interface on SerVision HVG Video Gateway devices with firmware before 2.2.26a100 has a hardcoded administrative password, which makes it easier for remote attackers to obtain access via an HTTP session.
Query: Sigma rule for Detects possible NTLM coercion via certutil using the 'syncwithWU' flag
Matching passage: Sigma rule: Detects possible NTLM coercion via certutil using the 'syncwithWU' flag. Logsource: windows / process_creation. Rule: title: Potential NTLM Coercion Via Certutil.EXE id: 6c6d9280-e6d0-4b9d-80ac-254701b64916 status: test description: Detects possible NTLM coercion via certutil using the 'syncwithWU' flag references: - https://github.com/LOLBAS-Project/LOLBAS/issues/243 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-01 modified: 2023-02-14 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \certutil.exe - OriginalFileName: CertUtil.exe selection_cli: CommandLine|contains|all: - ' -syncwithWU ' - ' \\\\' condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_ntlm_coercion/info.yml
Near-miss passage: Sigma rule: Detects the use of MeshAgent to execute commands on the target host, particularly when threat actors might abuse it to e. Logsource: windows / process_creation. Rule: title: Remote Access Tool - MeshAgent Command Execution via MeshCentral id: 74a2b202-73e0-4693-9a3a-9d36146d0775 status: test description: 'Detects the use of MeshAgent to execute commands on the target host, particularly when threat actors might abuse it to execute commands directly. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes. ' references: - https://github.com/Ylianst/MeshAgent - https://github.com/Ylianst/MeshAgent/blob/52cf129ca43d64743181fbaf940e0b4ddb542a37/modules/win-dispatcher.js#L173 - https://github.com/Ylianst/MeshAgent/blob/52cf129ca43d64743181fbaf940e0b4ddb542a37/modules/win-info.js#L55 author: '@Kostastsale' date: 2024-09-22 tags: - attack.command-and-control - attack.t1219.002 logsource: product: windows category: process_creation detection: selection: ParentImage|endswith: \meshagent.exe Image|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe condition: selection falsepositives: - False positives can be found in environments using MeshAgent for remote management, analysis should prioritize the grandparent process, MeshAgent.exe, and scrutinize the resulting child processes triggered by any suspicious interactive commands directed at the target host. level: medium
Query: detect Detects suspicious powershell invocations from interpreters or unusual programs in logs
Matching passage: Sigma rule: Detects suspicious powershell invocations from interpreters or unusual programs. Logsource: windows / process_creation. Rule: title: Suspicious PowerShell Invocation From Script Engines id: 95eadcb2-92e4-4ed1-9031-92547773a6db status: test description: Detects suspicious powershell invocations from interpreters or unusual programs references: - https://www.securitynewspaper.com/2017/03/20/attackers-leverage-excel-powershell-dns-latest-non-malware-attack/ author: Florian Roth (Nextron Systems) date: 2019-01-16 modified: 2023-01-05 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: - \wscript.exe - \cscript.exe Image|endswith: - \powershell.exe - \pwsh.exe filter_health_service: CurrentDirectory|contains: \Health Service State\ condition: selection and not 1 of filter_* falsepositives: - Microsoft Operations Manager (MOM) - Other scripts level: medium
Near-miss passage: Sigma rule: Detects the execution of the builtin "copy" command that targets a shadow copy (sometimes used to copy registry hives th. Logsource: windows / process_creation. Rule: title: Copy From VolumeShadowCopy Via Cmd.EXE id: c73124a7-3e89-44a3-bdc1-25fe4df754b1 status: test description: Detects the execution of the builtin "copy" command that targets a shadow copy (sometimes used to copy registry hives that are in use) references: - https://twitter.com/vxunderground/status/1423336151860002816?s=20 - https://www.virustotal.com/gui/file/03e9b8c2e86d6db450e5eceec057d7e369ee2389b9daecaf06331a95410aa5f8/detection - https://pentestlab.blog/2018/07/04/dumping-domain-password-hashes/ author: Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems) date: 2021-08-09 modified: 2023-03-07 tags: - attack.impact - attack.t1490 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - 'copy ' - \\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy condition: selection falsepositives: - Backup scenarios using the commandline level: high
Query: patch priority for CVE-2015-1438
Matching passage: CVE-2015-1438. CWE: CWE-119. CVSS: 7.800000190734863. Heap-based buffer overflow in Panda Security Kernel Memory Access Driver 1.0.0.13 allows attackers to execute arbitrary code with kernel privileges via a crafted size input for allocated kernel paged pool and allocated non-paged pool buffers.
Near-miss passage: CVE-2015-3700. CWE: CWE-119. CVSS: 7.199999809265137. Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-3695, CVE-2015-3696, CVE-2015-3697, CVE-2015-3698, CVE-2015-3699, CVE-2015-3701, and CVE-2015-3702.
Query: SIEM correlation: collection activity consistent with Sharepoint
Matching passage: T1213.002 Sharepoint. Tactics: collection. Description: Adversaries may leverage the SharePoint repository as a source to mine valuable information. SharePoint will often contain useful information for an adversary to learn about the structure and functionality of the internal network and systems. For example, the following is a list of example information that may hold potential value to an adversary and may also be found on SharePoint: * Policies, procedures, and standards * Physical / logical network diagrams * System architecture diagrams * Technical system documentation * Testing / development credentials (i.e., [Unsecured Credentials](https://attack.mitre.org/techniques/T1552)) * Work / project schedules * Source code snippets * Links to network shares and other internal resources
Near-miss passage: T1213.004 Customer Relationship Management Software. Tactics: collection. Description: Adversaries may leverage Customer Relationship Management (CRM) software to mine valuable information. CRM software is used to assist organizations in tracking and managing customer interactions, as well as storing customer data. Once adversaries gain access to a victim organization, they may mine CRM software for customer data. This may include personally identifiable information (PII) such as full names, emails, phone numbers, and addresses, as well as additional details such as purchase histories and IT support interactions. By collecting this data, an adversary may be able to send personalized [Phishing](https://attack.mitre.org/techniques/T1566) emails, engage in SIM swapping, or otherwise target the organization’s customers in ways that enable financial gain or the compromise of additional organizations.(Citation: Bleeping Computer US Cellular Hack 2022)(Citation: Bleeping Computer Mint Mobile Hack 2021)(Citation: Bleeping Computer Bank Hack 2020) CRM software may be hosted on-premises or in the cloud. Information stored in these solutions may vary based on the specific instance or environment. Examples of CRM software include Microsoft Dynamics 365, Salesforce, Zoho, Zendesk, and HubSpot.
Query: patch priority for CVE-2015-1579
Matching passage: CVE-2015-1579. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the img parameter in a revslider_show_image action to wp-admin/admin-ajax.php. NOTE: this vulnerability may be a duplicate of CVE-2014-9734.
Near-miss passage: CVE-2015-9277. CWE: CWE-22. CVSS: 9.100000381469727. MailEnable before 8.60 allows Directory Traversal for reading the messages of other users, uploading files, and deleting files because "/../" and "/.. /" are mishandled.
Query: write Sigma for Detects potential exfiltration attempt via audio file using PowerShell
Matching passage: Sigma rule: Detects potential exfiltration attempt via audio file using PowerShell. Logsource: windows / ps_script. Rule: title: Potential Data Exfiltration Via Audio File id: e4f93c99-396f-47c8-bb0f-201b1fa69034 status: test description: Detects potential exfiltration attempt via audio file using PowerShell references: - https://github.com/gtworek/PSBits/blob/e97cbbb173b31cbc4d37244d3412de0a114dacfb/NoDLP/bin2wav.ps1 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-16 tags: - attack.exfiltration logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_main: ScriptBlockText|contains|all: - '[System.Math]::' - '[IO.FileMode]::' - BinaryWriter selection_header_wav: ScriptBlockText|contains|all: - '0x52' - '0x49' - '0x46' - '0x57' - '0x41' - '0x56' - '0x45' - '0xAC' condition: selection_main and 1 of selection_header_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects potential DLL sideloading of "CCleanerDU.dll". Logsource: windows / image_load. Rule: title: Potential CCleanerDU.DLL Sideloading id: 1fbc0671-5596-4e17-8682-f020a0b995dc status: test description: Detects potential DLL sideloading of "CCleanerDU.dll" references: - https://lab52.io/blog/2344-2/ author: X__Junior (Nextron Systems) date: 2023-07-13 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \CCleanerDU.dll filter_main_path: Image|startswith: - C:\Program Files\CCleaner\ - C:\Program Files (x86)\CCleaner\ Image|endswith: - \CCleaner.exe - \CCleaner64.exe condition: selection and not 1 of filter_main_* falsepositives: - False positives could occur from other custom installation paths. Apply additional filters accordingly. level: medium
Query: CVE similar to CVE-2015-6007
Matching passage: CVE-2015-6007. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Web Reference Database (aka refbase) through 0.9.6 allows remote attackers to hijack the authentication of arbitrary users.
Near-miss passage: CVE-2015-0145. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Query: secure coding against Improper Protection for Outbound Error Messages and Alert Signals
Matching passage: CWE-1320 Improper Protection for Outbound Error Messages and Alert Signals. Untrusted agents can disable alerts about signal conditions exceeding limits or the response mechanism that handles such alerts.
Near-miss passage: CWE-778 Insufficient Logging. When a security-critical event occurs, the product either does not record the event or omits important details about the event when logging it.
Query: vulnerability: Adobe Shockwave Player before 12.2.1.171 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Matching passage: CVE-2015-7649. CWE: CWE-119. CVSS: 10.0. Adobe Shockwave Player before 12.2.1.171 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Near-miss passage: CVE-2015-4002. CWE: CWE-119. CVSS: 9.0. drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver in the Linux kernel through 4.0.5 does not ensure that certain length values are sufficiently large, which allows remote attackers to cause a denial of service (system crash or large loop) or possibly execute arbitrary code via a crafted packet, related to the (1) oz_usb_rx and (2) oz_usb_handle_ep_data functions.
Query: detect Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass) in logs
Matching passage: Sigma rule: Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass). Logsource: windows / process_creation. Rule: title: HackTool - Htran/NATBypass Execution id: f5e3b62f-e577-4e59-931e-0a15b2b94e1e status: test description: Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass) references: - https://github.com/HiwinCN/HTran - https://github.com/cw1997/NATBypass author: Florian Roth (Nextron Systems) date: 2022-12-27 modified: 2023-02-04 tags: - attack.command-and-control - attack.t1090 - attack.s0040 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: - \htran.exe - \lcx.exe selection_cli: CommandLine|contains: - '.exe -tran ' - '.exe -slave ' condition: 1 of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the deletion of files by the Sysinternals SDelete utility. It looks for the common name pattern used to rename f. Logsource: windows / file_delete. Rule: title: File Deleted Via Sysinternals SDelete id: 6ddab845-b1b8-49c2-bbf7-1a11967f64bc status: test description: Detects the deletion of files by the Sysinternals SDelete utility. It looks for the common name pattern used to rename files. references: - https://github.com/OTRF/detection-hackathon-apt29/issues/9 - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/4.B.4_83D62033-105A-4A02-8B75-DAB52D8D51EC.md author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-05-02 modified: 2023-02-15 tags: - attack.stealth - attack.t1070.004 logsource: product: windows category: file_delete detection: selection: TargetFilename|endswith: - .AAA - .ZZZ filter_wireshark: TargetFilename|endswith: \Wireshark\radius\dictionary.alcatel-lucent.aaa condition: selection and not 1 of filter_* falsepositives: - Legitimate usage level: medium
Query: describe CVE-2015-9157
Matching passage: CVE-2015-9157. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9625, MDM9635M, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 600, SD 615/16/SD 415, SD 617, SD 650/52, SD 800, SD 808, and SD 810, in widevine_dash_cmd_handler(), rsp buffers are passed off to widevine commands. These rsp buffers have values in them, such as buffer lengths, that need to be validated to ensure that no buffer overflow/over-reads happen. However, rsp buffers are not always in locked memory, meaning a time-of-check, time-of-use issue can occur where we check that the value is valid, but then a race condition occurs where this memory is swapped out with a different, possibly out of range, value.
Near-miss passage: CVE-2015-8779. CWE: CWE-119. CVSS: 9.800000190734863. Stack-based buffer overflow in the catopen function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long catalog name.
Query: what is T1027.003
Matching passage: T1027.003 Steganography. Tactics: stealth. Description: Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic techniques can be used to hide data in digital media such as images, audio tracks, video clips, or text files. [Duqu](https://attack.mitre.org/software/S0038) was an early example of malware that used steganography. It encrypted the gathered information from a victim's system and hid it within an image before exfiltrating the image to a C2 server.(Citation: Wikipedia Duqu) By the end of 2017, a threat group used <code>Invoke-PSImage</code> to hide [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands in an image file (.png) and execute the code on a victim's system. In this particular case the [PowerShell](https://attack.mitre.org/techniques/T1059/001) code downloaded another obfuscated script to gather intelligence from the victim's machine and communicate it back to the adversary.(Citation: McAfee Malicious Doc Targets Pyeongchang Olympics)
Near-miss passage: T1027.004 Compile After Delivery. Tactics: stealth. Description: Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as ilasm.exe(Citation: ATTACK IQ), csc.exe, or GCC/MinGW.(Citation: ClearSky MuddyWater Nov 2018) Source code payloads may also be encrypted, encoded, and/or embedded within other files, such as those delivered as a [Phishing](https://attack.mitre.org/techniques/T1566). Payloads may also be delivered in formats unrecognizable and inherently benign to the native OS (ex: EXEs on macOS/Linux) before later being (re)compiled into a proper executable binary with a bundled compiler and execution framework.(Citation: TrendMicro WindowsAppMac)