alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-0400
Matching passage: CVE-2015-0400. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to Libraries.
Near-miss passage: CVE-2015-0489. CWE: UNKNOWN. CVSS: 1.2000000476837158. Unspecified vulnerability in the Application Management Pack for Oracle E-Business Suite component in Oracle E-Business Suite AMP 121030 and 121020 allows local users to affect confidentiality via vectors related to EBS Plugin.
Query: risk of SQL injection vulnerability in Arab Portal 3 allows remote attackers to execute arbitrary SQL commands via the showemail parameter in a signup action to members.php.
Matching passage: CVE-2015-6519. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in Arab Portal 3 allows remote attackers to execute arbitrary SQL commands via the showemail parameter in a signup action to members.php.
Near-miss passage: CVE-2015-7387. CWE: CWE-89. CVSS: 7.5. ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions and execute arbitrary SQL commands via an allowed query followed by a disallowed one in the query parameter to event/runQuery.do, as demonstrated by "SELECT 1;INSERT INTO." Fixed in Build 11200.
Query: vulnerability: pioctls in OpenAFS 1.6.x before 1.6.13 allows local users to read kernel memory via crafted commands.
Matching passage: CVE-2015-3284. CWE: CWE-200. CVSS: 2.0999999046325684. pioctls in OpenAFS 1.6.x before 1.6.13 allows local users to read kernel memory via crafted commands.
Near-miss passage: CVE-2015-7929. CWE: CWE-200. CVSS: 4.300000190734863. eWON devices with firmware through 10.1s0 support unspecified GET requests, which might allow remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history.
Query: risk of Skia, as used in Android before 5.1.1 LMY48T, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka inter
Matching passage: CVE-2015-3877. CWE: CWE-119. CVSS: 10.0. Skia, as used in Android before 5.1.1 LMY48T, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 20723696.
Near-miss passage: CVE-2015-6599. CWE: CWE-119. CVSS: 10.0. libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23416608.
Query: patch priority for CVE-2015-9319
Matching passage: CVE-2015-9319. CWE: CWE-79. CVSS: 6.099999904632568. The gregs-high-performance-seo plugin before 1.6.2 for WordPress has XSS in the context of an old browser.
Near-miss passage: CVE-2015-0876. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the print_language_selectbox function in classes/adminpage.inc.php in Saurus CMS Community Edition before 4.7 2015-02-04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: indicators of Artificial Intelligence
Matching passage: T1588.007 Artificial Intelligence. Tactics: resource development. Description: Adversaries may obtain access to generative artificial intelligence tools, such as large language models (LLMs), to aid various techniques during targeting. These tools may be used to inform, bolster, and enable a variety of malicious tasks, including conducting [Reconnaissance](https://attack.mitre.org/tactics/TA0043), creating basic scripts, assisting social engineering, and even developing payloads.(Citation: MSFT-AI) For example, by utilizing a publicly available LLM an adversary is essentially outsourcing or automating certain tasks to the tool. Using AI, the adversary may draft and generate content in a variety of written languages to be used in [Phishing](https://attack.mitre.org/techniques/T1566)/[Phishing for Information](https://attack.mitre.org/techniques/T1598) campaigns. The same publicly available tool may further enable vulnerability or other offensive research supporting [Develop Capabilities](https://attack.mitre.org/techniques/T1587). AI tools may also automate technical tasks by generating, refining, or otherwise enhancing (e.g., [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027)) malicious scripts and payloads.(Citation: OpenAI-CTI) Finally, AI-generated text, images, audio, and video may be used for fraud, [Impersonation](https://attack.mitre.org/techniques/T1684/001), and other malicious activities.(Citation: Google-Vishing24)(Citation: IC3-AI24)(Citation: WSJ-Vishing-AI24)
Near-miss passage: T1588.002 Tool. Tactics: resource development. Description: Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A tool can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: [PsExec](https://attack.mitre.org/software/S0029)). Adversaries may obtain tools to support their operations, including to support execution of post-compromise behaviors. Tools may also be leveraged for testing – for example, evaluating malware against commercial antivirus or endpoint detection and response (EDR) applications.(Citation: Forescout Conti Leaks 2022)(Citation: Sentinel Labs Top Tier Target 2025) Tool acquisition may involve the procurement of commercial software licenses, including for red teaming tools such as Cobalt Strike. In addition to freely downloading or purchasing software, adversaries may steal software and/or software licenses from third-party entities (including other adversaries). Threat actors may also crack trial versions of software.(Citation: Recorded Future Beacon 2019)
Query: Sigma YAML for windows / ps_module
Matching passage: Sigma rule: Detects Obfuscated Powershell via use Rundll32 in Scripts. Logsource: windows / ps_module. Rule: title: Invoke-Obfuscation Via Use Rundll32 - PowerShell Module id: 88a22f69-62f9-4b8a-aa00-6b0212f2f05a related: - id: a5a30a6e-75ca-4233-8b8c-42e0f2037d3b type: derived status: test description: Detects Obfuscated Powershell via use Rundll32 in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2019-10-08 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_4103: Payload|contains|all: - '&&' - rundll32 - shell32.dll - shellexec_rundll Payload|contains: - value - invoke - comspec - iex condition: selection_4103 falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects DNS query requests to Visual Studio Code tunnel domains. Attackers can abuse that feature to establish a reverse. Logsource: windows / dns_query. Rule: title: DNS Query To Visual Studio Code Tunnels Domain id: b3e6418f-7c7a-4fad-993a-93b65027a9f1 related: - id: 9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4 type: similar - id: 4b657234-038e-4ad5-997c-4be42340bce4 type: similar - id: 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b type: similar status: test description: 'Detects DNS query requests to Visual Studio Code tunnel domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine. ' references: - https://ipfyx.fr/post/visual-studio-code-tunnel/ - https://badoption.eu/blog/2023/01/31/code_c2.html - https://cydefops.com/vscode-data-exfiltration author: citron_ninja date: 2023-10-25 modified: 2023-11-20 tags: - attack.command-and-control - attack.t1071.001 logsource: product: windows category: dns_query detection: selection: QueryName|endswith: .tunnels.api.visualstudio.com condition: selection falsepositives: - Legitimate use of Visual Studio Code tunnel will also trigger this. level: medium
Query: CVE similar to CVE-2015-2529
Matching passage: CVE-2015-2529. CWE: CWE-254. CVSS: 2.0999999046325684. The kernel in Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, and Windows 10 allows local users to bypass the ASLR protection mechanism via a crafted application, aka "Kernel ASLR Bypass Vulnerability."
Near-miss passage: CVE-2015-0005. CWE: CWE-254. CVSS: 4.300000190734863. The NETLOGON service in Microsoft Windows Server 2003 SP2, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 Gold and R2, when a Domain Controller is configured, allows remote attackers to spoof the computer name of a secure channel's endpoint, and obtain sensitive session information, by running a crafted application and leveraging the ability to sniff network traffic, aka "NETLOGON Spoofing Vulnerability."
Query: Sigma rule for Find information about network devices that is not stored in config files
Matching passage: Sigma rule: Find information about network devices that is not stored in config files. Logsource: cisco / aaa. Rule: title: Cisco Discovery id: 9705a6a1-6db6-4a16-a987-15b7151e299b status: test description: Find information about network devices that is not stored in config files references: - https://www.cisco.com/c/en/us/td/docs/server_nw_virtual/2-5_release/command_reference/show.html author: Austin Clark date: 2019-08-12 modified: 2023-01-04 tags: - attack.discovery - attack.t1083 - attack.t1201 - attack.t1057 - attack.t1018 - attack.t1082 - attack.t1016 - attack.t1049 - attack.t1033 - attack.t1124 logsource: product: cisco service: aaa detection: keywords: - dir - show arp - show cdp - show clock - show ip interface - show ip route - show ip sockets - show processes - show ssh - show users - show version condition: keywords falsepositives: - Commonly used by administrators for troubleshooting level: low
Near-miss passage: Sigma rule: Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image based detection. Logsource: windows / process_creation. Rule: title: Use NTFS Short Name in Image id: 3ef5605c-9eb9-47b0-9a71-b727e6aa5c3b related: - id: dd6b39d9-d9be-4a3b-8fe0-fe3c6a5c1795 type: similar status: test description: Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image based detection references: - https://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web-security-problem/ - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10) - https://twitter.com/jonasLyk/status/1555914501802921984 author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2022-08-06 modified: 2023-07-20 tags: - attack.stealth - attack.t1564.004 logsource: category: process_creation product: windows detection: selection: Image|contains: - ~1.bat - ~1.dll - ~1.exe - ~1.hta - ~1.js - ~1.msi - ~1.ps1 - ~1.tmp - ~1.vbe - ~1.vbs - ~2.bat - ~2.dll - ~2.exe - ~2.hta - ~2.js - ~2.msi - ~2.ps1 - ~2.tmp - ~2.vbe - ~2.vbs filter_main_generic_parent: ParentImage: C:\Windows\explorer.exe filter_optional_webex: ParentImage|endswith: \WebEx\WebexHost.exe filter_optional_thor: ParentImage|endswith: \thor\thor64.exe filter_optional_winzip: Image: C:\PROGRA~1\WinZip\WZPREL~1.EXE filter_optional_vcred: Image|endswith: \VCREDI~1.EXE condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Software Installers level: medium
Query: alert when Identifies when sensitive information is re-identified in google Cloud.
Matching passage: Sigma rule: Identifies when sensitive information is re-identified in google Cloud.. Logsource: gcp / gcp.audit. Rule: title: Google Cloud Re-identifies Sensitive Information id: 234f9f48-904b-4736-a34c-55d23919e4b7 status: test description: Identifies when sensitive information is re-identified in google Cloud. references: - https://cloud.google.com/dlp/docs/reference/rest/v2/projects.content/reidentify author: Austin Songer @austinsonger date: 2021-08-15 modified: 2022-10-09 tags: - attack.impact - attack.t1565 logsource: product: gcp service: gcp.audit detection: selection: gcp.audit.method_name: projects.content.reidentify condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects command line parameters used by Koadic hack tool. Logsource: windows / process_creation. Rule: title: HackTool - Koadic Execution id: 5cddf373-ef00-4112-ad72-960ac29bac34 status: test description: Detects command line parameters used by Koadic hack tool references: - https://unit42.paloaltonetworks.com/unit42-sofacy-groups-parallel-attacks/ - https://github.com/offsecginger/koadic/blob/457f9a3ff394c989cdb4c599ab90eb34fb2c762c/data/stager/js/stdlib.js - https://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/ author: wagga, Jonhnathan Ribeiro, oscd.community date: 2020-01-12 modified: 2023-02-11 tags: - attack.execution - attack.t1059.003 - attack.t1059.005 - attack.t1059.007 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \cmd.exe - OriginalFileName: Cmd.Exe selection_cli: CommandLine|contains|all: - /q - /c - chcp condition: all of selection_* falsepositives: - Unknown level: high
Query: Sigma YAML for windows / system
Matching passage: Sigma rule: Detects a TacticalRMM service installation. Tactical RMM is a remote monitoring & management tool.. Logsource: windows / system. Rule: title: TacticalRMM Service Installation id: 4bb79b62-ef12-4861-981d-2aab43fab642 status: test description: Detects a TacticalRMM service installation. Tactical RMM is a remote monitoring & management tool. references: - https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-11-28 tags: - attack.command-and-control - attack.t1219.002 logsource: product: windows service: system detection: selection_root: Provider_Name: Service Control Manager EventID: 7045 selection_service: - ImagePath|contains: tacticalrmm.exe - ServiceName|contains: TacticalRMM Agent Service condition: all of selection_* falsepositives: - Legitimate use of the tool level: medium
Near-miss passage: Sigma rule: Detects execution of "reg.exe" to disable security services such as Windows Defender.. Logsource: windows / process_creation. Rule: title: Security Service Disabled Via Reg.EXE id: 5e95028c-5229-4214-afae-d653d573d0ec status: test description: Detects execution of "reg.exe" to disable security services such as Windows Defender. references: - https://twitter.com/JohnLaTwC/status/1415295021041979392 - https://github.com/gordonbay/Windows-On-Reins/blob/e587ac7a0407847865926d575e3c46f68cf7c68d/wor.ps1 - https://vms.drweb.fr/virus/?i=24144899 - https://bidouillesecurity.com/disable-windows-defender-in-powershell/ author: Florian Roth (Nextron Systems), John Lambert (idea), elhoim date: 2021-07-14 modified: 2023-06-05 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_reg_add: CommandLine|contains|all: - reg - add selection_cli_reg_start: CommandLine|contains|all: - d 4 - v Start CommandLine|contains: - \AppIDSvc - \MsMpSvc - \NisSrv - \SecurityHealthService - \Sense - \UsoSvc - \WdBoot - \WdFilter - \WdNisDrv - \WdNisSvc - \WinDefend - \wscsvc - \wuauserv condition: all of selection_* falsepositives: - Unlikely level: high
Query: explain CWE-680
Matching passage: CWE-680 Integer Overflow to Buffer Overflow. The product performs a calculation to determine how much memory to allocate, but an integer overflow can occur that causes less memory to be allocated than expected, leading to a buffer overflow.
Near-miss passage: CWE-307 Improper Restriction of Excessive Authentication Attempts. The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
Query: describe CVE-2015-0650
Matching passage: CVE-2015-0650. CWE: CWE-20. CVSS: 7.800000190734863. The Service Discovery Gateway (aka mDNS Gateway) in Cisco IOS 12.2, 12.4, 15.0, 15.1, 15.2, 15.3, and 15.4 and IOS XE 3.9.xS and 3.10.xS before 3.10.4S, 3.11.xS before 3.11.3S, 3.12.xS before 3.12.2S, and 3.13.xS before 3.13.1S allows remote attackers to cause a denial of service (device reload) by sending malformed mDNS UDP packets over (1) IPv4 or (2) IPv6, aka Bug ID CSCup70579.
Near-miss passage: CVE-2015-8227. CWE: CWE-20. CVSS: 8.5. The built-in web server in Huawei VP9660 multi-point control unit with software before V200R001C30SPC700 allows remote administrators to obtain sensitive information or cause a denial of service via a crafted message.
Query: ATT&CK technique for Virtual Private Server
Matching passage: T1584.003 Virtual Private Server. Tactics: resource development. Description: Adversaries may compromise third-party Virtual Private Servers (VPSs) that can be used during targeting. There exist a variety of cloud service providers that will sell virtual machines/containers as a service. Adversaries may compromise VPSs purchased by third-party entities. By compromising a VPS to use as infrastructure, adversaries can make it difficult to physically tie back operations to themselves.(Citation: NSA NCSC Turla OilRig) Compromising a VPS for use in later stages of the adversary lifecycle, such as Command and Control, can allow adversaries to benefit from the ubiquity and trust associated with higher reputation cloud service providers as well as that added by the compromised third-party.
Near-miss passage: T1584 Compromise Infrastructure. Tactics: resource development. Description: Adversaries may compromise third-party infrastructure that can be used during targeting. Infrastructure solutions include physical or cloud servers, domains, network devices, and third-party web and DNS services. Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle.(Citation: Mandiant APT1)(Citation: ICANNDomainNameHijacking)(Citation: Talos DNSpionage Nov 2018)(Citation: FireEye EPS Awakens Part 2) Additionally, adversaries may compromise numerous machines to form a botnet they can leverage. Use of compromised infrastructure allows adversaries to stage, launch, and execute operations. Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites. For example, adversaries may leverage compromised infrastructure (potentially also in conjunction with [Digital Certificates](https://attack.mitre.org/techniques/T1588/004)) to further blend in and support staged information gathering and/or [Phishing](https://attack.mitre.org/techniques/T1566) campaigns.(Citation: FireEye DNS Hijack 2019) Adversaries may also compromise numerous machines to support [Proxy](https://attack.mitre.org/techniques/T1090) and/or proxyware services or to form a botnet.(Citation: amnesty_nso_pegasus)(Citation: Sysdig Proxyjacking) Additionally, adversaries may compromise infrastructure residing in close proximity to a target in order to gain [Initial Access](https://attack.mitre.org/tactics/TA0001) via [Wi-Fi Networks](https://attack.mitre.org/techniques/T1669).(Citation: Nearest Neighbor Volexity) By using compromised infrastructure, adversaries may enable follow-on malicious operations. Prior to targeting, adversaries may also compromise the infrastructure of other adversaries.(Citation: NSA NCSC Turla OilRig)
Query: patch priority for CVE-2015-1299
Matching passage: CVE-2015-1299. CWE: UNKNOWN. CVSS: 7.5. Use-after-free vulnerability in the shared-timer implementation in Blink, as used in Google Chrome before 45.0.2454.85, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging erroneous timer firing, related to ThreadTimers.cpp and Timer.cpp.
Near-miss passage: CVE-2015-3910. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in Google V8 before 4.3.61.21, as used in Google Chrome before 43.0.2357.65, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Query: detection rule: Detects instances where an SNMP service on an OpenCanary node has had an OID request.
Matching passage: Sigma rule: Detects instances where an SNMP service on an OpenCanary node has had an OID request.. Logsource: opencanary / application. Rule: title: OpenCanary - SNMP OID Request id: e9856028-fd4e-46e6-b3d1-10f7ceb95078 status: test description: Detects instances where an SNMP service on an OpenCanary node has had an OID request. references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.discovery - attack.lateral-movement - attack.t1016 - attack.t1021 logsource: category: application product: opencanary detection: selection: logtype: 13001 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects registry modifications that disable internal tools or functions in explorer (malware like Agent Tesla uses this. Logsource: windows / registry_set. Rule: title: Registry Explorer Policy Modification id: 1c3121ed-041b-4d97-a075-07f54f20fb4a status: test description: Detects registry modifications that disable internal tools or functions in explorer (malware like Agent Tesla uses this technique) references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md author: frack113 date: 2022-03-18 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection_set_1: TargetObject|endswith: - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoLogOff - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktop - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileMenu - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetTaskbar - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyDocuments - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu Details: DWORD (0x00000001) condition: selection_set_1 falsepositives: - Legitimate admin script level: medium
Query: patch priority for CVE-2015-10003
Matching passage: CVE-2015-10003. CWE: CWE-441. CVSS: 4.300000190734863. A vulnerability, which was classified as problematic, was found in FileZilla Server up to 0.9.50. This affects an unknown part of the component PORT Handler. The manipulation leads to unintended intermediary. It is possible to initiate the attack remotely. Upgrading to version 0.9.51 is able to address this issue. It is recommended to upgrade the affected component.
Near-miss passage: CVE-2015-2947. CWE: CWE-441. CVSS: 9.100000381469727. KanColleViewer versions 3.8.1 and earlier operates as an open proxy which allows remote attackers to trigger outbound network traffic.
Query: describe CVE-2015-1862
Matching passage: CVE-2015-1862. CWE: CWE-362. CVSS: 7.0. The crash reporting feature in Abrt allows local users to gain privileges by leveraging an execve by root after a chroot into a user-specified directory in a namedspaced environment.
Near-miss passage: CVE-2015-7543. CWE: CWE-362. CVSS: 7.0. aRts 1.5.10 and kdelibs3 3.5.10 and earlier do not properly create temporary directories, which allows local users to hijack the IPC by pre-creating the temporary directory.