alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: patch priority for CVE-2015-9215
Matching passage: CVE-2015-9215. CWE: CWE-476. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9615, MDM9625, MDM9635M, and SD 810, improper input validation can cause a null pointer dereference in USB bootloader find_ep() function.
Near-miss passage: CVE-2015-9111. CWE: CWE-476. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, and SD 820A, in a QTEE syscall handler, an untrusted pointer dereference can occur.
Query: vulnerability: powervc-iso-import in IBM PowerVC 1.2.0.x before 1.2.0.4 and 1.2.1.x before 1.2.2 places an access token on the command line during IVM and PowerKVM management, which allows local 
Matching passage: CVE-2015-0136. CWE: CWE-200. CVSS: 2.0999999046325684. powervc-iso-import in IBM PowerVC 1.2.0.x before 1.2.0.4 and 1.2.1.x before 1.2.2 places an access token on the command line during IVM and PowerKVM management, which allows local users to obtain sensitive information by listing the process.
Near-miss passage: CVE-2015-9256. CWE: CWE-200. CVSS: 5.300000190734863. Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information via access to device/VM restore mount points, because they do not have ACLs by default.
Query: exploit Race condition in the Measurement, Aggregation, and Correlation Engine (MACE) implementation in Cisco IOS 15.4(2)T3 and earlier allows remote attackers to cause a denial of service
Matching passage: CVE-2015-0608. CWE: CWE-362. CVSS: 7.099999904632568. Race condition in the Measurement, Aggregation, and Correlation Engine (MACE) implementation in Cisco IOS 15.4(2)T3 and earlier allows remote attackers to cause a denial of service (device reload) via crafted network traffic that triggers improper handling of the timing of process switching and Cisco Express Forwarding (CEF) switching, aka Bug ID CSCul48736.
Near-miss passage: CVE-2015-1862. CWE: CWE-362. CVSS: 7.0. The crash reporting feature in Abrt allows local users to gain privileges by leveraging an execve by root after a chroot into a user-specified directory in a namedspaced environment.
Query: hunt for Search Victim-Owned Websites activity
Matching passage: T1594 Search Victim-Owned Websites. Tactics: reconnaissance. Description: Adversaries may search websites owned by the victim for information that can be used during targeting. Victim-owned websites may contain a variety of details, including names of departments/divisions, physical locations, and data about key employees such as names, roles, and contact info (ex: [Email Addresses](https://attack.mitre.org/techniques/T1589/002)). These sites may also have details highlighting business operations and relationships.(Citation: Comparitech Leak) Adversaries may search victim-owned websites to gather actionable information. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Trusted Relationship](https://attack.mitre.org/techniques/T1199) or [Phishing](https://attack.mitre.org/techniques/T1566)). In addition to manually browsing the website, adversaries may attempt to identify hidden directories or files that could contain additional sensitive information or vulnerable functionality. They may do this through automated activities such as [Wordlist Scanning](https://attack.mitre.org/techniques/T1595/003), as well as by leveraging files such as sitemap.xml and robots.txt.(Citation: Perez Sitemap XML 2023)(Citation: Register Robots TXT 2015)
Near-miss passage: T1596.002 WHOIS. Tactics: reconnaissance. Description: Adversaries may search public WHOIS data for information about victims that can be used during targeting. WHOIS data is stored by regional Internet registries (RIR) responsible for allocating and assigning Internet resources such as domain names. Anyone can query WHOIS servers for information about a registered domain, such as assigned IP blocks, contact information, and DNS nameservers.(Citation: WHOIS) Adversaries may search WHOIS data to gather actionable information. Threat actors can use online resources or command-line utilities to pillage through WHOIS data for information about potential victims. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
Query: patch priority for CVE-2015-5466
Matching passage: CVE-2015-5466. CWE: CWE-269. CVSS: 7.800000190734863. Silicon Integrated Systems XGI WindowsXP Display Manager (aka XGI VGA Driver Manager and VGA Display Manager) 6.14.10.1090 allows local users to gain privileges via a crafted 0x96002404 IOCTL call.
Near-miss passage: CVE-2015-0949. CWE: CWE-269. CVSS: 7.800000190734863. The System Management Mode (SMM) implementation in Dell Latitude E6430 BIOS Revision A09, HP EliteBook 850 G1 BIOS revision L71 Ver. 01.09, and possibly other BIOS implementations does not ensure that function calls operate on SMRAM memory locations, which allows local users to bypass the Secure Boot protection mechanism and gain privileges by leveraging write access to physical memory.
Query: patch priority for CVE-2015-4674
Matching passage: CVE-2015-4674. CWE: CWE-345. CVSS: 9.300000190734863. The autoupdate implementation in TimeDoctor Pro 1.4.72.3 on Windows relies on unsigned installer files that are retrieved without use of SSL, which makes it easier for man-in-the-middle attackers to execute arbitrary code via a crafted file.
Near-miss passage: CVE-2015-3956. CWE: CWE-345. CVSS: 9.800000190734863. Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior accept drug libraries, firmware updates, pump commands, and unauthorized configuration changes from unauthenticated devices on the host network. Hospira recommends that customers close Port 20/FTP and Port 23/TELNET on the affected devices. Hospira has also released the Plum 360 Infusion System which is not vulnerable to this issue.
Query: Sigma rule for Detects malicious behavior where the MMC utility (`mmc.exe`) executes files with reversed extensions caused by Right-to-
Matching passage: Sigma rule: Detects malicious behavior where the MMC utility (`mmc.exe`) executes files with reversed extensions caused by Right-to-. Logsource: windows / process_creation. Rule: title: MMC Executing Files with Reversed Extensions Using RTLO Abuse id: 9cfe4b27-1e56-48b4-b7a8-d46851c91a44 status: experimental description: Detects malicious behavior where the MMC utility (`mmc.exe`) executes files with reversed extensions caused by Right-to-Left Override (RLO) abuse, disguising them as document formats. references: - https://www.unicode.org/versions/Unicode5.2.0/ch02.pdf - https://en.wikipedia.org/wiki/Right-to-left_override - https://tria.ge/241015-l98snsyeje/behavioral2 author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-02-05 tags: - attack.execution - attack.stealth - attack.t1204.002 - attack.t1218.014 - attack.t1036.002 logsource: category: process_creation product: windows detection: selection_image: - Image|endswith: \mmc.exe - OriginalFileName: MMC.exe selection_commandline: CommandLine|contains: - cod.msc - fdp.msc - ftr.msc - lmth.msc - slx.msc - tdo.msc - xcod.msc - xslx.msc - xtpp.msc condition: all of selection_* falsepositives: - Legitimate administrative actions using MMC to execute misnamed `.msc` files. - Unconventional but non-malicious usage of RLO or reversed extensions. level: high
Near-miss passage: Sigma rule: Detects potential malicious modification of the property value of IsCredGuardEnabled from HKLM:\SYSTEM\CurrentControlSet. Logsource: windows / registry_event. Rule: title: Wdigest CredGuard Registry Modification id: 1a2d6c47-75b0-45bd-b133-2c0be75349fd status: test description: 'Detects potential malicious modification of the property value of IsCredGuardEnabled from HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest to disable Cred Guard on a system. This is usually used with UseLogonCredential to manipulate the caching credentials. ' references: - https://teamhydra.blog/2020/08/25/bypassing-credential-guard/ author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2019-08-25 modified: 2021-11-27 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_event product: windows detection: selection: TargetObject|endswith: \IsCredGuardEnabled condition: selection falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-3347
Matching passage: CVE-2015-3347. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Cloudwords for Multilingual Drupal module before 7.x-2.3 for Drupal allows remote attackers to hijack the authentication of unspecified victims via an unknown menu callback.
Near-miss passage: CVE-2015-7984. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in Horde before 5.2.8, Horde Groupware before 5.2.11, and Horde Groupware Webmail Edition before 5.2.11 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary (1) commands via the cmd parameter to admin/cmdshell.php, (2) SQL queries via the sql parameter to admin/sqlshell.php, or (3) PHP code via the php parameter to admin/phpshell.php.
Query: write Sigma for Detects events in which someone prints the contents of history files to the commandline or redirects it to a file for re
Matching passage: Sigma rule: Detects events in which someone prints the contents of history files to the commandline or redirects it to a file for re. Logsource: linux / process_creation. Rule: title: Print History File Contents id: d7821ff1-4527-4e33-9f84-d0d57fa2fb66 status: test description: Detects events in which someone prints the contents of history files to the commandline or redirects it to a file for reconnaissance references: - https://github.com/sleventyeleven/linuxprivchecker/ - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md author: Florian Roth (Nextron Systems) date: 2022-06-20 modified: 2022-09-15 tags: - attack.reconnaissance - attack.t1592.004 logsource: category: process_creation product: linux detection: selection: Image|endswith: - /cat - /head - /tail - /more selection_history: - CommandLine|contains: - /.bash_history - /.zsh_history - CommandLine|endswith: - _history - .history - zhistory condition: all of selection* falsepositives: - Legitimate administration activities level: medium
Near-miss passage: Sigma rule: Detects suspicious change of file privileges with chown and chmod commands. Logsource: linux / process_creation. Rule: title: Setuid and Setgid id: c21c4eaa-ba2e-419a-92b2-8371703cbe21 status: test description: Detects suspicious change of file privileges with chown and chmod commands references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.001/T1548.001.md author: Ömer Günal date: 2020-06-16 modified: 2022-10-05 tags: - attack.persistence - attack.privilege-escalation - attack.t1548.001 logsource: product: linux category: process_creation detection: selection_root: CommandLine|contains: chown root selection_perm: CommandLine|contains: - ' chmod u+s' - ' chmod g+s' condition: all of selection_* falsepositives: - Legitimate administration activities level: low
Query: CVE similar to CVE-2015-2252
Matching passage: CVE-2015-2252. CWE: CWE-94. CVSS: 8.800000190734863. Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to execute arbitrary code with root privileges via a crafted UDS patch with shell scripts.
Near-miss passage: CVE-2015-8351. CWE: CWE-94. CVSS: 9.0. PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allow_url_include is enabled, allows remote authenticated users to execute arbitrary PHP code via a URL in the abspath parameter to frontend/captcha/ajaxresponse.php. NOTE: this can also be leveraged to include and execute arbitrary local files via directory traversal sequences regardless of whether allow_url_include is enabled.
Query: detection rule: Detects when an attacker tries to backdoor the MSSQL server by adding a backdoor account to the sysadmin fixed server ro
Matching passage: Sigma rule: Detects when an attacker tries to backdoor the MSSQL server by adding a backdoor account to the sysadmin fixed server ro. Logsource: windows / application. Rule: title: MSSQL Add Account To Sysadmin Role id: 08200f85-2678-463e-9c32-88dce2f073d1 status: test description: Detects when an attacker tries to backdoor the MSSQL server by adding a backdoor account to the sysadmin fixed server role references: - https://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-13 modified: 2024-06-26 tags: - attack.persistence logsource: product: windows service: application definition: 'Requirements: MSSQL audit policy must be enabled in order to receive this event in the application log' detection: selection: Provider_Name|contains: MSSQL EventID: 33205 Data|contains|all: - object_name:sysadmin - 'statement:alter server role [sysadmin] add member ' condition: selection falsepositives: - Rare legitimate administrative activity level: high
Near-miss passage: Sigma rule: Detects potential DLL sideloading of "SolidPDFCreator.dll". Logsource: windows / image_load. Rule: title: Potential SolidPDFCreator.DLL Sideloading id: a2edbce1-95c8-4291-8676-0d45146862b3 status: test description: Detects potential DLL sideloading of "SolidPDFCreator.dll" references: - https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/ author: X__Junior (Nextron Systems) date: 2023-05-07 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \SolidPDFCreator.dll filter_main_path: Image|endswith: \SolidPDFCreator.exe ImageLoaded|startswith: - C:\Program Files (x86)\SolidDocuments\SolidPDFCreator\ - C:\Program Files\SolidDocuments\SolidPDFCreator\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Query: vulnerability: Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and A
Matching passage: CVE-2015-5114. CWE: CWE-416. CVSS: 10.0. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-4448, CVE-2015-5095, CVE-2015-5099, CVE-2015-5101, CVE-2015-5111, and CVE-2015-5113.
Near-miss passage: CVE-2015-7621. CWE: CWE-416. CVSS: 6.800000190734863. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via a crafted U3D object, a different vulnerability than CVE-2015-5586, CVE-2015-6683, CVE-2015-6684, CVE-2015-6687, CVE-2015-6688, CVE-2015-6689, CVE-2015-6690, CVE-2015-6691, CVE-2015-7615, and CVE-2015-7617.
Query: vulnerability: Cross-site request forgery (CSRF) vulnerability in Cisco TelePresence Server software 3.0(2.24) allows remote attackers to hijack the authentication of arbitrary users, aka Bug IDs
Matching passage: CVE-2015-6304. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Cisco TelePresence Server software 3.0(2.24) allows remote attackers to hijack the authentication of arbitrary users, aka Bug IDs CSCut63718, CSCut63724, and CSCut63760.
Near-miss passage: CVE-2015-6376. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Cisco TelePresence Video Communication Server (VCS) X8.5.1 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuv72412.
Query: exploit TPview.dll in VMware Workstation 10.x before 10.0.6 and 11.x before 11.1.1, VMware Player 6.x before 6.0.6 and 7.x before 7.1.1, and VMware Horizon Client 3.2.x before 3.2.1, 3.3.x
Matching passage: CVE-2015-2339. CWE: CWE-399. CVSS: 6.099999904632568. TPview.dll in VMware Workstation 10.x before 10.0.6 and 11.x before 11.1.1, VMware Player 6.x before 6.0.6 and 7.x before 7.1.1, and VMware Horizon Client 3.2.x before 3.2.1, 3.3.x, and 5.x local-mode before 5.4.2 on Windows does not properly allocate memory, which allows guest OS users to cause a host OS denial of service via unspecified vectors, a different vulnerability than CVE-2015-2338.
Near-miss passage: CVE-2015-6399. CWE: CWE-399. CVSS: 6.800000190734863. The Supervisor 1.0.0.0 and 1.0.0.1 in Cisco Integrated Management Controller (IMC) before 2.0(9) allows remote authenticated users to cause a denial of service (IP interface outage) via crafted parameters in an HTTP request, aka Bug ID CSCuv38286.
Query: describe CVE-2015-0971
Matching passage: CVE-2015-0971. CWE: CWE-399. CVSS: 5.0. The DER parser in Suricata before 2.0.8 allows remote attackers to cause a denial of service (crash) via vectors related to SSL/TLS certificates.
Near-miss passage: CVE-2015-1072. CWE: CWE-399. CVSS: 6.800000190734863. WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Query: CVE similar to CVE-2015-1696
Matching passage: CVE-2015-1696. CWE: CWE-94. CVSS: 9.300000190734863. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted Journal file, aka "Windows Journal Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-1675, CVE-2015-1695, CVE-2015-1697, CVE-2015-1698, and CVE-2015-1699.
Near-miss passage: CVE-2015-0092. CWE: CWE-94. CVSS: 9.300000190734863. Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted (1) web site or (2) file, aka "Adobe Font Driver Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-0088, CVE-2015-0090, CVE-2015-0091, and CVE-2015-0093.
Query: alert when Detects execution of PktMon, a tool that captures network packets.
Matching passage: Sigma rule: Detects execution of PktMon, a tool that captures network packets.. Logsource: windows / process_creation. Rule: title: PktMon.EXE Execution id: f956c7c1-0f60-4bc5-b7d7-b39ab3c08908 status: test description: Detects execution of PktMon, a tool that captures network packets. references: - https://lolbas-project.github.io/lolbas/Binaries/Pktmon/ author: frack113 date: 2022-03-17 modified: 2023-06-23 tags: - attack.discovery - attack.credential-access - attack.t1040 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \pktmon.exe - OriginalFileName: PktMon.exe condition: selection falsepositives: - Legitimate use level: medium
Near-miss passage: Sigma rule: Detects the execution of "gpg.exe" from uncommon location. Often used by ransomware and loaders to decrypt/encrypt data.. Logsource: windows / process_creation. Rule: title: Portable Gpg.EXE Execution id: 77df53a5-1d78-4f32-bc5a-0e7465bd8f41 status: test description: Detects the execution of "gpg.exe" from uncommon location. Often used by ransomware and loaders to decrypt/encrypt data. references: - https://www.trendmicro.com/vinfo/vn/threat-encyclopedia/malware/ransom.bat.zarlock.a - https://securelist.com/locked-out/68960/ - https://github.com/redcanaryco/atomic-red-team/blob/c4097dc7ed14d7f7d08c89d148c4307097e8c294/atomics/T1486/T1486.md author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-08-06 modified: 2023-11-10 tags: - attack.impact - attack.t1486 logsource: category: process_creation product: windows detection: selection: - Image|endswith: - \gpg.exe - \gpg2.exe - OriginalFileName: gpg.exe - Description: GnuPG’s OpenPGP tool filter_main_legit_location: Image|contains: - :\Program Files (x86)\GNU\GnuPG\bin\ - :\Program Files (x86)\GnuPG VS-Desktop\ - :\Program Files (x86)\GnuPG\bin\ - :\Program Files (x86)\Gpg4win\bin\ condition: selection and not 1 of filter_main_* level: medium
Query: patch priority for CVE-2015-9327
Matching passage: CVE-2015-9327. CWE: CWE-79. CVSS: 6.099999904632568. The flickr-justified-gallery plugin before 3.4.0 for WordPress has XSS.
Near-miss passage: CVE-2015-4413. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the new_fb_sign_button function in nextend-facebook-connect.php in Nextend Facebook Connect plugin before 1.5.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirect_to parameter.