alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a proble
Matching passage: CVE-2015-8103. CWE: CWE-502. CVSS: 9.800000190734863. The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy variant in 'ysoserial'".
Near-miss passage: CVE-2015-2020. CWE: CWE-502. CVSS: 9.800000190734863. The MyScript SDK before 1.3 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.
Query: rule covering Detects when a configuration change is made to an applications AppID URI.
Matching passage: Sigma rule: Detects when a configuration change is made to an applications AppID URI.. Logsource: azure / auditlogs. Rule: title: Application AppID Uri Configuration Changes id: 1b45b0d1-773f-4f23-aedc-814b759563b1 status: test description: Detects when a configuration change is made to an applications AppID URI. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#appid-uri-added-modified-or-removed author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik' date: 2022-06-02 tags: - attack.initial-access - attack.persistence - attack.credential-access - attack.privilege-escalation - attack.stealth - attack.t1552 - attack.t1078.004 logsource: product: azure service: auditlogs detection: selection: properties.message: - Update Application - Update Service principal condition: selection falsepositives: - When and administrator is making legitimate AppID URI configuration changes to an application. This should be a planned event. level: high
Near-miss passage: Sigma rule: Detects events with patterns found in commands used for reconnaissance on linux systems. Logsource: linux / process_creation. Rule: title: Linux Recon Indicators id: 0cf7a157-8879-41a2-8f55-388dd23746b7 status: test description: Detects events with patterns found in commands used for reconnaissance on linux systems references: - https://github.com/sleventyeleven/linuxprivchecker/blob/0d701080bbf92efd464e97d71a70f97c6f2cd658/linuxprivchecker.py author: Florian Roth (Nextron Systems) date: 2022-06-20 tags: - attack.reconnaissance - attack.t1592.004 - attack.credential-access - attack.t1552.001 logsource: category: process_creation product: linux detection: selection: CommandLine|contains: - ' -name .htpasswd' - ' -perm -4000 ' condition: selection falsepositives: - Legitimate administration activities level: high
Query: describe CVE-2015-8982
Matching passage: CVE-2015-8982. CWE: CWE-190. CVSS: 8.100000381469727. Integer overflow in the strxfrm function in the GNU C Library (aka glibc or libc6) before 2.21 allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string, which triggers a stack-based buffer overflow.
Near-miss passage: CVE-2015-7599. CWE: CWE-190. CVSS: 8.100000381469727. Integer overflow in the _authenticate function in svc_auth.c in Wind River VxWorks 5.5 through 6.9.4.1, when the Remote Procedure Call (RPC) protocol is enabled, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a username and password.
Query: describe CVE-2015-7826
Matching passage: CVE-2015-7826. CWE: CWE-295. CVSS: 9.800000190734863. botan 1.11.x before 1.11.22 improperly handles wildcard matching against hostnames, which might allow remote attackers to have unspecified impact via a valid X.509 certificate, as demonstrated by accepting *.example.com as a match for bar.foo.example.com.
Near-miss passage: CVE-2015-3420. CWE: CWE-295. CVSS: 5.900000095367432. The ssl-proxy-openssl.c function in Dovecot before 2.2.17, when SSLv3 is disabled, allow remote attackers to cause a denial of service (login process crash) via vectors related to handshake failures.
Query: risk of Unquoted executable path vulnerability in Client Management and Gateway components in McAfee (now Intel Security) ePO Deep Command (eDC) 2.2 and 2.1 allows authenticated users to e
Matching passage: CVE-2015-8988. CWE: CWE-77. CVSS: 8.800000190734863. Unquoted executable path vulnerability in Client Management and Gateway components in McAfee (now Intel Security) ePO Deep Command (eDC) 2.2 and 2.1 allows authenticated users to execute a command of their choice via dropping a malicious file for the path.
Near-miss passage: CVE-2015-1986. CWE: CWE-77. CVSS: 10.0. The server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to execute arbitrary commands via unspecified vectors, a different vulnerability than CVE-2015-1938.
Query: CVE similar to CVE-2015-1281
Matching passage: CVE-2015-1281. CWE: CWE-254. CVSS: 4.300000190734863. core/loader/ImageLoader.cpp in Blink, as used in Google Chrome before 44.0.2403.89, does not properly determine the V8 context of a microtask, which allows remote attackers to bypass Content Security Policy (CSP) restrictions by providing an image from an unintended source.
Near-miss passage: CVE-2015-1793. CWE: CWE-254. CVSS: 6.5. The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraints cA values during identification of alternative certificate chains, which allows remote attackers to spoof a Certification Authority role and trigger unintended certificate verifications via a valid leaf certificate.
Query: describe CVE-2015-8597
Matching passage: CVE-2015-8597. CWE: UNKNOWN. CVSS: 7.400000095367432. Open redirect vulnerability in Blue Coat ProxySG 6.5 before 6.5.8.8 and 6.6 and Advanced Secure Gateway (ASG) 6.6 might allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a base64-encoded URL in conjunction with a "clear text" one in a coaching page, as demonstrated by "http://www.%humbug-URL%.local/bluecoat-splash-API?%BASE64-URL%."
Near-miss passage: CVE-2015-3118. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3124, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, CVE-2015-4430, and CVE-2015-5117.
Query: detection rule: Detects when a Microsoft Cloud App Security reported when an app downloads multiple files from Microsoft SharePoint or M
Matching passage: Sigma rule: Detects when a Microsoft Cloud App Security reported when an app downloads multiple files from Microsoft SharePoint or M. Logsource: m365 / threat_management. Rule: title: Suspicious OAuth App File Download Activities id: ee111937-1fe7-40f0-962a-0eb44d57d174 status: test description: Detects when a Microsoft Cloud App Security reported when an app downloads multiple files from Microsoft SharePoint or Microsoft OneDrive in a manner that is unusual for the user. references: - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference author: Austin Songer @austinsonger date: 2021-08-23 modified: 2022-10-09 tags: - attack.exfiltration logsource: service: threat_management product: m365 detection: selection: eventSource: SecurityComplianceCenter eventName: Suspicious OAuth app file download activities status: success condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: List credentials currently stored in Windows Credential Manager via the native Windows utility vaultcmd.exe. Logsource: windows / process_creation. Rule: title: Windows Credential Manager Access via VaultCmd id: 58f50261-c53b-4c88-bd12-1d71f12eda4c status: test description: List credentials currently stored in Windows Credential Manager via the native Windows utility vaultcmd.exe references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555.004/T1555.004.md#atomic-test-1---access-saved-credentials-via-vaultcmd author: frack113 date: 2022-04-08 modified: 2022-05-13 tags: - attack.credential-access - attack.t1555.004 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \VaultCmd.exe - OriginalFileName: VAULTCMD.EXE selection_cli: CommandLine|contains: '/listcreds:' condition: all of selection* falsepositives: - Unknown level: medium
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects attackers attempting to disable Windows Defender using Powershell. Logsource: windows / process_creation. Rule: title: Disable Windows Defender AV Security Monitoring id: a7ee1722-c3c5-aeff-3212-c777e4733217 status: test description: Detects attackers attempting to disable Windows Defender using Powershell references: - https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/ - https://rvsec0n.wordpress.com/2020/01/24/malwares-that-bypass-windows-defender/ - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md author: ok @securonix invrep-de, oscd.community, frack113 date: 2020-10-12 modified: 2022-11-18 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_pwsh_binary: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_pwsh_cli: CommandLine|contains: - -DisableBehaviorMonitoring $true - -DisableRuntimeMonitoring $true selection_sc_binary: - Image|endswith: \sc.exe - OriginalFileName: sc.exe selection_sc_tamper_cmd_stop: CommandLine|contains|all: - stop - WinDefend selection_sc_tamper_cmd_delete: CommandLine|contains|all: - delete - WinDefend selection_sc_tamper_cmd_disabled: CommandLine|contains|all: - config - WinDefend - start=disabled condition: all of selection_pwsh_* or (selection_sc_binary and 1 of selection_sc_tamper_*) falsepositives: - Minimal, for some older versions of dev tools, such as pycharm, developers were known to sometimes disable Windows Defender to improve performance, but this generally is not considered a good security practice. level: high
Near-miss passage: Sigma rule: Detects attempts to install unsigned MSIX/AppX packages using the -AllowUnsigned parameter via AppXDeployment-Server eve. Logsource: windows / appxdeployment-server. Rule: title: Windows AppX Deployment Unsigned Package Installation id: 9a025188-6f2d-42f8-bb2f-d3a83d24a5af related: - id: 37651c2a-42cd-4a69-ae0d-22a4349aa04a type: similar - id: 975b2262-9a49-439d-92a6-0709cccdf0b2 type: similar status: experimental description: Detects attempts to install unsigned MSIX/AppX packages using the -AllowUnsigned parameter via AppXDeployment-Server events references: - https://docs.microsoft.com/en-us/powershell/module/appx/add-appxpackage - https://www.splunk.com/en_us/blog/security/msix-weaponization-threat-detection-splunk.html author: Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-03 tags: - attack.execution - attack.defense-impairment - attack.t1204.002 - attack.t1553.005 logsource: product: windows service: appxdeployment-server detection: selection: EventID: 603 Flags: '8388608' condition: selection falsepositives: - Legitimate installation of unsigned packages for legitimate purposes such as development or testing level: medium
Query: detection rule: Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's locat
Matching passage: Sigma rule: Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's locat. Logsource: windows / process_creation. Rule: title: Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script id: 236d8e89-ed95-4789-a982-36f4643738ba related: - id: 7aa4e81a-a65c-4e10-9f81-b200eb229d7d type: derived status: test description: Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's located in a potentially suspicious location to run for a specific VM state references: - https://bohops.com/2021/10/08/analyzing-and-detecting-a-vmtools-persistence-technique/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-14 tags: - attack.execution - attack.persistence - attack.t1059 logsource: category: process_creation product: windows detection: selection_bin_img: - Image|endswith: \VMwareToolBoxCmd.exe - OriginalFileName: toolbox-cmd.exe selection_bin_cli: CommandLine|contains|all: - ' script ' - ' set ' selection_susp_paths: CommandLine|contains: - :\PerfLogs\ - :\Temp\ - :\Windows\System32\Tasks\ - :\Windows\Tasks\ - :\Windows\Temp\ - \AppData\Local\Temp condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects changes to the ClickOnce trust prompt registry key in order to enable an installation from different locations s. Logsource: windows / registry_set. Rule: title: ClickOnce Trust Prompt Tampering id: ac9159cc-c364-4304-8f0a-d63fc1a0aabb status: test description: Detects changes to the ClickOnce trust prompt registry key in order to enable an installation from different locations such as the Internet. references: - https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5 - https://learn.microsoft.com/en-us/visualstudio/deployment/how-to-configure-the-clickonce-trust-prompt-behavior author: '@SerkinValery, Nasreddine Bencherchali (Nextron Systems)' date: 2023-06-12 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \SOFTWARE\MICROSOFT\.NETFramework\Security\TrustManager\PromptingLevel\ TargetObject|endswith: - \Internet - \LocalIntranet - \MyComputer - \TrustedSites - \UntrustedSites Details: Enabled condition: selection falsepositives: - Legitimate internal requirements. level: medium
Query: rule covering Detects LOLBINs and applications that should not legitimately drop executable or executable-equivalent files to disk. Th
Matching passage: Sigma rule: Detects LOLBINs and applications that should not legitimately drop executable or executable-equivalent files to disk. Th. Logsource: windows / file_event. Rule: title: Legitimate Application Dropped Executable id: f0540f7e-2db3-4432-b9e0-3965486744bc status: test description: 'Detects LOLBINs and applications that should not legitimately drop executable or executable-equivalent files to disk. This may indicate malware staging, process injection, or abuse of a trusted binary for payload delivery. ' references: - https://github.com/Neo23x0/sysmon-config/blob/3f808d9c022c507aae21a9346afba4a59dd533b9/sysmonconfig-export-block.xml#L1326 - https://dmpdump.github.io/posts/TelegramRat/ - https://www.virustotal.com/gui/file/a0d5b30578acd1df9139e7a8a4bfc659dc2cf48f4dc0c5804b70890adeb9fa21/behavior author: frack113, Florian Roth (Nextron Systems) date: 2022-08-21 modified: 2026-05-11 tags: - attack.stealth - attack.t1218 logsource: product: windows category: file_event detection: selection: Image|endswith: - \eqnedt32.exe - \wordpad.exe - \wordview.exe - \certutil.exe - \certoc.exe - \CertReq.exe - \Desktopimgdownldr.exe - \esentutl.exe - \mshta.exe - \AcroRd32.exe - \RdrCEF.exe - \hh.exe - \finger.exe TargetFilename|endswith: - .com - .dll - .exe - .jar - .ocx - .pyc condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_exe/info.yml
Near-miss passage: Sigma rule: Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels. Logsource: cisco / ldp. Rule: title: Cisco LDP Authentication Failures id: 50e606bf-04ce-4ca7-9d54-3449494bbd4b status: test description: Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels references: - https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-convery-franz-v3.pdf author: Tim Brown date: 2023-01-09 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation - attack.credential-access - attack.collection - attack.stealth - attack.t1078 - attack.t1110 - attack.t1557 logsource: product: cisco service: ldp definition: 'Requirements: cisco ldp logs need to be enabled and ingested' detection: selection_protocol: - LDP selection_keywords: - SOCKET_TCP_PACKET_MD5_AUTHEN_FAIL - TCPMD5AuthenFail condition: selection_protocol and selection_keywords falsepositives: - Unlikely. Except due to misconfigurations level: low
Query: CVE similar to CVE-2015-0407
Matching passage: CVE-2015-0407. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to Swing.
Near-miss passage: CVE-2015-4938. CWE: UNKNOWN. CVSS: 5.0. IBM WebSphere Application Server 7.x before 7.0.0.39, 8.0.x before 8.0.0.11, and 8.5.x before 8.5.5.7 allows remote attackers to spoof servlets and obtain sensitive information via unspecified vectors.
Query: intelligence brief on T1090.001
Matching passage: T1090.001 Internal Proxy. Tactics: command and control. Description: Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use internal proxies to manage command and control communications inside a compromised environment, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between infected systems to avoid suspicion. Internal proxy connections may use common peer-to-peer (p2p) networking protocols, such as SMB, to better blend in with the environment. By using a compromised internal system as a proxy, adversaries may conceal the true destination of C2 traffic while reducing the need for numerous connections to external systems.
Near-miss passage: T1090.003 Multi-hop Proxy. Tactics: command and control. Description: Adversaries may chain together multiple proxies to disguise the source of malicious traffic. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source. For example, adversaries may construct or use onion routing networks – such as the publicly available [Tor](https://attack.mitre.org/software/S0183) network – to transport encrypted C2 traffic through a compromised population, allowing communication with any device within the network.(Citation: Onion Routing) Adversaries may also use operational relay box (ORB) networks composed of virtual private servers (VPS), Internet of Things (IoT) devices, smart devices, and end-of-life routers to obfuscate their operations.(Citation: ORB Mandiant) In the case of network infrastructure, it is possible for an adversary to leverage multiple compromised devices to create a multi-hop proxy chain (i.e., [Network Devices](https://attack.mitre.org/techniques/T1584/008)). By leveraging [Patch System Image](https://attack.mitre.org/techniques/T1601/001) on routers, adversaries can add custom code to the affected network devices that will implement onion routing between those nodes. This method is dependent upon the [Network Boundary Bridging](https://attack.mitre.org/techniques/T1599) method allowing the adversaries to cross the protected network boundary of the Internet perimeter and into the organization’s Wide-Area Network (WAN). Protocols such as ICMP may be used as a transport. Similarly, adversaries may abuse peer-to-peer (P2P) and blockchain-oriented infrastructure to implement routing between a decentralized network of peers.(Citation: NGLite Trojan)
Query: exploit libstagefright in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows attackers to gain privileges or cause a denial of service (memory corruption) via a crafted applicati
Matching passage: CVE-2015-6610. CWE: CWE-119. CVSS: 10.0. libstagefright in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows attackers to gain privileges or cause a denial of service (memory corruption) via a crafted application, aka internal bug 23707088.
Near-miss passage: CVE-2015-2372. CWE: CWE-119. CVSS: 9.300000190734863. vbscript.dll in Microsoft VBScript 5.6 through 5.8, as used with Internet Explorer 6 through 11 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "VBScript Memory Corruption Vulnerability."
Query: exploit In open buildservice 2.6 before 2.6.3, 2.5 before 2.5.7 and 2.4 before 2.4.8 the source service patch application could generate non-standard files like symlinks or device nodes, w
Matching passage: CVE-2015-0796. CWE: CWE-434. CVSS: 7.800000190734863. In open buildservice 2.6 before 2.6.3, 2.5 before 2.5.7 and 2.4 before 2.4.8 the source service patch application could generate non-standard files like symlinks or device nodes, which could allow buildservice users to break of confinement or cause denial of service attacks on the source service.
Near-miss passage: CVE-2015-1785. CWE: CWE-434. CVSS: 6.5. In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the web application. The vulnerabilities lie in how the application validates user uploaded files and lack of security measures preventing unwanted HTTP requests.
Query: patch priority for CVE-2015-7221
Matching passage: CVE-2015-7221. CWE: CWE-119. CVSS: 10.0. Buffer overflow in the nsDeque::GrowCapacity function in xpcom/glue/nsDeque.cpp in Mozilla Firefox before 43.0 might allow remote attackers to cause a denial of service or possibly have unspecified other impact by triggering a deque size change.
Near-miss passage: CVE-2015-5876. CWE: CWE-119. CVSS: 9.300000190734863. dyld in Dev Tools in Apple iOS before 9 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Query: exploit Absolute path traversal vulnerability in the download feature in FileDownloadServlet in GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise before 3.1.5 allows remote attack
Matching passage: CVE-2015-6459. CWE: CWE-22. CVSS: 10.0. Absolute path traversal vulnerability in the download feature in FileDownloadServlet in GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise before 3.1.5 allows remote attackers to read or delete arbitrary files via a full pathname.
Near-miss passage: CVE-2015-5467. CWE: CWE-22. CVSS: 9.800000190734863. web\ViewAction in Yii (aka Yii2) 2.x before 2.0.5 allows attackers to execute any local .php file via a relative path in the view parameeter.