alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection rule: Detects suspicious process related to rasdial.exe
Matching passage: Sigma rule: Detects suspicious process related to rasdial.exe. Logsource: windows / process_creation. Rule: title: Suspicious RASdial Activity id: 6bba49bf-7f8c-47d6-a1bb-6b4dece4640e status: test description: Detects suspicious process related to rasdial.exe references: - https://twitter.com/subTee/status/891298217907830785 author: juju4 date: 2019-01-16 modified: 2021-11-27 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection: Image|endswith: rasdial.exe condition: selection falsepositives: - False positives depend on scripts and administrative tools used in the monitored environment level: medium
Near-miss passage: Sigma rule: Detects the creation of a file with the ".dll" extension that has the name of a System DLL in uncommon or unsuspected lo. Logsource: windows / file_event. Rule: title: Files With System DLL Name In Unsuspected Locations id: 13c02350-4177-4e45-ac17-cf7ca628ff5e status: test description: 'Detects the creation of a file with the ".dll" extension that has the name of a System DLL in uncommon or unsuspected locations. (Outisde of "System32", "SysWOW64", etc.). It is highly recommended to perform an initial baseline before using this rule in production. ' references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2024-06-24 tags: - attack.stealth - attack.t1036.005 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: - \secur32.dll - \tdh.dll filter_main_generic: TargetFilename|contains: - C:\$WINDOWS.~BT\ - C:\$WinREAgent\ - C:\Windows\SoftwareDistribution\ - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ - C:\Windows\uus\ condition: selection and not 1 of filter_main_* falsepositives: - Third party software might bundle specific versions of system DLLs. level: medium regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_creation_system_dll_files/info.yml
Query: write Sigma for Detects the execution of the LOLBIN gpscript, which executes logon or startup scripts configured in Group Policy
Matching passage: Sigma rule: Detects the execution of the LOLBIN gpscript, which executes logon or startup scripts configured in Group Policy. Logsource: windows / process_creation. Rule: title: Gpscript Execution id: 1e59c230-6670-45bf-83b0-98903780607e status: test description: Detects the execution of the LOLBIN gpscript, which executes logon or startup scripts configured in Group Policy references: - https://oddvar.moe/2018/04/27/gpscript-exe-another-lolbin-to-the-list/ - https://lolbas-project.github.io/lolbas/Binaries/Gpscript/ author: frack113 date: 2022-05-16 modified: 2023-06-14 tags: - attack.stealth - attack.t1218 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \gpscript.exe - OriginalFileName: GPSCRIPT.EXE selection_cli: CommandLine|contains: - ' /logon' - ' /startup' filter_main_svchost: ParentCommandLine: C:\windows\system32\svchost.exe -k netsvcs -p -s gpsvc condition: all of selection_* and not 1 of filter_main_* falsepositives: - Legitimate uses of logon scripts distributed via group policy level: medium
Near-miss passage: Sigma rule: A General detection for sdclt being spawned as an elevated process. This could be an indicator of sdclt being used for b. Logsource: windows / process_creation. Rule: title: Potential UAC Bypass Via Sdclt.EXE id: 40f9af16-589d-4984-b78d-8c2aec023197 status: test description: A General detection for sdclt being spawned as an elevated process. This could be an indicator of sdclt being used for bypass UAC techniques. references: - https://github.com/OTRF/detection-hackathon-apt29/issues/6 - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.B.2_C36B49B5-DF58-4A34-9FE9-56189B9DEFEA.md author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-05-02 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: Image|endswith: sdclt.exe IntegrityLevel: - High - S-1-16-12288 condition: selection falsepositives: - Unknown level: medium
Query: exploit Cross-site scripting (XSS) vulnerability on ASUS Japan WL-330NUL devices with firmware before 3.0.0.42 allows remote attackers to inject arbitrary web script or HTML via unspecifie
Matching passage: CVE-2015-7790. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability on ASUS Japan WL-330NUL devices with firmware before 3.0.0.42 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-9304. CWE: CWE-79. CVSS: 6.099999904632568. The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input.
Query: rule covering Detects known sensitive file extensions via Zeek
Matching passage: Sigma rule: Detects known sensitive file extensions via Zeek. Logsource: zeek / smb_files. Rule: title: Suspicious Access to Sensitive File Extensions - Zeek id: 286b47ed-f6fe-40b3-b3a8-35129acd43bc related: - id: 91c945bc-2ad1-4799-a591-4d00198a1215 type: derived status: test description: Detects known sensitive file extensions via Zeek references: - Internal Research author: Samir Bousseaden, @neu5ron date: 2020-04-02 modified: 2025-10-17 tags: - attack.collection logsource: product: zeek service: smb_files detection: selection: name|endswith: - .pst - .ost - .msg - .nst - .oab - .edb - .nsf - .bak - .dmp - .kirbi - .rdp condition: selection falsepositives: - Help Desk operator doing backup or re-imaging end user machine or backup software - Users working with these data types or exchanging message files level: medium
Near-miss passage: Sigma rule: Detects the "iscsicpl.exe" UAC bypass technique that leverages a DLL Search Order hijacking technique to load a custom D. Logsource: windows / image_load. Rule: title: UAC Bypass Using Iscsicpl - ImageLoad id: 9ed5959a-c43c-4c59-84e3-d28628429456 status: test description: Detects the "iscsicpl.exe" UAC bypass technique that leverages a DLL Search Order hijacking technique to load a custom DLL's from temp or a any user controlled location in the users %PATH% references: - https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC - https://twitter.com/wdormann/status/1547583317410607110 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-17 modified: 2022-07-25 tags: - attack.privilege-escalation - attack.t1548.002 logsource: product: windows category: image_load detection: selection: Image: C:\Windows\SysWOW64\iscsicpl.exe ImageLoaded|endswith: \iscsiexe.dll filter: ImageLoaded|contains|all: - C:\Windows\ - iscsiexe.dll condition: selection and not filter falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-6335
Matching passage: CVE-2015-6335. CWE: CWE-264. CVSS: 9.0. The policy implementation in Cisco FireSIGHT Management Center 5.3.1.7, 5.4.0.4, and 6.0.0 for VMware allows remote authenticated administrators to bypass intended policy restrictions and execute Linux commands as root via unspecified vectors, aka Bug ID CSCuw12839.
Near-miss passage: CVE-2015-7003. CWE: CWE-264. CVSS: 6.800000190734863. coreaudiod in Audio in Apple OS X before 10.11.1 does not initialize an unspecified data structure, which allows attackers to execute arbitrary code via a crafted app.
Query: describe CVE-2015-3182
Matching passage: CVE-2015-3182. CWE: CWE-20. CVSS: 5.5. epan/dissectors/packet-dec-dnart.c in the DECnet NSP/RT dissector in Wireshark 1.10.12 through 1.10.14 mishandles a certain strdup return value, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Near-miss passage: CVE-2015-2752. CWE: CWE-20. CVSS: 4.900000095367432. The XEN_DOMCTL_memory_mapping hypercall in Xen 3.2.x through 4.5.x, when using a PCI passthrough device, is not preemptible, which allows local x86 HVM domain users to cause a denial of service (host CPU consumption) via a crafted request to the device model (qemu-dm).
Query: rule covering Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). U
Matching passage: Sigma rule: Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). U. Logsource: windows / pipe_created. Rule: title: ADFS Database Named Pipe Connection By Uncommon Tool id: 1ea13e8c-03ea-409b-877d-ce5c3d2c1cb3 status: test description: 'Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). Used to access information such as the AD FS configuration settings which contains sensitive information used to sign SAML tokens. ' references: - https://github.com/Azure/Azure-Sentinel/blob/f99542b94afe0ad2f19a82cc08262e7ac8e1428e/Detections/SecurityEvent/ADFSDBNamedPipeConnection.yaml - https://o365blog.com/post/adfs/ - https://github.com/Azure/SimuLand author: Roberto Rodriguez @Cyb3rWard0g date: 2021-10-08 modified: 2023-11-30 tags: - attack.collection - attack.t1005 logsource: product: windows category: pipe_created definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection: PipeName: \MICROSOFT##WID\tsql\query filter_main_generic: Image|endswith: - :\Windows\System32\mmc.exe - :\Windows\system32\svchost.exe - :\Windows\System32\wsmprovhost.exe - :\Windows\SysWOW64\mmc.exe - :\Windows\SysWOW64\wsmprovhost.exe - :\Windows\WID\Binn\sqlwriter.exe - \AzureADConnect.exe - \Microsoft.Identity.Health.Adfs.PshSurrogate.exe - \Microsoft.IdentityServer.ServiceHost.exe - \Microsoft.Tri.Sensor.exe - \sqlservr.exe - \tssdis.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects a ProcessHacker tool that elevated privileges to a very high level. Logsource: windows / system. Rule: title: ProcessHacker Privilege Elevation id: c4ff1eac-84ad-44dd-a6fb-d56a92fc43a9 status: test description: Detects a ProcessHacker tool that elevated privileges to a very high level references: - https://twitter.com/1kwpeter/status/1397816101455765504 author: Florian Roth (Nextron Systems) date: 2021-05-27 modified: 2022-12-25 tags: - attack.persistence - attack.execution - attack.privilege-escalation - attack.t1543.003 - attack.t1569.002 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ServiceName|startswith: ProcessHacker AccountName: LocalSystem condition: selection falsepositives: - Unlikely level: high
Query: exploit Multiple cross-site scripting (XSS) vulnerabilities in install_classic.php in Coppermine Photo Gallery (CPG) 1.5.36 allow remote attackers to inject arbitrary web script or HTML vi
Matching passage: CVE-2015-6528. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in install_classic.php in Coppermine Photo Gallery (CPG) 1.5.36 allow remote attackers to inject arbitrary web script or HTML via the (1) admin_username, (2) admin_password, (3) admin_email, (4) dbserver, (5) dbname, (6) dbuser, (7) dbpass, (8) table_prefix, or (9) impath parameter.
Near-miss passage: CVE-2015-0551. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum WebTop 6.7SP1 before P31, 6.7SP2 before P23, and 6.8 before P01; Documentum Administrator 6.7SP1 before P31, 6.7SP2 before P23, 7.0 before P18, 7.1 before P15, and 7.2 before P01; Documentum Digital Assets Manager 6.5SP6 before P25; Documentum Web Publishers 6.5 SP7 before P25; and Documentum Task Space 6.7SP1 before P31 and 6.7SP2 before P23 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Query: risk of The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in Cisco IOS 15.3(3)S0.1 on ASR devices mishandles internal tables, which allows remote attackers to cause a d
Matching passage: CVE-2015-6359. CWE: CWE-119. CVSS: 6.099999904632568. The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in Cisco IOS 15.3(3)S0.1 on ASR devices mishandles internal tables, which allows remote attackers to cause a denial of service (memory consumption or device crash) via a flood of crafted ND messages, aka Bug ID CSCup28217.
Near-miss passage: CVE-2015-3824. CWE: CWE-119. CVSS: 10.0. The MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not properly restrict size addition, which allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow and memory corruption) via a crafted MPEG-4 tx3g atom, aka internal bug 20923261.
Query: detect Detects a suspicious process spawning from an Outlook process. in logs
Matching passage: Sigma rule: Detects a suspicious process spawning from an Outlook process.. Logsource: windows / process_creation. Rule: title: Suspicious Outlook Child Process id: 208748f7-881d-47ac-a29c-07ea84bf691d related: - id: 438025f9-5856-4663-83f7-52f878a70a50 type: derived - id: e212d415-0e93-435f-9e1a-f29005bb4723 type: derived status: test description: Detects a suspicious process spawning from an Outlook process. references: - https://www.hybrid-analysis.com/sample/465aabe132ccb949e75b8ab9c5bda36d80cf2fd503d52b8bad54e295f28bbc21?environmentId=100 - https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html author: Michael Haag, Florian Roth (Nextron Systems), Markus Neis, Elastic, FPT.EagleEye Team date: 2022-02-28 modified: 2023-02-04 tags: - attack.execution - attack.t1204.002 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \OUTLOOK.EXE Image|endswith: - \AppVLP.exe - \bash.exe - \cmd.exe - \cscript.exe - \forfiles.exe - \hh.exe - \mftrace.exe - \msbuild.exe - \msdt.exe - \mshta.exe - \msiexec.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \schtasks.exe - \scrcons.exe - \scriptrunner.exe - \sh.exe - \svchost.exe - \wmic.exe - \wscript.exe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects usage of Gpg4win to encrypt/decrypt files located in potentially suspicious locations.. Logsource: windows / process_creation. Rule: title: File Encryption/Decryption Via Gpg4win From Suspicious Locations id: e1e0b7d7-e10b-4ee4-ac49-a4bda05d320d status: test description: Detects usage of Gpg4win to encrypt/decrypt files located in potentially suspicious locations. references: - https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html - https://news.sophos.com/en-us/2022/01/19/zloader-installs-remote-access-backdoors-and-delivers-cobalt-strike/ author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) date: 2022-11-30 modified: 2023-08-09 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_metadata: - Image|endswith: - \gpg.exe - \gpg2.exe - Product: GNU Privacy Guard (GnuPG) - Description: GnuPG’s OpenPGP tool selection_cli: CommandLine|contains: -passphrase selection_paths: CommandLine|contains: - :\PerfLogs\ - :\Temp\ - :\Users\Public\ - :\Windows\Temp\ - \AppData\Local\Temp\ - \AppData\Roaming\ condition: all of selection_* falsepositives: - Unknown level: high
Query: detect Indicates sign-ins from IP addresses infected with malware that is known to actively communicate with a bot server. in logs
Matching passage: Sigma rule: Indicates sign-ins from IP addresses infected with malware that is known to actively communicate with a bot server.. Logsource: azure / riskdetection. Rule: title: Sign-In From Malware Infected IP id: 821b4dc3-1295-41e7-b157-39ab212dd6bd status: test description: Indicates sign-ins from IP addresses infected with malware that is known to actively communicate with a bot server. references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#malware-linked-ip-address-deprecated - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-03 tags: - attack.t1090 - attack.command-and-control logsource: product: azure service: riskdetection detection: selection: riskEventType: malwareInfectedIPAddress condition: selection falsepositives: - Using an IP address that is shared by many users level: high
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via COMPRESS OBFUSCATION. Logsource: windows / system. Rule: title: Invoke-Obfuscation COMPRESS OBFUSCATION - System id: 175997c5-803c-4b08-8bb0-70b099f47595 status: test description: Detects Obfuscated Powershell via COMPRESS OBFUSCATION references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Timur Zinniatullin, oscd.community date: 2020-10-18 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ImagePath|contains|all: - new-object - text.encoding]::ascii - readtoend ImagePath|contains: - :system.io.compression.deflatestream - system.io.streamreader condition: selection falsepositives: - Unknown level: medium
Query: risk of Directory traversal vulnerability in the file output plugin in Elasticsearch Logstash before 1.4.3 allows remote attackers to write to arbitrary files via vectors related to dynami
Matching passage: CVE-2015-4152. CWE: CWE-22. CVSS: 6.400000095367432. Directory traversal vulnerability in the file output plugin in Elasticsearch Logstash before 1.4.3 allows remote attackers to write to arbitrary files via vectors related to dynamic field references in the path option.
Near-miss passage: CVE-2015-4988. CWE: CWE-22. CVSS: 8.600000381469727. Directory traversal vulnerability in the replay server in IBM Tealeaf Customer Experience before 8.7.1.8818, 8.8 before 8.8.0.9026, 9.0.0, 9.0.0A, 9.0.1 before 9.0.1.1083, 9.0.1A before 9.0.1.5073, 9.0.2 before 9.0.2.1095, and 9.0.2A before 9.0.2.5144 allows remote attackers to read arbitrary files via unspecified vectors.
Query: rule covering Detects kerberos TGS request using RC4 encryption which may be indicative of kerberoasting
Matching passage: Sigma rule: Detects kerberos TGS request using RC4 encryption which may be indicative of kerberoasting. Logsource: zeek / kerberos. Rule: title: Kerberos Network Traffic RC4 Ticket Encryption id: 503fe26e-b5f2-4944-a126-eab405cc06e5 status: test description: Detects kerberos TGS request using RC4 encryption which may be indicative of kerberoasting references: - https://adsecurity.org/?p=3458 author: sigma date: 2020-02-12 modified: 2021-11-27 tags: - attack.credential-access - attack.t1558.003 logsource: product: zeek service: kerberos detection: selection: request_type: TGS cipher: rc4-hmac computer_acct: service|startswith: $ condition: selection and not computer_acct falsepositives: - Normal enterprise SPN requests activity level: medium
Near-miss passage: Sigma rule: An adversary may use legitimate desktop support and remote access software,to establish an interactive command and contr. Logsource: windows / process_creation. Rule: title: Use of UltraVNC Remote Access Software id: 145322e4-0fd3-486b-81ca-9addc75736d8 status: test description: An adversary may use legitimate desktop support and remote access software,to establish an interactive command and control channel to target systems within networks references: - https://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1219/T1219.md author: frack113 date: 2022-10-02 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: windows detection: selection: - Description: VNCViewer - Product: UltraVNC VNCViewer - Company: UltraVNC - OriginalFileName: VNCViewer.exe condition: selection falsepositives: - Legitimate use level: medium
Query: detect Detects parameters used by WMImplant in logs
Matching passage: Sigma rule: Detects parameters used by WMImplant. Logsource: windows / ps_script. Rule: title: WMImplant Hack Tool id: 8028c2c3-e25a-46e3-827f-bbb5abf181d7 status: test description: Detects parameters used by WMImplant references: - https://github.com/FortyNorthSecurity/WMImplant author: NVISO date: 2020-03-26 modified: 2022-12-25 tags: - attack.execution - attack.t1047 - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - WMImplant - ' change_user ' - ' gen_cli ' - ' command_exec ' - ' disable_wdigest ' - ' disable_winrm ' - ' enable_wdigest ' - ' enable_winrm ' - ' registry_mod ' - ' remote_posh ' - ' sched_job ' - ' service_mod ' - ' process_kill ' - ' active_users ' - ' basic_info ' - ' power_off ' - ' vacant_system ' - ' logon_events ' condition: selection falsepositives: - Administrative scripts that use the same keywords. level: high
Near-miss passage: Sigma rule: Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.. Logsource: windows / security. Rule: title: WMI Persistence - Security id: f033f3f3-fd24-4995-97d8-a3bb17550a88 related: - id: 0b7889b4-5577-4521-a60a-3376ee7f9f7b type: derived status: test description: Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs. references: - https://twitter.com/mattifestation/status/899646620148539397 - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/ author: Florian Roth (Nextron Systems), Gleb Sukhodolskiy, Timur Zinniatullin oscd.community date: 2017-08-22 modified: 2022-11-29 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.003 logsource: product: windows service: security detection: selection: EventID: 4662 ObjectType: WMI Namespace ObjectName|contains: subscription condition: selection falsepositives: - Unknown (data set is too small; further testing needed) level: medium
Query: describe CVE-2015-7597
Matching passage: CVE-2015-7597. CWE: CWE-264. CVSS: 7.800000190734863. SafeNet Authentication Service IIS Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module.
Near-miss passage: CVE-2015-3185. CWE: CWE-264. CVSS: 4.300000190734863. The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an authorization setting rather than an authentication setting, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging the presence of a module that relies on the 2.2 API behavior.
Query: risk of In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in eMBMS where an assertion can be reached by a sequence of downlink messages
Matching passage: CVE-2015-9039. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in eMBMS where an assertion can be reached by a sequence of downlink messages.
Near-miss passage: CVE-2015-1611. CWE: CWE-20. CVSS: 7.5. OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology and affect the flow of data, related to "fake LLDP injection."