alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in Dovgalyuk AIBattle. Affected is the function sendComments of the file site/procedures.php. 
Matching passage: CVE-2015-10041. CWE: CWE-89. CVSS: 9.800000190734863. ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in Dovgalyuk AIBattle. Affected is the function sendComments of the file site/procedures.php. The manipulation of the argument text leads to sql injection. The name of the patch is e3aa4d0900167641d41cbccf53909229f00381c9. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218304. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Near-miss passage: CVE-2015-6537. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in the login page in Epiphany Cardio Server 3.3 allows remote attackers to execute arbitrary SQL commands via a crafted URL.
Query: describe CVE-2015-4842
Matching passage: CVE-2015-4842. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via vectors related to JAXP.
Near-miss passage: CVE-2015-5442. CWE: UNKNOWN. CVSS: 4.599999904632568. Unspecified vulnerability in HP Software Update before 5.005.002.002 allows local users to gain privileges via unknown vectors.
Query: vulnerability: Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to bypass intended access restrictions and read files via unspecified vectors, a d
Matching passage: CVE-2015-2953. CWE: CWE-264. CVSS: 5.0. Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to bypass intended access restrictions and read files via unspecified vectors, a different vulnerability than CVE-2015-2952 and CVE-2015-2958.
Near-miss passage: CVE-2015-4165. CWE: CWE-264. CVSS: 7.5. The snapshot API in Elasticsearch before 1.6.0 when another application exists on the system that can read Lucene files and execute code from them, is accessible by the attacker, and the Java VM on which Elasticsearch is running can write to a location that the other application can read and execute from, allows remote authenticated users to write to and create arbitrary snapshot metadata files, and potentially execute arbitrary code.
Query: exploit Techno Project Japan Enisys Gw before 1.4.1 allows remote attackers to bypass intended access restrictions and read arbitrary uploaded files via unspecified vectors.
Matching passage: CVE-2015-5671. CWE: CWE-264. CVSS: 5.0. Techno Project Japan Enisys Gw before 1.4.1 allows remote attackers to bypass intended access restrictions and read arbitrary uploaded files via unspecified vectors.
Near-miss passage: CVE-2015-1291. CWE: CWE-264. CVSS: 6.400000095367432. The ContainerNode::parserRemoveChild function in core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 45.0.2454.85, does not check whether a node is expected, which allows remote attackers to bypass the Same Origin Policy or cause a denial of service (DOM tree corruption) via a web site with crafted JavaScript code and IFRAME elements.
Query: risk of buffer.c in named in ISC BIND 9.x before 9.9.7-P3 and 9.10.x before 9.10.2-P4 allows remote attackers to cause a denial of service (assertion failure and daemon exit) by creating a
Matching passage: CVE-2015-5722. CWE: CWE-20. CVSS: 7.800000190734863. buffer.c in named in ISC BIND 9.x before 9.9.7-P3 and 9.10.x before 9.10.2-P4 allows remote attackers to cause a denial of service (assertion failure and daemon exit) by creating a zone containing a malformed DNSSEC key and issuing a query for a name in that zone.
Near-miss passage: CVE-2015-0601. CWE: CWE-20. CVSS: 4.599999904632568. Cisco Unified IP 9900 phones with firmware 9.4(.1) and earlier allow local users to cause a denial of service (device reload) via crafted commands, aka Bug ID CSCup92790.
Query: Sigma rule for Detects the download of a file with a potentially suspicious extension from a .zip top level domain.
Matching passage: Sigma rule: Detects the download of a file with a potentially suspicious extension from a .zip top level domain.. Logsource: windows / create_stream_hash. Rule: title: Potentially Suspicious File Download From ZIP TLD id: 0bb4bbeb-fe52-4044-b40c-430a04577ebe status: test description: Detects the download of a file with a potentially suspicious extension from a .zip top level domain. references: - https://twitter.com/cyb3rops/status/1659175181695287297 - https://fabian-voith.de/2020/06/25/sysmon-v11-1-reads-alternate-data-streams/ author: Florian Roth (Nextron Systems) date: 2023-05-18 tags: - attack.stealth logsource: product: windows category: create_stream_hash detection: selection: Contents|contains: .zip/ TargetFilename|contains: - .bat:Zone - .dat:Zone - .dll:Zone - .doc:Zone - .docm:Zone - .exe:Zone - .hta:Zone - .pptm:Zone - .ps1:Zone - .rar:Zone - .rtf:Zone - .sct:Zone - .vbe:Zone - .vbs:Zone - .ws:Zone - .wsf:Zone - .xll:Zone - .xls:Zone - .xlsm:Zone - .zip:Zone condition: selection falsepositives: - Legitimate file downloads from a websites and web services that uses the ".zip" top level domain. level: high
Near-miss passage: Sigma rule: Detects the abuse of custom file open handler, executing powershell. Logsource: windows / registry_set. Rule: title: Custom File Open Handler Executes PowerShell id: 7530b96f-ad8e-431d-a04d-ac85cc461fdc status: test description: Detects the abuse of custom file open handler, executing powershell references: - https://news.sophos.com/en-us/2022/02/01/solarmarker-campaign-used-novel-registry-changes-to-establish-persistence/?cmp=30728 author: CD_R0M_ date: 2022-06-11 modified: 2023-08-17 tags: - attack.stealth - attack.t1202 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: shell\open\command\ Details|contains|all: - powershell - -command condition: selection falsepositives: - Unknown level: high
Query: detection rule: Detects that network ACL entries have been added to a route table which could indicate that new attack vectors have been
Matching passage: Sigma rule: Detects that network ACL entries have been added to a route table which could indicate that new attack vectors have been. Logsource: aws / cloudtrail. Rule: title: New Network ACL Entry Added id: e1f7febb-7b94-4234-b5c6-00fb8500f5dd status: test description: 'Detects that network ACL entries have been added to a route table which could indicate that new attack vectors have been opened up in the AWS account. ' references: - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/ author: jamesc-grafana date: 2024-07-11 tags: - attack.defense-impairment - attack.t1686.001 logsource: product: aws service: cloudtrail detection: selection: eventSource: ec2.amazonaws.com eventName: CreateNetworkAclEntry condition: selection falsepositives: - Legitimate use of ACLs to enable customer and staff access from the public internet into a public VPC level: low
Near-miss passage: Sigma rule: Detects a Python process initiating a network connection. While this often relates to package installation, it can also. Logsource: windows / network_connection. Rule: title: Python Initiated Connection id: bef0bc5a-b9ae-425d-85c6-7b2d705980c6 status: test description: Detects a Python process initiating a network connection. While this often relates to package installation, it can also indicate a potential malicious script communicating with a C&C server. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md#atomic-test-4---port-scan-using-python - https://pypi.org/project/scapy/ author: frack113 date: 2021-12-10 modified: 2025-03-05 tags: - attack.discovery - attack.t1046 logsource: category: network_connection product: windows definition: 'Requirements: Field enrichment is required for the filters to work. As field such as CommandLine and ParentImage are not available by default on this event type' detection: selection: Initiated: 'true' Image|contains|all: - \python - .exe filter_optional_conda: ParentImage: C:\ProgramData\Anaconda3\Scripts\conda.exe CommandLine|contains|all: - :\ProgramData\Anaconda3\Scripts\conda-script.py - update filter_optional_conda_jupyter_notebook: ParentImage: C:\ProgramData\Anaconda3\python.exe CommandLine|contains: C:\ProgramData\Anaconda3\Scripts\jupyter-notebook-script.py filter_main_local_communication: DestinationIp: 127.0.0.1 SourceIp: 127.0.0.1 filter_main_pip: CommandLine|contains|all: - pip.exe - install condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate python scripts using the socket library or similar will trigger this. Apply additional filters and perform an initial baseline before deploying. level: medium
Query: EDR alert: possible Malicious Link (T1204.001)
Matching passage: T1204.001 Malicious Link. Tactics: execution. Description: An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will typically be observed as follow-on behavior from [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002). Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203). Links may also lead users to download files that require execution via [Malicious File](https://attack.mitre.org/techniques/T1204/002).
Near-miss passage: T1204.004 Malicious Copy and Paste. Tactics: execution. Description: An adversary may rely upon a user copying and pasting code in order to gain execution. Users may be subjected to social engineering to get them to copy and paste code directly into a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059). One such strategy is "ClickFix," in which adversaries present users with seemingly helpful solutions—such as prompts to fix errors or complete CAPTCHAs—that instead instruct the user to copy and paste malicious code. Malicious websites, such as those used in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), may present fake error messages or CAPTCHA prompts that instruct users to open a terminal or the Windows Run Dialog box and execute an arbitrary command. These commands may be obfuscated using encoding or other techniques to conceal malicious intent. Once executed, the adversary will typically be able to establish a foothold on the victim's machine.(Citation: CloudSEK Lumma Stealer 2024)(Citation: Sekoia ClickFake 2025)(Citation: Reliaquest CAPTCHA 2024)(Citation: AhnLab LummaC2 2025) Adversaries may also leverage phishing emails for this purpose. When a user attempts to open an attachment, they may be presented with a fake error and offered a malicious command to paste as a solution, consistent with the "ClickFix" strategy.(Citation: Proofpoint ClickFix 2024)(Citation: AhnLab Malicioys Copy Paste 2024) Tricking a user into executing a command themselves may help to bypass email filtering, browser sandboxing, or other mitigations designed to protect users against malicious downloaded files.
Query: Sigma rule for Detects regsvr32 execution to download and install DLLs located remotely where the address is an IP address.
Matching passage: Sigma rule: Detects regsvr32 execution to download and install DLLs located remotely where the address is an IP address.. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Regsvr32 HTTP IP Pattern id: 2dd2c217-bf68-437a-b57c-fe9fd01d5de8 status: test description: Detects regsvr32 execution to download and install DLLs located remotely where the address is an IP address. references: - https://twitter.com/mrd0x/status/1461041276514623491 - https://twitter.com/tccontre18/status/1480950986650832903 - https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/ author: Florian Roth (Nextron Systems) date: 2022-01-11 modified: 2023-05-24 tags: - attack.stealth - attack.t1218.010 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \regsvr32.exe - OriginalFileName: REGSVR32.EXE selection_ip: CommandLine|contains: - ' /i:http://1' - ' /i:http://2' - ' /i:http://3' - ' /i:http://4' - ' /i:http://5' - ' /i:http://6' - ' /i:http://7' - ' /i:http://8' - ' /i:http://9' - ' /i:https://1' - ' /i:https://2' - ' /i:https://3' - ' /i:https://4' - ' /i:https://5' - ' /i:https://6' - ' /i:https://7' - ' /i:https://8' - ' /i:https://9' - ' -i:http://1' - ' -i:http://2' - ' -i:http://3' - ' -i:http://4' - ' -i:http://5' - ' -i:http://6' - ' -i:http://7' - ' -i:http://8' - ' -i:http://9' - ' -i:https://1' - ' -i:https://2' - ' -i:https://3' - ' -i:https://4' - ' -i:https://5' - ' -i:https://6' - ' -i:https://7' - ' -i:https://8' - ' -i:https://9' condition: all of selection_* falsepositives: - FQDNs that start with a number such as "7-Zip" level: high
Near-miss passage: Sigma rule: Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove model safety controls and allow u. Logsource: aws / cloudtrail. Rule: title: AWS Bedrock Guardrail Deleted id: 59b70e4d-dd17-44a9-b740-acf07ae3eb6a status: experimental description: 'Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove model safety controls and allow unsafe or unauthorized model responses. ' references: - https://docs.aws.amazon.com/bedrock/latest/APIReference/API_DeleteGuardrail.html author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) date: 2026-07-10 tags: - attack.defense-impairment - attack.t1685 logsource: product: aws service: cloudtrail detection: selection: eventName: DeleteGuardrail eventSource: bedrock.amazonaws.com condition: selection falsepositives: - Legitimate guardrail deletion by authorized identities. level: medium
Query: rule covering Detects suspicious usage of the ShellExec_RunDLL function to launch other commands as seen in the the raspberry-robin at
Matching passage: Sigma rule: Detects suspicious usage of the ShellExec_RunDLL function to launch other commands as seen in the the raspberry-robin at. Logsource: windows / process_creation. Rule: title: Suspicious Usage Of ShellExec_RunDLL id: d87bd452-6da1-456e-8155-7dc988157b7d related: - id: 36c5146c-d127-4f85-8e21-01bf62355d5a type: obsolete - id: 8823e85d-31d8-473e-b7f4-92da070f0fc6 type: similar status: test description: Detects suspicious usage of the ShellExec_RunDLL function to launch other commands as seen in the the raspberry-robin attack references: - https://redcanary.com/blog/raspberry-robin/ - https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/ - https://github.com/SigmaHQ/sigma/issues/1009 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-01 modified: 2022-12-30 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_openasrundll: CommandLine|contains: ShellExec_RunDLL selection_suspcli: CommandLine|contains: - \Desktop\ - \Temp\ - \Users\Public\ - comspec - iex - Invoke- - msiexec - odbcconf - regsvr32 condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detect unix shell configuration modification. Adversaries may establish persistence through executing malicious commands. Logsource: linux / auditd. Rule: title: Unix Shell Configuration Modification id: a94cdd87-6c54-4678-a6cc-2814ffe5a13d related: - id: e74e15cc-c4b6-4c80-b7eb-dfe49feb7fe9 type: obsolete status: test description: Detect unix shell configuration modification. Adversaries may establish persistence through executing malicious commands triggered when a new shell is opened. references: - https://objective-see.org/blog/blog_0x68.html - https://web.archive.org/web/20221204161143/https://www.glitch-cat.com/p/green-lambert-and-attack - https://www.anomali.com/blog/pulling-linux-rabbit-rabbot-malware-out-of-a-hat author: Peter Matkovski, IAI date: 2023-03-06 modified: 2023-03-15 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.004 logsource: product: linux service: auditd detection: selection: type: PATH name: - /etc/shells - /etc/profile - /etc/profile.d/* - /etc/bash.bashrc - /etc/bashrc - /etc/zsh/zprofile - /etc/zsh/zshrc - /etc/zsh/zlogin - /etc/zsh/zlogout - /etc/csh.cshrc - /etc/csh.login - /root/.bashrc - /root/.bash_profile - /root/.profile - /root/.zshrc - /root/.zprofile - /home/*/.bashrc - /home/*/.zshrc - /home/*/.bash_profile - /home/*/.zprofile - /home/*/.profile - /home/*/.bash_login - /home/*/.bash_logout - /home/*/.zlogin - /home/*/.zlogout condition: selection falsepositives: - Admin or User activity are expected to generate some false positives level: medium
Query: risk of Adobe Shockwave Player before 12.1.9.159 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerabil
Matching passage: CVE-2015-5121. CWE: CWE-119. CVSS: 10.0. Adobe Shockwave Player before 12.1.9.159 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5120.
Near-miss passage: CVE-2015-2900. CWE: CWE-119. CVSS: 6.800000190734863. The AddUserFinding add_userfinding2 function in Medicomp MEDCIN Engine before 2.22.20153.226 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted packet on port 8190.
Query: describe CVE-2015-7261
Matching passage: CVE-2015-7261. CWE: CWE-255. CVSS: 9.800000190734863. The FTP service in QNAP iArtist Lite before 1.4.54, as distributed with QNAP Signage Station before 2.0.1, has hardcoded credentials, which makes it easier for remote attackers to obtain access via a session on TCP port 21.
Near-miss passage: CVE-2015-4196. CWE: CWE-255. CVSS: 5.0. Platform Software before 4.4.5 in Cisco Unified Communications Domain Manager (CDM) 8.x has a hardcoded password for a privileged account, which allows remote attackers to obtain root access by leveraging knowledge of this password and entering it in an SSH session, aka Bug ID CSCuq45546.
Query: describe CVE-2015-0361
Matching passage: CVE-2015-0361. CWE: UNKNOWN. CVSS: 7.800000190734863. Use-after-free vulnerability in Xen 4.2.x, 4.3.x, and 4.4.x allows remote domains to cause a denial of service (system crash) via a crafted hypercall during HVM guest teardown.
Near-miss passage: CVE-2015-4789. CWE: UNKNOWN. CVSS: 6.900000095367432. Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-2583, CVE-2015-2624, CVE-2015-2626, CVE-2015-2640, CVE-2015-2654, CVE-2015-2656, CVE-2015-4754, CVE-2015-4764, CVE-2015-4775, CVE-2015-4776, CVE-2015-4777, CVE-2015-4778, CVE-2015-4780, CVE-2015-4781, CVE-2015-4782, CVE-2015-4783, CVE-2015-4784, CVE-2015-4785, CVE-2015-4786, CVE-2015-4787, and CVE-2015-4790.
Query: patch priority for CVE-2015-7109
Matching passage: CVE-2015-7109. CWE: CWE-119. CVSS: 9.300000190734863. IOAcceleratorFamily in Apple OS X before 10.11.2 and tvOS before 9.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Near-miss passage: CVE-2015-7113. CWE: CWE-119. CVSS: 10.0. The LaunchServices component in Apple iOS before 9.2 and watchOS before 2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a malformed plist.
Query: risk of The xsave/xrstor implementation in arch/x86/include/asm/xsave.h in the Linux kernel before 3.19.2 creates certain .altinstr_replacement pointers and consequently does not provide a
Matching passage: CVE-2015-2672. CWE: CWE-20. CVSS: 5.5. The xsave/xrstor implementation in arch/x86/include/asm/xsave.h in the Linux kernel before 3.19.2 creates certain .altinstr_replacement pointers and consequently does not provide any protection against instruction faulting, which allows local users to cause a denial of service (panic) by triggering a fault, as demonstrated by an unaligned memory operand or a non-canonical address memory operand.
Near-miss passage: CVE-2015-3803. CWE: CWE-20. CVSS: 7.199999809265137. Apple iOS before 8.4.1 and OS X before 10.10.5 allow local users to bypass a code-signing protection mechanism via a crafted multi-architecture executable file.
Query: write Sigma for Detects password dumper activity by monitoring remote thread creation EventID 8 in combination with the lsass.exe proces
Matching passage: Sigma rule: Detects password dumper activity by monitoring remote thread creation EventID 8 in combination with the lsass.exe proces. Logsource: windows / create_remote_thread. Rule: title: Password Dumper Remote Thread in LSASS id: f239b326-2f41-4d6b-9dfa-c846a60ef505 status: stable description: 'Detects password dumper activity by monitoring remote thread creation EventID 8 in combination with the lsass.exe process as TargetImage. The process in field Process is the malicious program. A single execution can lead to hundreds of events. ' references: - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/WCE.htm author: Thomas Patzke date: 2017-02-19 modified: 2021-06-21 tags: - attack.credential-access - attack.s0005 - attack.t1003.001 logsource: product: windows category: create_remote_thread detection: selection: TargetImage|endswith: \lsass.exe StartModule: '' condition: selection falsepositives: - Antivirus products level: high
Near-miss passage: Sigma rule: Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised ac. Logsource: windows / ps_script. Rule: title: Clearing Windows Console History id: bde47d4b-9987-405c-94c7-b080410e8ea7 status: test description: Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. references: - https://stefanos.cloud/blog/kb/how-to-clear-the-powershell-command-history/ - https://www.shellhacks.com/clear-history-powershell/ - https://community.sophos.com/sophos-labs/b/blog/posts/powershell-command-history-forensics author: Austin Songer @austinsonger date: 2021-11-25 modified: 2022-12-25 tags: - attack.stealth - attack.t1070 - attack.t1070.003 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection1: ScriptBlockText|contains: Clear-History selection2a: ScriptBlockText|contains: - Remove-Item - rm selection2b: ScriptBlockText|contains: - ConsoleHost_history.txt - (Get-PSReadlineOption).HistorySavePath condition: selection1 or selection2a and selection2b falsepositives: - Unknown level: high