alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Detects suspicious DNS error messages that indicate a fatal or suspicious error that could be caused by exploiting attem
Matching passage: Sigma rule: Detects suspicious DNS error messages that indicate a fatal or suspicious error that could be caused by exploiting attem. Logsource: linux / syslog. Rule: title: Suspicious Named Error id: c8e35e96-19ce-4f16-aeb6-fd5588dc5365 status: test description: Detects suspicious DNS error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts references: - https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/named_rules.xml author: Florian Roth (Nextron Systems) date: 2018-02-20 modified: 2022-10-05 tags: - attack.initial-access - attack.t1190 logsource: product: linux service: syslog detection: keywords: - ' dropping source port zero packet from ' - ' denied AXFR from ' - ' exiting (due to fatal error)' condition: keywords falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects potential persistence using Appx DebugPath. Logsource: windows / registry_set. Rule: title: Potential Persistence Using DebugPath id: df4dc653-1029-47ba-8231-3c44238cc0ae status: test description: Detects potential persistence using Appx DebugPath references: - https://oddvar.moe/2018/09/06/persistence-using-universal-windows-platform-apps-appx/ - https://github.com/rootm0s/WinPwnage author: frack113 date: 2022-07-27 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.015 logsource: category: registry_set product: windows detection: selection_debug: TargetObject|contains: Classes\ActivatableClasses\Package\Microsoft. TargetObject|endswith: \DebugPath selection_default: TargetObject|contains: \Software\Microsoft\Windows\CurrentVersion\PackagedAppXDebug\Microsoft. TargetObject|endswith: \(Default) condition: 1 of selection_* falsepositives: - Unknown level: medium
Query: CVE similar to CVE-2015-0543
Matching passage: CVE-2015-0543. CWE: CWE-20. CVSS: 5.800000190734863. EMC Secure Remote Services Virtual Edition (ESRS VE) 3.x before 3.06 does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Near-miss passage: CVE-2015-9051. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in LTE where an assertion can be reached due to an improper bound on a length in a System Information message.
Query: vulnerability: Use-after-free vulnerability in Open Litespeed before 1.3.10.
Matching passage: CVE-2015-3890. CWE: CWE-416. CVSS: 7.5. Use-after-free vulnerability in Open Litespeed before 1.3.10.
Near-miss passage: CVE-2015-8822. CWE: CWE-416. CVSS: 8.800000190734863. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via crafted MPEG-4 data, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, CVE-2015-8454, CVE-2015-8653, CVE-2015-8655, and CVE-2015-8821.
Query: vulnerability: Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Ex
Matching passage: CVE-2015-1694. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1710.
Near-miss passage: CVE-2015-8072. CWE: CWE-119. CVSS: 10.0. mediaserver in Android 4.4 through 5.x before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23881715, a different vulnerability than CVE-2015-6608 and CVE-2015-8073.
Query: detection rule: Detects the use of wget to download content to a suspicious directory
Matching passage: Sigma rule: Detects the use of wget to download content to a suspicious directory. Logsource: linux / process_creation. Rule: title: Download File To Potentially Suspicious Directory Via Wget id: cf610c15-ed71-46e1-bdf8-2bd1a99de6c4 status: test description: Detects the use of wget to download content to a suspicious directory references: - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/ - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-06-02 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: /wget selection_output: - CommandLine|re: \s-O\s - CommandLine|contains: --output-document selection_path: CommandLine|contains: /tmp/ condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects risky authentication from a non AD registered device without MFA being required.. Logsource: azure / signinlogs. Rule: title: Suspicious SignIns From A Non Registered Device id: 572b12d4-9062-11ed-a1eb-0242ac120002 status: test description: Detects risky authentication from a non AD registered device without MFA being required. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#non-compliant-device-sign-in author: Harjot Singh, '@cyb3rjy0t' date: 2023-01-10 modified: 2025-07-02 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078 logsource: product: azure service: signinlogs detection: selection_main: Status: Success AuthenticationRequirement: singleFactorAuthentication RiskState: atRisk selection_empty1: DeviceDetail.trusttype: '' selection_empty2: DeviceDetail.trusttype: null condition: selection_main and 1 of selection_empty* falsepositives: - Unknown level: high
Query: rule covering Detects XML parsing issues, if the application expects to work with XML make sure that the parser is initialized safely.
Matching passage: Sigma rule: Detects XML parsing issues, if the application expects to work with XML make sure that the parser is initialized safely.. Logsource: jvm / application. Rule: title: Potential XXE Exploitation Attempt In JVM Based Application id: c4e06896-e27c-4583-95ac-91ce2279345d status: test description: Detects XML parsing issues, if the application expects to work with XML make sure that the parser is initialized safely. references: - https://rules.sonarsource.com/java/RSPEC-2755 - https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs author: Moti Harmats date: 2023-02-11 tags: - attack.initial-access - attack.t1190 logsource: category: application product: jvm definition: 'Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)' detection: keywords: - SAXParseException - DOMException condition: keywords falsepositives: - If the application expects to work with XML there may be parsing issues that don't necessarily mean XXE. level: high
Near-miss passage: Sigma rule: Detects when an a role is modified or deleted in Google Workspace.. Logsource: gcp / google_workspace.admin. Rule: title: Google Workspace Role Modified or Deleted id: 6aef64e3-60c6-4782-8db3-8448759c714e status: test description: Detects when an a role is modified or deleted in Google Workspace. references: - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3 - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-delegated-admin-settings author: Austin Songer date: 2021-08-24 modified: 2023-10-11 tags: - attack.impact logsource: product: gcp service: google_workspace.admin detection: selection: eventService: admin.googleapis.com eventName: - DELETE_ROLE - RENAME_ROLE - UPDATE_ROLE condition: selection falsepositives: - Unknown level: medium
Query: Sigma YAML for linux / process_creation
Matching passage: Sigma rule: Detects the use of the "git" utility to execute a shell. Such behavior may be associated with privilege escalation, unau. Logsource: linux / process_creation. Rule: title: Shell Execution via Git - Linux id: 47b3bbd4-1bf7-48cc-84ab-995362aaa75a status: test description: 'Detects the use of the "git" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments. ' references: - https://gtfobins.github.io/gtfobins/git/#shell author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) date: 2024-09-02 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: linux detection: selection: ParentImage|endswith: /git ParentCommandLine|contains|all: - ' -p ' - help CommandLine|contains: - bash 0<&1 - dash 0<&1 - sh 0<&1 condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution GMER tool based on image and hash fields.. Logsource: windows / process_creation. Rule: title: HackTool - GMER Rootkit Detector and Remover Execution id: 9082ff1f-88ab-4678-a3cc-5bcff99fc74d status: test description: Detects the execution GMER tool based on image and hash fields. references: - http://www.gmer.net/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-05 modified: 2024-11-23 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \gmer.exe selection_sysmon_hash: Hashes|contains: - MD5=E9DC058440D321AA17D0600B3CA0AB04 - SHA1=539C228B6B332F5AA523E5CE358C16647D8BBE57 - SHA256=E8A3E804A96C716A3E9B69195DB6FFB0D33E2433AF871E4D4E1EAB3097237173 condition: 1 of selection_* falsepositives: - Unlikely level: high
Query: EDR alert: possible Rootkit (T1014)
Matching passage: T1014 Rootkit. Tactics: stealth. Description: Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information. (Citation: Symantec Windows Rootkits) Rootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, to include a hypervisor or [System Firmware](https://attack.mitre.org/techniques/T1542/001). (Citation: Wikipedia Rootkit) Rootkits have been seen for Windows, Linux, and Mac OS X systems. (Citation: CrowdStrike Linux Rootkit) (Citation: BlackHat Mac OSX Rootkit) Rootkits that reside or modify boot sectors are known as [Bootkit](https://attack.mitre.org/techniques/T1542/003)s and specifically target the boot process of the operating system.
Near-miss passage: T1197 BITS Jobs. Tactics: stealth, persistence, execution. Description: Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks. Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM).(Citation: Microsoft COM)(Citation: Microsoft BITS) BITS is commonly used by updaters, messengers, and other applications preferred to operate in the background (using available idle bandwidth) without interrupting other networked applications. File transfer tasks are implemented as BITS jobs, which contain a queue of one or more file operations. The interface to create and manage BITS jobs is accessible through [PowerShell](https://attack.mitre.org/techniques/T1059/001) and the [BITSAdmin](https://attack.mitre.org/software/S0190) tool.(Citation: Microsoft BITS)(Citation: Microsoft BITSAdmin) Adversaries may abuse BITS to download (e.g. [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)), execute, and even clean up after running malicious code (e.g. [Indicator Removal](https://attack.mitre.org/techniques/T1070)). BITS tasks are self-contained in the BITS job database, without new files or registry modifications, and often permitted by host firewalls.(Citation: CTU BITS Malware June 2016)(Citation: Mondok Windows PiggyBack BITS May 2007)(Citation: Symantec BITS May 2007) BITS enabled execution may also enable persistence by creating long-standing jobs (the default maximum lifetime is 90 days and extendable) or invoking an arbitrary program when a job completes or errors (including after system reboots).(Citation: PaloAlto UBoatRAT Nov 2017)(Citation: CTU BITS Malware June 2016) BITS upload functionalities can also be used to perform [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048).(Citation: CTU BITS Malware June 2016)
Query: describe CVE-2015-8985
Matching passage: CVE-2015-8985. CWE: CWE-19. CVSS: 5.900000095367432. The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a denial of service (assertion failure and application crash) via vectors related to extended regular expression processing.
Near-miss passage: CVE-2015-8952. CWE: CWE-19. CVSS: 5.5. The mbcache feature in the ext2 and ext4 filesystem implementations in the Linux kernel before 4.6 mishandles xattr block caching, which allows local users to cause a denial of service (soft lockup) via filesystem operations in environments that use many attributes, as demonstrated by Ceph and Samba.
Query: risk of Buffer overflow in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arb
Matching passage: CVE-2015-0348. CWE: CWE-119. CVSS: 10.0. Buffer overflow in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-4142. CWE: CWE-119. CVSS: 4.300000190734863. Integer underflow in the WMM Action frame parser in hostapd 0.5.5 through 2.4 and wpa_supplicant 0.7.0 through 2.4, when used for AP mode MLME/SME functionality, allows remote attackers to cause a denial of service (crash) via a crafted frame, which triggers an out-of-bounds read.
Query: describe CVE-2015-4697
Matching passage: CVE-2015-4697. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in Google Analyticator Wordpress Plugin before 6.4.9.3 rev @1183563.
Near-miss passage: CVE-2015-4350. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the Spider Catalog module for Drupal allow remote attackers to hijack the authentication of administrators for requests that delete (1) products, (2) ratings, or (3) categories via unspecified vectors.
Query: vulnerability: The UC Profile module 6.x-1.x before 6.x-1.3 for Drupal does not properly check access to profiles in certain circumstances, which might allow remote attackers to obtain sensitive 
Matching passage: CVE-2015-8232. CWE: CWE-200. CVSS: 4.300000190734863. The UC Profile module 6.x-1.x before 6.x-1.3 for Drupal does not properly check access to profiles in certain circumstances, which might allow remote attackers to obtain sensitive information from the anonymous user profile via unspecified vectors.
Near-miss passage: CVE-2015-1000007. CWE: CWE-200. CVSS: 7.5. Remote file download vulnerability in wptf-image-gallery v1.03
Query: vulnerability: IBM WebSphere Portal 8.0.0.1 before CF19 and 8.5.0 before CF09 allows remote attackers to cause a denial of service (memory consumption) via crafted requests.
Matching passage: CVE-2015-7419. CWE: CWE-399. CVSS: 7.800000190734863. IBM WebSphere Portal 8.0.0.1 before CF19 and 8.5.0 before CF09 allows remote attackers to cause a denial of service (memory consumption) via crafted requests.
Near-miss passage: CVE-2015-2338. CWE: CWE-399. CVSS: 6.099999904632568. TPview.dll in VMware Workstation 10.x before 10.0.6 and 11.x before 11.1.1, VMware Player 6.x before 6.0.6 and 7.x before 7.1.1, and VMware Horizon Client 3.2.x before 3.2.1, 3.3.x, and 5.x local-mode before 5.4.2 on Windows does not properly allocate memory, which allows guest OS users to cause a host OS denial of service via unspecified vectors, a different vulnerability than CVE-2015-2339.
Query: exploit XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause
Matching passage: CVE-2015-0250. CWE: UNKNOWN. CVSS: 6.400000095367432. XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.
Near-miss passage: CVE-2015-0417. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Portal Framework, a different vulnerability than CVE-2015-0388.
Query: vulnerability: Multiple untrusted search path vulnerabilities in updater.exe in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 on Windows, when the Mainten
Matching passage: CVE-2015-0833. CWE: UNKNOWN. CVSS: 6.900000095367432. Multiple untrusted search path vulnerabilities in updater.exe in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 on Windows, when the Maintenance Service is not used, allow local users to gain privileges via a Trojan horse DLL in (1) the current working directory or (2) a temporary directory, as demonstrated by bcrypt.dll.
Near-miss passage: CVE-2015-8068. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: patch priority for CVE-2015-8799
Matching passage: CVE-2015-8799. CWE: CWE-22. CVSS: 7.599999904632568. Directory traversal vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedded Security: Critical System Protection for Controllers and Devices (SES:CSP) 6.5.0 before MP1, Critical System Protection (SCSP) before 5.2.9 MP6, Data Center Security: Server Advanced Server (DCS:SA) 6.x before 6.5 MP1 and 6.6 before MP1, and Data Center Security: Server Advanced Server and Agents (DCS:SA) through 6.6 MP1 allows remote authenticated users to write update-package data to arbitrary agent locations via unspecified vectors.
Near-miss passage: CVE-2015-3297. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.1 through 1.5.2 allows remote attackers to read arbitrary files by leveraging replacement of backslashes with slashes in the path parameter of HTTP API requests.
Query: vulnerability: The SharedObject object implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR b
Matching passage: CVE-2015-8439. CWE: UNKNOWN. CVSS: 9.300000190734863. The SharedObject object implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code by leveraging an unspecified "type confusion" during a getRemote call, a different vulnerability than CVE-2015-8456.
Near-miss passage: CVE-2015-0471. CWE: UNKNOWN. CVSS: 4.400000095367432. Unspecified vulnerability in Oracle Sun Solaris 10 and 11.2 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to libelfsign.
Query: describe CVE-2015-0821
Matching passage: CVE-2015-0821. CWE: CWE-264. CVSS: 6.800000190734863. Mozilla Firefox before 36.0 allows user-assisted remote attackers to read arbitrary files or execute arbitrary JavaScript code with chrome privileges via a crafted web site that is accessed with unspecified mouse and keyboard actions.
Near-miss passage: CVE-2015-8940. CWE: CWE-264. CVSS: 7.800000190734863. Integer overflow in sound/soc/msm/qdsp6v2/q6lsm.c in the Qualcomm components in Android before 2016-08-05 on Nexus 6 devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28813987 and Qualcomm internal bug CR792367.