alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit A vulnerability was found in Custom-Content-Width 1.0. It has been declared as problematic. Affected by this vulnerability is the function override_content_width/register_settings 
Matching passage: CVE-2015-10075. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability was found in Custom-Content-Width 1.0. It has been declared as problematic. Affected by this vulnerability is the function override_content_width/register_settings of the file custom-content-width.php. The manipulation leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.1 is able to address this issue. The patch is named e05e0104fc42ad13b57e2b2cb2d1857432624d39. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220219. NOTE: This attack is not very likely.
Near-miss passage: CVE-2015-9303. CWE: CWE-79. CVSS: 6.099999904632568. The simple-share-buttons-adder plugin before 6.0.0 for WordPress has XSS.
Query: CWE for Policy Privileges are not Assigned Consistently Between Control and Data Agents
Matching passage: CWE-1268 Policy Privileges are not Assigned Consistently Between Control and Data Agents. The product's hardware-enforced access control for a particular resource improperly accounts for privilege discrepancies between control and write policies.
Near-miss passage: CWE-219 Storage of File with Sensitive Data Under Web Root. The product stores sensitive data under the web document root with insufficient access control, which might make it accessible to untrusted parties.
Query: alert when Detects the pattern of a pipe name as used by the hack tool CoercedPotato
Matching passage: Sigma rule: Detects the pattern of a pipe name as used by the hack tool CoercedPotato. Logsource: windows / pipe_created. Rule: title: HackTool - CoercedPotato Named Pipe Creation id: 4d0083b3-580b-40da-9bba-626c19fe4033 status: test description: Detects the pattern of a pipe name as used by the hack tool CoercedPotato references: - https://blog.hackvens.fr/articles/CoercedPotato.html - https://github.com/hackvens/CoercedPotato author: Florian Roth (Nextron Systems) date: 2023-10-11 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: product: windows category: pipe_created definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection: PipeName|contains: \coerced\ condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Well-known TAP software installation. Possible preparation for data exfiltration using tunnelling techniques. Logsource: windows / system. Rule: title: Tap Driver Installation id: 8e4cf0e5-aa5d-4dc3-beff-dc26917744a9 status: test description: Well-known TAP software installation. Possible preparation for data exfiltration using tunnelling techniques references: - https://community.openvpn.net/openvpn/wiki/ManagingWindowsTAPDrivers author: Daniil Yugoslavskiy, Ian Davis, oscd.community date: 2019-10-24 modified: 2022-12-25 tags: - attack.exfiltration - attack.t1048 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ImagePath|contains: tap0901 condition: selection falsepositives: - Legitimate OpenVPN TAP installation level: medium
Query: explain CWE-543
Matching passage: CWE-543 Use of Singleton Pattern Without Synchronization in a Multithreaded Context. The product uses the singleton pattern when creating a resource within a multithreaded environment.
Near-miss passage: CWE-512 Spyware. The product collects personally identifiable information about a human user or the user's activities, but the product accesses this information using other resources besides itself, and it does not require that user's explicit approval or direct input into the product.
Query: vulnerability: lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service (inco
Matching passage: CVE-2015-2695. CWE: CWE-763. CVSS: 5.0. lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service (incorrect pointer read and process crash) via a crafted SPNEGO packet that is mishandled during a gss_inquire_context call.
Near-miss passage: CVE-2015-3769. CWE: CWE-119. CVSS: 7.199999809265137. IOFireWireFamily in Apple OS X before 10.10.5 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3771 and CVE-2015-3772.
Query: Sigma rule for Detects execution of the Kaspersky init.d stop script on Linux systems either directly or via systemctl. This activity m
Matching passage: Sigma rule: Detects execution of the Kaspersky init.d stop script on Linux systems either directly or via systemctl. This activity m. Logsource: linux / process_creation. Rule: title: Kaspersky Endpoint Security Stopped Via CommandLine - Linux id: 36388120-b3f1-4ce9-b50b-280d9a7f4c04 status: experimental description: 'Detects execution of the Kaspersky init.d stop script on Linux systems either directly or via systemctl. This activity may indicate a manual interruption of the antivirus service by an administrator, or it could be a sign of potential tampering or evasion attempts by malicious actors. ' references: - https://support.kaspersky.com/KES4Linux/12.0.0/en-US/197929.htm author: Milad Cheraghi date: 2025-10-18 tags: - attack.execution - attack.defense-impairment - attack.t1685 logsource: product: linux category: process_creation detection: selection: Image|endswith: - /systemctl - /bash - /sh CommandLine|contains|all: - stop - kesl condition: selection falsepositives: - System administrator manually stopping Kaspersky services level: high
Near-miss passage: Sigma rule: Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons. Logsource: windows / dns_query. Rule: title: Suspicious Cobalt Strike DNS Beaconing - Sysmon id: f356a9c4-effd-4608-bbf8-408afd5cd006 related: - id: 0d18728b-f5bf-4381-9dcf-915539fff6c2 type: similar status: test description: Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons references: - https://www.icebrg.io/blog/footprints-of-fin7-tracking-actor-patterns - https://www.sekoia.io/en/hunting-and-detecting-cobalt-strike/ author: Florian Roth (Nextron Systems) date: 2021-11-09 modified: 2023-01-16 tags: - attack.command-and-control - attack.t1071.004 logsource: product: windows category: dns_query detection: selection1: QueryName|startswith: - aaa.stage. - post.1 selection2: QueryName|contains: .stage.123456. condition: 1 of selection* falsepositives: - Unknown level: critical
Query: exploit The WebRTC subsystem in Mozilla Firefox before 36.0 recognizes turns: and stuns: URIs but accesses the TURN or STUN server without using TLS, which makes it easier for man-in-the-m
Matching passage: CVE-2015-0834. CWE: CWE-200. CVSS: 4.300000190734863. The WebRTC subsystem in Mozilla Firefox before 36.0 recognizes turns: and stuns: URIs but accesses the TURN or STUN server without using TLS, which makes it easier for man-in-the-middle attackers to discover credentials by spoofing a server and completing a brute-force attack within a short time window.
Near-miss passage: CVE-2015-5859. CWE: CWE-200. CVSS: 4.300000190734863. The CFNetwork HTTPProtocol component in Apple iOS before 9 and OS X before 10.11 does not properly recognize the HSTS preload list during a Safari private-browsing session, which makes it easier for remote attackers to obtain sensitive information by sniffing the network.
Query: alert when Detects scheduled task creation using "schtasks" that contain potentially suspicious or uncommon commands
Matching passage: Sigma rule: Detects scheduled task creation using "schtasks" that contain potentially suspicious or uncommon commands. Logsource: windows / process_creation. Rule: title: Suspicious Command Patterns In Scheduled Task Creation id: f2c64357-b1d2-41b7-849f-34d2682c0fad status: test description: Detects scheduled task creation using "schtasks" that contain potentially suspicious or uncommon commands references: - https://app.any.run/tasks/512c1352-6380-4436-b27d-bb62f0c020d6/ - https://twitter.com/RedDrip7/status/1506480588827467785 - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/devil-bait/NCSC-MAR-Devil-Bait.pdf author: Florian Roth (Nextron Systems) date: 2022-02-23 modified: 2024-03-19 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1053.005 logsource: product: windows category: process_creation detection: selection_schtasks: Image|endswith: \schtasks.exe CommandLine|contains: '/Create ' selection_pattern_1: CommandLine|contains: - '/sc minute ' - '/ru system ' selection_pattern_2: CommandLine|contains: - cmd /c - cmd /k - cmd /r - 'cmd.exe /c ' - 'cmd.exe /k ' - 'cmd.exe /r ' selection_uncommon: CommandLine|contains: - ' -decode ' - ' -enc ' - ' -w hidden ' - ' bypass ' - ' IEX' - .DownloadData - .DownloadFile - .DownloadString - '/c start /min ' - FromBase64String - mshta http - mshta.exe http selection_anomaly_1: CommandLine|contains: - :\ProgramData\ - :\Temp\ - :\Tmp\ - :\Users\Public\ - :\Windows\Temp\ - \AppData\ - '%AppData%' - '%Temp%' - '%tmp%' selection_anomaly_2: CommandLine|contains: - cscript - curl - wscript condition: selection_schtasks and ( all of selection_pattern_* or selection_uncommon or all of selection_anomaly_* ) falsepositives: - Software installers that run from temporary folders and also install scheduled tasks are expected to generate some false positives level: high
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via RUNDLL LAUNCHER. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell id: e6cb92b4-b470-4eb8-8a9d-d63e8583aae0 status: test description: Detects Obfuscated Powershell via RUNDLL LAUNCHER references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Timur Zinniatullin, oscd.community date: 2020-10-18 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_4104: ScriptBlockText|contains|all: - rundll32.exe - shell32.dll - shellexec_rundll - powershell condition: selection_4104 falsepositives: - Unknown level: medium
Query: campaign using Web Shell
Matching passage: T1505.003 Web Shell. Tactics: persistence. Description: Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.(Citation: volexity_0day_sophos_FW) In addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (e.g. [China Chopper](https://attack.mitre.org/software/S0020) Web shell client).(Citation: Lee 2013)
Near-miss passage: T1505 Server Software Component. Tactics: persistence. Description: Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application. Adversaries may install malicious components to extend and abuse server applications.(Citation: volexity_0day_sophos_FW)
Query: SOC alert related to Multiband Communication
Matching passage: T1026 Multiband Communication. Tactics: command and control. Description: **This technique has been deprecated and should no longer be used.** Some adversaries may split communications between different protocols. There could be one protocol for inbound command and control and another for outbound data, allowing it to bypass certain firewall restrictions. The split could also be random to simply avoid data threshold alerts on any one communication.
Near-miss passage: T1219.002 Remote Desktop Software. Tactics: command and control. Description: An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks. Desktop support software provides a graphical interface for remotely controlling another computer, transmitting the display output, keyboard input, and mouse control between devices using various protocols. Desktop support software, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy) Remote access modules/features may also exist as part of otherwise existing software such as Zoom or Google Chrome’s Remote Desktop.(Citation: Google Chrome Remote Desktop)(Citation: Chrome Remote Desktop)
Query: risk of Incomplete blacklist vulnerability in the FileUploadsFilter class in protected/components/filters/FileUploadsFilter.php in X2Engine X2CRM before 5.0.9 allows remote authenticated u
Matching passage: CVE-2015-5074. CWE: CWE-20. CVSS: 7.5. Incomplete blacklist vulnerability in the FileUploadsFilter class in protected/components/filters/FileUploadsFilter.php in X2Engine X2CRM before 5.0.9 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a .pht extension.
Near-miss passage: CVE-2015-8734. CWE: CWE-20. CVSS: 5.5. The dissect_nwp function in epan/dissectors/packet-nwp.c in the NWP dissector in Wireshark 2.0.x before 2.0.1 mishandles the packet type, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Query: Sigma YAML for windows / registry_set
Matching passage: Sigma rule: Detects tampering with EventLog service "file" key. In order to change the default location of an Evtx file. This techni. Logsource: windows / registry_set. Rule: title: Potential EventLog File Location Tampering id: 0cb8d736-995d-4ce7-a31e-1e8d452a1459 status: test description: Detects tampering with EventLog service "file" key. In order to change the default location of an Evtx file. This technique is used to tamper with log collection and alerting references: - https://learn.microsoft.com/en-us/windows/win32/eventlog/eventlog-key author: D3F7A5105 date: 2023-01-02 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \SYSTEM\CurrentControlSet\Services\EventLog\ TargetObject|endswith: \File filter: Details|contains: \System32\Winevt\Logs\ condition: selection and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects potential exfiltration attempt via audio file using PowerShell. Logsource: windows / ps_script. Rule: title: Potential Data Exfiltration Via Audio File id: e4f93c99-396f-47c8-bb0f-201b1fa69034 status: test description: Detects potential exfiltration attempt via audio file using PowerShell references: - https://github.com/gtworek/PSBits/blob/e97cbbb173b31cbc4d37244d3412de0a114dacfb/NoDLP/bin2wav.ps1 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-16 tags: - attack.exfiltration logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_main: ScriptBlockText|contains|all: - '[System.Math]::' - '[IO.FileMode]::' - BinaryWriter selection_header_wav: ScriptBlockText|contains|all: - '0x52' - '0x49' - '0x46' - '0x57' - '0x41' - '0x56' - '0x45' - '0xAC' condition: selection_main and 1 of selection_header_* falsepositives: - Unknown level: medium
Query: describe CVE-2015-6038
Matching passage: CVE-2015-6038. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Office Compatibility Pack SP3, Excel Viewer, and Excel Services on SharePoint Server 2007 SP3, 2010 SP2, and 2013 SP1 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-3144. CWE: CWE-119. CVSS: 9.0. The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name, as demonstrated by "http://:80" and ":80."
Query: alert when Detects the usage of tooling to sniff network traffic. An adversary may place a network interface into promiscuous mode
Matching passage: Sigma rule: Detects the usage of tooling to sniff network traffic. An adversary may place a network interface into promiscuous mode. Logsource: macos / process_creation. Rule: title: Network Sniffing - MacOs id: adc9bcc4-c39c-4f6b-a711-1884017bf043 status: test description: 'Detects the usage of tooling to sniff network traffic. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1040/T1040.md author: Alejandro Ortuno, oscd.community date: 2020-10-14 modified: 2022-11-26 tags: - attack.discovery - attack.credential-access - attack.t1040 logsource: category: process_creation product: macos detection: selection: Image|endswith: - /tcpdump - /tshark condition: selection falsepositives: - Legitimate administration activities level: informational
Near-miss passage: Sigma rule: Detects UAC bypass method using Windows event viewer. Logsource: windows / registry_set. Rule: title: UAC Bypass via Event Viewer id: 7c81fec3-1c1d-43b0-996a-46753041b1b6 status: test description: Detects UAC bypass method using Windows event viewer references: - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/ - https://www.hybrid-analysis.com/sample/e122bc8bf291f15cab182a5d2d27b8db1e7019e4e96bb5cdbd1dfe7446f3f51f?environmentId=100 author: Florian Roth (Nextron Systems) date: 2017-03-19 modified: 2023-09-28 tags: - attack.privilege-escalation - attack.t1548.002 - car.2019-04-001 logsource: product: windows category: registry_set detection: selection: TargetObject|endswith: \mscfile\shell\open\command condition: selection falsepositives: - Unknown level: high
Query: alert when Identifies the creation of local users via the net.exe command.
Matching passage: Sigma rule: Identifies the creation of local users via the net.exe command.. Logsource: windows / process_creation. Rule: title: New User Created Via Net.EXE id: cd219ff3-fa99-45d4-8380-a7d15116c6dc related: - id: b9f0e6f5-09b4-4358-bae4-08408705bd5c type: similar status: test description: Identifies the creation of local users via the net.exe command. references: - https://eqllib.readthedocs.io/en/latest/analytics/014c3f51-89c6-40f1-ac9c-5688f26090ab.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1136.001/T1136.001.md author: Endgame, JHasenbusch (adapted to Sigma for oscd.community) date: 2018-10-30 modified: 2023-02-21 tags: - attack.persistence - attack.t1136.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \net.exe - \net1.exe - OriginalFileName: - net.exe - net1.exe selection_cli: CommandLine|contains|all: - user - add condition: all of selection_* falsepositives: - Legitimate user creation. - Better use event IDs for user creation rather than command line rules. level: medium
Near-miss passage: Sigma rule: Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policie. Logsource: m365 / audit. Rule: title: Azure Login Bypassing Conditional Access Policies id: 13f2d3f5-6497-44a7-bf5f-dc13ffafe5dc status: experimental description: 'Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith. ' author: Josh Nickels, Marius Rothenbücher references: - https://labs.jumpsec.com/tokensmith-bypassing-intune-compliant-device-conditional-access/ - https://github.com/JumpsecLabs/TokenSmith date: 2025-01-08 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078 logsource: service: audit product: m365 detection: selection: Operation: UserLoggedIn ApplicationId: 9ba1a5c7-f17a-4de9-a1f1-6178c8d51223 ResultStatus: Success RequestType: Cmsi:Cmsi filter_main_bjectid: ObjectId: 0000000a-0000-0000-c000-000000000000 condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high