alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: patch priority for CVE-2015-8455
Matching passage: CVE-2015-8455. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, and CVE-2015-8451.
Near-miss passage: CVE-2015-6159. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6140, CVE-2015-6142, CVE-2015-6143, CVE-2015-6153, CVE-2015-6158, and CVE-2015-6160.
Query: alert when Detects creation of the PSEXEC key file. Which is created anytime a PsExec command is executed. It gets written to the f
Matching passage: Sigma rule: Detects creation of the PSEXEC key file. Which is created anytime a PsExec command is executed. It gets written to the f. Logsource: windows / file_event. Rule: title: PSEXEC Remote Execution File Artefact id: 304afd73-55a5-4bb9-8c21-0b1fc84ea9e4 status: test description: Detects creation of the PSEXEC key file. Which is created anytime a PsExec command is executed. It gets written to the file system and will be recorded in the USN Journal on the target system references: - https://aboutdfir.com/the-key-to-identify-psexec/ - https://twitter.com/davisrichardg/status/1616518800584704028 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-21 modified: 2023-02-23 tags: - attack.lateral-movement - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1136.002 - attack.t1543.003 - attack.t1570 - attack.s0029 logsource: category: file_event product: windows detection: selection: TargetFilename|startswith: C:\Windows\PSEXEC- TargetFilename|endswith: .key condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects suspicious use of command-line tools such as curl or wget to download remote content - particularly scripts - in. Logsource: linux / process_creation. Rule: title: Suspicious Download and Execute Pattern via Curl/Wget id: a2d9e2f3-0f43-4c7a-bcd9-9acfc0d723aa status: experimental description: 'Detects suspicious use of command-line tools such as curl or wget to download remote content - particularly scripts - into temporary directories (e.g., /dev/shm, /tmp), followed by immediate execution, indicating potential malicious activity. This pattern is commonly used by malicious scripts, stagers, or downloaders in fileless or multi-stage Linux attacks. ' references: - https://gtfobins.github.io/gtfobins/wget/ - https://gtfobins.github.io/gtfobins/curl/ author: Aayush Gupta date: 2025-06-17 tags: - attack.execution - attack.t1059.004 - attack.t1203 logsource: category: process_creation product: linux detection: selection_downloader: CommandLine|contains: - /curl - /wget selection_tmp: CommandLine|contains: - /tmp/ - /dev/shm/ selection_executor: CommandLine|contains: sh -c condition: all of selection_* falsepositives: - System update scripts using temporary files - Installer scripts or automated provisioning tools level: high
Query: write Sigma for Detects Obfuscated use of Environment Variables to execute PowerShell
Matching passage: Sigma rule: Detects Obfuscated use of Environment Variables to execute PowerShell. Logsource: windows / process_creation. Rule: title: Invoke-Obfuscation VAR+ Launcher id: 27aec9c9-dbb0-4939-8422-1742242471d0 status: test description: Detects Obfuscated use of Environment Variables to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-15 modified: 2024-04-15 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: CommandLine|re: cmd.{0,5}(?:/c|/r)(?:\s|)\"set\s[a-zA-Z]{3,6}.*(?:\{\d\}){1,}\\\"\s+?\-f(?:.*\)){1,}.*\" condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a suspicious Microsoft desktopimgdownldr file creation that stores a file to a suspicious location or contains a. Logsource: windows / file_event. Rule: title: Suspicious Desktopimgdownldr Target File id: fc4f4817-0c53-4683-a4ee-b17a64bc1039 status: test description: Detects a suspicious Microsoft desktopimgdownldr file creation that stores a file to a suspicious location or contains a file with a suspicious extension references: - https://labs.sentinelone.com/living-off-windows-land-a-new-native-file-downldr/ - https://twitter.com/SBousseaden/status/1278977301745741825 author: Florian Roth (Nextron Systems) date: 2020-07-03 modified: 2022-06-02 tags: - attack.command-and-control - attack.t1105 logsource: product: windows category: file_event detection: selection: Image|endswith: \svchost.exe TargetFilename|contains: \Personalization\LockScreenImage\ filter1: TargetFilename|contains: C:\Windows\ filter2: TargetFilename|contains: - .jpg - .jpeg - .png condition: selection and not filter1 and not filter2 falsepositives: - False positives depend on scripts and administrative tools used in the monitored environment level: high
Query: rule covering Potential adversaries accessing the microphone and webcam in an endpoint.
Matching passage: Sigma rule: Potential adversaries accessing the microphone and webcam in an endpoint.. Logsource: windows / security. Rule: title: Processes Accessing the Microphone and Webcam id: 8cd538a4-62d5-4e83-810b-12d41e428d6e status: test description: Potential adversaries accessing the microphone and webcam in an endpoint. references: - https://twitter.com/duzvik/status/1269671601852813320 - https://medium.com/@7a616368/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-06-07 modified: 2021-11-27 tags: - attack.collection - attack.t1123 logsource: product: windows service: security detection: selection: EventID: - 4657 - 4656 - 4663 ObjectName|contains: - \SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone\NonPackaged - \SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam\NonPackaged condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects DNS queries for subdomains related to MEGA sharing website. Logsource: windows / dns_query. Rule: title: DNS Query To MEGA Hosting Website id: 613c03ba-0779-4a53-8a1f-47f914a4ded3 related: - id: 66474410-b883-415f-9f8d-75345a0a66a6 type: similar status: test description: Detects DNS queries for subdomains related to MEGA sharing website references: - https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/ author: Aaron Greetham (@beardofbinary) - NCC Group date: 2021-05-26 modified: 2023-09-18 tags: - attack.exfiltration - attack.t1567.002 logsource: product: windows category: dns_query detection: selection: QueryName|contains: userstorage.mega.co.nz condition: selection falsepositives: - Legitimate DNS queries and usage of Mega level: medium
Query: common weakness: User Interface (UI) Misrepresentation of Critical Information
Matching passage: CWE-451 User Interface (UI) Misrepresentation of Critical Information. The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.
Near-miss passage: CWE-384 Session Fixation. Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
Query: describe CVE-2015-8277
Matching passage: CVE-2015-8277. CWE: CWE-119. CVSS: 9.800000190734863. Multiple buffer overflows in (1) lmgrd and (2) Vendor Daemon in Flexera FlexNet Publisher before 11.13.1.2 Security Update 1 allow remote attackers to execute arbitrary code via a crafted packet with opcode (a) 0x107 or (b) 0x10a.
Near-miss passage: CVE-2015-3746. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Query: vulnerability: In all Qualcomm products with Android releases from CAF using the Linux kernel, an incorrect length is used to clear a memory buffer resulting in adjacent memory getting corrupted.
Matching passage: CVE-2015-9036. CWE: CWE-119. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, an incorrect length is used to clear a memory buffer resulting in adjacent memory getting corrupted.
Near-miss passage: CVE-2015-0564. CWE: CWE-119. CVSS: 5.0. Buffer underflow in the ssl_decrypt_record function in epan/dissectors/packet-ssl-utils.c in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 allows remote attackers to cause a denial of service (application crash) via a crafted packet that is improperly handled during decryption of an SSL session.
Query: risk of Multiple cross-site scripting (XSS) vulnerabilities in Ultimate PHP Board (aka myUPB) before 2.2.8 allow remote attackers to inject arbitrary web script or HTML via the (1) q param
Matching passage: CVE-2015-2217. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Ultimate PHP Board (aka myUPB) before 2.2.8 allow remote attackers to inject arbitrary web script or HTML via the (1) q parameter to search.php or (2) avatar parameter to profile.php.
Near-miss passage: CVE-2015-4552. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the quick edit function in xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.8.5 allows remote attackers to inject arbitrary web script or HTML via the content of a post.
Query: CWE for Double-Checked Locking
Matching passage: CWE-609 Double-Checked Locking. The product uses double-checked locking to access a resource without the overhead of explicit synchronization, but the locking is insufficient.
Near-miss passage: CWE-107 Struts: Unused Validation Form. An unused validation form indicates that validation logic is not up-to-date.
Query: how to detect Malware
Matching passage: T1588.001 Malware. Tactics: resource development. Description: Adversaries may buy, steal, or download malware that can be used during targeting. Malicious software can include payloads, droppers, post-compromise tools, backdoors, packers, and C2 protocols. Adversaries may acquire malware to support their operations, obtaining a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors. In addition to downloading free malware from the internet, adversaries may purchase these capabilities from third-party entities. Third-party entities can include technology companies that specialize in malware development, criminal marketplaces (including Malware-as-a-Service, or MaaS), or from individuals. In addition to purchasing malware, adversaries may steal and repurpose malware from third-party entities (including other adversaries).
Near-miss passage: T1588.007 Artificial Intelligence. Tactics: resource development. Description: Adversaries may obtain access to generative artificial intelligence tools, such as large language models (LLMs), to aid various techniques during targeting. These tools may be used to inform, bolster, and enable a variety of malicious tasks, including conducting [Reconnaissance](https://attack.mitre.org/tactics/TA0043), creating basic scripts, assisting social engineering, and even developing payloads.(Citation: MSFT-AI) For example, by utilizing a publicly available LLM an adversary is essentially outsourcing or automating certain tasks to the tool. Using AI, the adversary may draft and generate content in a variety of written languages to be used in [Phishing](https://attack.mitre.org/techniques/T1566)/[Phishing for Information](https://attack.mitre.org/techniques/T1598) campaigns. The same publicly available tool may further enable vulnerability or other offensive research supporting [Develop Capabilities](https://attack.mitre.org/techniques/T1587). AI tools may also automate technical tasks by generating, refining, or otherwise enhancing (e.g., [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027)) malicious scripts and payloads.(Citation: OpenAI-CTI) Finally, AI-generated text, images, audio, and video may be used for fraud, [Impersonation](https://attack.mitre.org/techniques/T1684/001), and other malicious activities.(Citation: Google-Vishing24)(Citation: IC3-AI24)(Citation: WSJ-Vishing-AI24)
Query: detect Detects suspicious reconnaissance command line activity on Windows systems using the PowerShell Get-LocalGroupMember Cmd in logs
Matching passage: Sigma rule: Detects suspicious reconnaissance command line activity on Windows systems using the PowerShell Get-LocalGroupMember Cmd. Logsource: windows / process_creation. Rule: title: Suspicious Reconnaissance Activity Using Get-LocalGroupMember Cmdlet id: c8a180d6-47a3-4345-a609-53f9c3d834fc related: - id: cef24b90-dddc-4ae1-a09a-8764872f69fc type: similar status: test description: Detects suspicious reconnaissance command line activity on Windows systems using the PowerShell Get-LocalGroupMember Cmdlet references: - https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-10 tags: - attack.discovery - attack.t1087.001 logsource: category: process_creation product: windows detection: selection_cmdlet: CommandLine|contains: 'Get-LocalGroupMember ' selection_group: CommandLine|contains: - domain admins - ' administrator' - ' administrateur' - enterprise admins - Exchange Trusted Subsystem - Remote Desktop Users - Utilisateurs du Bureau à distance - Usuarios de escritorio remoto condition: all of selection_* falsepositives: - Administrative activity level: medium
Near-miss passage: Sigma rule: Detects the creation of files with certain extensions on a static web site. This can be indicative of potential uploads. Logsource: windows / file_event. Rule: title: Potential Webshell Creation On Static Website id: 39f1f9f2-9636-45de-98f6-a4046aa8e4b9 status: test description: Detects the creation of files with certain extensions on a static web site. This can be indicative of potential uploads of a web shell. references: - PT ESC rule and personal experience - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/c95a0a1a2855dc0cd7f7327614545fe30482a636/Upload%20Insecure%20Files/README.md author: Beyu Denis, oscd.community, Tim Shelton, Thurein Oo date: 2019-10-22 modified: 2023-10-15 tags: - attack.persistence - attack.t1505.003 logsource: product: windows category: file_event detection: selection_wwwroot_path: TargetFilename|contains: \inetpub\wwwroot\ selection_wwwroot_ext: TargetFilename|contains: - .ashx - .asp - .ph - .soap selection_htdocs_path: TargetFilename|contains: - \www\ - \htdocs\ - \html\ selection_htdocs_ext: TargetFilename|contains: .ph filter_main_temp: TargetFilename|contains: - \AppData\Local\Temp\ - \Windows\Temp\ filter_main_system: Image: System filter_main_legitimate: TargetFilename|contains: \xampp condition: (all of selection_wwwroot_* or all of selection_htdocs_*) and not 1 of filter_main_* falsepositives: - Legitimate administrator or developer creating legitimate executable files in a web application folder level: medium
Query: patch priority for CVE-2015-1325
Matching passage: CVE-2015-1325. CWE: CWE-362. CVSS: 7.0. Race condition in Apport before 2.17.2-0ubuntu1.1 as packaged in Ubuntu 15.04, before 2.14.70ubuntu8.5 as packaged in Ubuntu 14.10, before 2.14.1-0ubuntu3.11 as packaged in Ubuntu 14.04 LTS, and before 2.0.1-0ubuntu17.9 as packaged in Ubuntu 12.04 LTS allow local users to write to arbitrary files and gain root privileges.
Near-miss passage: CVE-2015-7543. CWE: CWE-362. CVSS: 7.0. aRts 1.5.10 and kdelibs3 3.5.10 and earlier do not properly create temporary directories, which allows local users to hijack the IPC by pre-creating the temporary directory.
Query: CVE similar to CVE-2015-0892
Matching passage: CVE-2015-0892. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Maroyaka CGI Maroyaka Image Album allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-3274. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the user_get_user_details function in user/lib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allows remote attackers to inject arbitrary web script or HTML by leveraging absence of an external_format_text call in a web service.
Query: Sigma YAML for m365 / audit
Matching passage: Sigma rule: Detects instances where an email, identified as malicious or suspicious by the Microsoft Defender for Office 365 (former. Logsource: m365 / audit. Rule: title: Suspicious Email Delivered In Microsoft 365 id: 3569aefd-e535-4391-8c18-24bd01a21eaf status: experimental description: 'Detects instances where an email, identified as malicious or suspicious by the Microsoft Defender for Office 365 (formerly ATP) engine, was delivered to a user''s Inbox or Junk folder. It might indicate that a potential threat, such as a spearphishing attachment or links, has bypassed initial blocking mechanisms and reached an end-user, requiring further investigation and potential remediation. ' references: - https://learn.microsoft.com/en-us/defender-office-365/threat-explorer-real-time-detections-about - https://research.splunk.com/cloud/605cc93a-70e4-4ee3-9a3d-1a62e8c9b6c2/ - https://github.com/Bert-JanP/Hunting-Queries-Detection-Rules/blob/e7250648cb16d4a497ae8737943bf010ea96d2e6/Defender%20For%20Cloud%20Apps/MaliciousEmailDeliveredInMailbox.md author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) date: 2026-01-27 tags: - attack.initial-access - attack.t1566.001 - attack.t1566.002 logsource: service: audit product: m365 detection: selection: Workload: ThreatIntelligence Operation: TIMailData Directionality: Inbound filter_main_blocked: DeliveryAction: Blocked condition: selection and not 1 of filter_main_* falsepositives: - Unlikely level: medium
Near-miss passage: Sigma rule: Detects a DNS server error in which a specified plugin DLL (in registry) could not be loaded. Logsource: windows / dns-server. Rule: title: DNS Server Error Failed Loading the ServerLevelPluginDLL id: cbe51394-cd93-4473-b555-edf0144952d9 related: - id: e61e8a88-59a9-451c-874e-70fcc9740d67 type: derived - id: f63b56ee-3f79-4b8a-97fb-5c48007e8573 type: derived status: test description: Detects a DNS server error in which a specified plugin DLL (in registry) could not be loaded references: - https://medium.com/@esnesenon/feature-not-bug-dnsadmin-to-dc-compromise-in-one-line-a0f779b8dc83 - https://technet.microsoft.com/en-us/library/cc735829(v=ws.10).aspx - https://twitter.com/gentilkiwi/status/861641945944391680 author: Florian Roth (Nextron Systems) date: 2017-05-08 modified: 2023-02-05 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: product: windows service: dns-server detection: selection: EventID: - 150 - 770 - 771 condition: selection falsepositives: - Unknown level: high
Query: exploit Buffer overflow in the XML parser in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code by pro
Matching passage: CVE-2015-2716. CWE: CWE-119. CVSS: 7.5. Buffer overflow in the XML parser in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code by providing a large amount of compressed XML data, a related issue to CVE-2015-1283.
Near-miss passage: CVE-2015-7937. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in the GoAhead Web Server on Schneider Electric Modicon M340 PLC BMXNOx and BMXPx devices allows remote attackers to execute arbitrary code via a long password in HTTP Basic Authentication data.
Query: risk of The Hostscan module in Cisco AnyConnect Secure Mobility Client 4.0(.00051) and earlier allows local users to write to arbitrary files via crafted IPC messages, aka Bug ID CSCus7917
Matching passage: CVE-2015-0665. CWE: CWE-22. CVSS: 6.599999904632568. The Hostscan module in Cisco AnyConnect Secure Mobility Client 4.0(.00051) and earlier allows local users to write to arbitrary files via crafted IPC messages, aka Bug ID CSCus79173.
Near-miss passage: CVE-2015-1192. CWE: CWE-22. CVSS: 5.0. Absolute path traversal vulnerability in kgb 1.0b4 allows remote attackers to write to arbitrary files via a full pathname in a crafted archive.
Query: patch priority for CVE-2015-6613
Matching passage: CVE-2015-6613. CWE: CWE-77. CVSS: 5.099999904632568. Bluetooth in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows attackers to send commands to a debugging port, and consequently gain privileges, via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 24371736.
Near-miss passage: CVE-2015-7541. CWE: CWE-77. CVSS: 10.0. The initialize method in the Histogram class in lib/colorscore/histogram.rb in the colorscore gem before 0.0.5 for Ruby allows context-dependent attackers to execute arbitrary code via shell metacharacters in the (1) image_path, (2) colors, or (3) depth variable.
Query: vulnerability: QuickTime 7 in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted file
Matching passage: CVE-2015-3789. CWE: CWE-119. CVSS: 6.800000190734863. QuickTime 7 in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted file, a different vulnerability than CVE-2015-3765, CVE-2015-3779, CVE-2015-3788, CVE-2015-3790, CVE-2015-3791, CVE-2015-3792, CVE-2015-5751, CVE-2015-5753, and CVE-2015-5779.
Near-miss passage: CVE-2015-5776. CWE: CWE-119. CVSS: 7.5. Libinfo in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by leveraging use of an AF_INET6 socket.
Query: describe CVE-2015-3302
Matching passage: CVE-2015-3302. CWE: CWE-284. CVSS: 7.5. The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to obtain sensitive order detail information by leveraging a "broken authentication mechanism."
Near-miss passage: CVE-2015-3672. CWE: CWE-284. CVSS: 7.199999809265137. Admin Framework in Apple OS X before 10.10.4 does not properly handle authentication errors, which allows local users to obtain admin privileges via unspecified vectors.