alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Detects the creation of an administrator account on a Fortinet FortiGate Firewall.
Matching passage: Sigma rule: Detects the creation of an administrator account on a Fortinet FortiGate Firewall.. Logsource: fortigate / event. Rule: title: FortiGate - New Administrator Account Created id: cd0a4943-0edd-42cf-b50c-06f77a10d4c1 status: experimental description: Detects the creation of an administrator account on a Fortinet FortiGate Firewall. references: - https://www.fortiguard.com/psirt/FG-IR-24-535 - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/390485493/config-system-admin - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) date: 2025-11-01 tags: - attack.persistence - attack.t1136.001 logsource: product: fortigate service: event detection: selection: action: Add cfgpath: system.admin condition: selection falsepositives: - An administrator account can be created for legitimate purposes. Investigate the account details to determine if it is authorized. level: medium
Near-miss passage: Sigma rule: Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename. Logsource: windows / process_creation. Rule: title: PUA - Potential PE Metadata Tamper Using Rcedit id: 0c92f2e6-f08f-4b73-9216-ecb0ca634689 status: test description: Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion. references: - https://security.stackexchange.com/questions/210843/is-it-possible-to-change-original-filename-of-an-exe - https://www.virustotal.com/gui/file/02e8e8c5d430d8b768980f517b62d7792d690982b9ba0f7e04163cbc1a6e7915 - https://github.com/electron/rcedit author: Micah Babinski date: 2022-12-11 modified: 2023-03-05 tags: - attack.stealth - attack.t1036.003 - attack.t1036 - attack.t1027.005 - attack.t1027 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \rcedit-x64.exe - \rcedit-x86.exe - Description: Edit resources of exe - Product: rcedit selection_flags: CommandLine|contains: --set- selection_attributes: CommandLine|contains: - OriginalFileName - CompanyName - FileDescription - ProductName - ProductVersion - LegalCopyright condition: all of selection_* falsepositives: - Legitimate use of the tool by administrators or users to update metadata of a binary level: medium
Query: describe CVE-2015-7029
Matching passage: CVE-2015-7029. CWE: CWE-119. CVSS: 9.800000190734863. Apple AirPort Base Station Firmware before 7.6.7 and 7.7.x before 7.7.7 misparses DNS data, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Near-miss passage: CVE-2015-6360. CWE: CWE-119. CVSS: 7.5. The encryption-processing feature in Cisco libSRTP before 1.5.3 allows remote attackers to cause a denial of service via crafted fields in SRTP packets, aka Bug ID CSCux00686.
Query: risk of Cross-site scripting (XSS) vulnerability in IBM Multi-Enterprise Integration Gateway 1.x through 1.0.0.1 and B2B Advanced Communications 1.0.0.2 and 1.0.0.3 before 1.0.0.3_2 allows
Matching passage: CVE-2015-4973. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in IBM Multi-Enterprise Integration Gateway 1.x through 1.0.0.1 and B2B Advanced Communications 1.0.0.2 and 1.0.0.3 before 1.0.0.3_2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-8935. CWE: CWE-79. CVSS: 6.099999904632568. The sapi_header_op function in main/SAPI.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 supports deprecated line folding without considering browser compatibility, which allows remote attackers to conduct cross-site scripting (XSS) attacks against Internet Explorer by leveraging (1) %0A%20 or (2) %0D%0A%20 mishandling in the header function.
Query: describe CVE-2015-4524
Matching passage: CVE-2015-4524. CWE: CWE-434. CVSS: 6.5. Unrestricted file upload vulnerability in EMC Documentum WebTop 6.7SP1 before P31, 6.7SP2 before P23, and 6.8 before P01; Documentum Administrator 6.7SP1 before P31, 6.7SP2 before P23, 7.0 before P18, 7.1 before P15, and 7.2 before P01; Documentum Digital Assets Manager 6.5SP6 before P25; Documentum Web Publishers 6.5 SP7 before P25; and Documentum Task Space 6.7SP1 before P31 and 6.7SP2 before P23 allows remote authenticated users to execute arbitrary code by uploading a file to the backend Content Server.
Near-miss passage: CVE-2015-1000013. CWE: CWE-434. CVSS: 7.800000190734863. Remote file upload vulnerability in wordpress plugin csv2wpec-coupon v1.1
Query: describe CVE-2015-6068
Matching passage: CVE-2015-6068. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6072, CVE-2015-6073, CVE-2015-6075, CVE-2015-6077, CVE-2015-6079, CVE-2015-6080, and CVE-2015-6082.
Near-miss passage: CVE-2015-6069. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6081.
Query: detect Detects a highly relevant Antivirus alert that reports APT malware. This event must not be ignored just because the AV h in logs
Matching passage: Sigma rule: Detects a highly relevant Antivirus alert that reports APT malware. This event must not be ignored just because the AV h. Logsource: antivirus. Rule: title: Antivirus - APT Malware Signature id: 101a1877-2cf4-474d-abfd-7f6ac4788d1a status: experimental description: 'Detects a highly relevant Antivirus alert that reports APT malware. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place. ' references: - https://www.nextron-systems.com/?s=antivirus author: Arnim Rupp (Nextron Systems) date: 2026-06-15 tags: - attack.execution - attack.t1203 - attack.command-and-control - attack.t1219.002 logsource: category: antivirus detection: selection: - Signature|re: - APT\d - ATK\d - UNC\d - UAC\d - Signature|contains: - '[APT]' - APT_ - APT- - BackOrder - BlindingCan - Blizzard - Chollima - Cleaver - Cobra - DarkHotel - Dragon - DTrack - Equation - GiftedCrook - GraphSteel - GreyEnergy - GEnergy - GrimPlant - Hydra - Jackal - Kitten - Kimsuky - Lazar - LightRail - Lotus - Luminous - LumiMoth - Nimbus - Manticore - MiniBike - MiniBrowse - MiniBus - MiniFast - MiniJuke - MiniUpdate - MuddyWater - NukeSped - OilRig - Panda - Sandstorm - SandWorm - Seamonkey - Sleet - SlugResin - SnailResin - Snake - Tempest - Tsunami - Turla - Typhoon - UAC_ - UAC- - UNC_ - UNC- - VinoSiren - Winnti condition: selection falsepositives: - Unlikely level: critical
Near-miss passage: Sigma rule: Detects potential DLL sideloading using comctl32.dll to obtain system privileges. Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Via comctl32.dll id: 6360757a-d460-456c-8b13-74cf0e60cceb status: test description: Detects potential DLL sideloading using comctl32.dll to obtain system privileges references: - https://github.com/binderlabs/DirCreate2System - https://github.com/sailay1996/awesome_windows_logical_bugs/blob/60cbb23a801f4c3195deac1cc46df27c225c3d07/dir_create2system.txt author: Nasreddine Bencherchali (Nextron Systems), Subhash Popuri (@pbssubhash) date: 2022-12-16 modified: 2022-12-19 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|startswith: - C:\Windows\System32\logonUI.exe.local\ - C:\Windows\System32\werFault.exe.local\ - C:\Windows\System32\consent.exe.local\ - C:\Windows\System32\narrator.exe.local\ - C:\windows\system32\wermgr.exe.local\ ImageLoaded|endswith: \comctl32.dll condition: selection falsepositives: - Unlikely level: high
Query: CVE similar to CVE-2015-7466
Matching passage: CVE-2015-7466. CWE: CWE-74. CVSS: 3.0999999046325684. Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service (JRS) 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to conduct LDAP injection attacks, and consequently bypass intended query restrictions or modify the LDAP directory, via unspecified vectors.
Near-miss passage: CVE-2015-7544. CWE: CWE-74. CVSS: 9.100000381469727. redhat-support-plugin-rhev in Red Hat Enterprise Virtualization Manager (aka RHEV Manager) before 3.6 allows remote authenticated users with the SuperUser role on any Entity to execute arbitrary commands on any host in the RHEV environment.
Query: Sigma YAML for windows / dns_query
Matching passage: Sigma rule: Detects when the Notepad++ updater (gup.exe) makes DNS queries to domains that are not part of the known legitimate upda. Logsource: windows / dns_query. Rule: title: Notepad++ Updater DNS Query to Uncommon Domains id: 2074e137-1b73-4e2d-88ba-5a3407dbdce0 status: experimental description: 'Detects when the Notepad++ updater (gup.exe) makes DNS queries to domains that are not part of the known legitimate update infrastructure. This could indicate potential exploitation of the updater mechanism or suspicious network activity that warrants further investigation. ' references: - https://notepad-plus-plus.org/news/v889-released/ - https://www.heise.de/en/news/Notepad-updater-installed-malware-11109726.html - https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/ - https://www.validin.com/blog/exploring_notepad_plus_plus_network_indicators/ - https://securelist.com/notepad-supply-chain-attack/118708/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-02-02 modified: 2026-03-16 tags: - attack.collection - attack.credential-access - attack.t1195.002 - attack.initial-access - attack.t1557 logsource: category: dns_query product: windows detection: selection: Image|endswith: \gup.exe filter_main_notepad_legit_domain: QueryName: notepad-plus-plus.org filter_optional_sourceforge_legit_domain: QueryName|endswith: .sourceforge.net filter_optional_github_legit_domain: - QueryName|endswith: .githubusercontent.com - QueryName: github.com filter_optional_google_storage_legit_domain: QueryName|endswith: .googleapis.com filter_optional_uncommon_domains: QueryName|endswith: - .azurewebsites.net - block.opendns.com - gateway.zscalerthree.net condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Some legitimate network misconfigurations or proxy issues causing unexpected DNS queries. - Other legitimate query to official domains not listed in the filter, needing tuning. level: medium
Near-miss passage: Sigma rule: Detects potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This can be used by attackers to ena. Logsource: windows / process_creation. Rule: title: Potential Remote Desktop Tunneling id: 8a3038e8-9c9d-46f8-b184-66234a160f6f status: test description: Detects potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination. references: - https://www.elastic.co/guide/en/security/current/potential-remote-desktop-tunneling-detected.html author: Tim Rauch, Elastic (idea) date: 2022-09-27 tags: - attack.lateral-movement - attack.t1021 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: :3389 selection_opt: CommandLine|contains: - ' -L ' - ' -P ' - ' -R ' - ' -pw ' - ' -ssh ' condition: all of selection* falsepositives: - Unknown level: medium
Query: risk of The Dictionary app in Apple OS X before 10.10.5 does not use HTTPS, which allows man-in-the-middle attackers to obtain sensitive information by sniffing the network or spoof word d
Matching passage: CVE-2015-3774. CWE: CWE-20. CVSS: 4.800000190734863. The Dictionary app in Apple OS X before 10.10.5 does not use HTTPS, which allows man-in-the-middle attackers to obtain sensitive information by sniffing the network or spoof word definitions by modifying the client-server data stream.
Near-miss passage: CVE-2015-0717. CWE: CWE-20. CVSS: 6.900000095367432. Cisco Unified Communications Manager 10.0(1.10000.12) allows local users to gain privileges via a command string in an unspecified parameter, aka Bug ID CSCut19546.
Query: vulnerability: Cross-site request forgery (CSRF) vulnerability in HP Version Control Repository Manager (VCRM) before 7.5.0 allows remote authenticated users to hijack the authentication of unspe
Matching passage: CVE-2015-5412. CWE: CWE-352. CVSS: 6.0. Cross-site request forgery (CSRF) vulnerability in HP Version Control Repository Manager (VCRM) before 7.5.0 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.
Near-miss passage: CVE-2015-4258. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability on Cisco TelePresence MSE 8000 devices allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu90444.
Query: Sigma YAML for windows / ps_module
Matching passage: Sigma rule: Detects PowerShell module creation where the module Contents are set to "function Get-VMRemoteFXPhysicalVideoAdapter". T. Logsource: windows / ps_module. Rule: title: Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell Module id: 38a7625e-b2cb-485d-b83d-aff137d859f4 related: - id: a6fc3c46-23b8-4996-9ea2-573f4c4d88c5 type: similar - id: f65e22f9-819e-4f96-9c7b-498364ae7a25 type: similar - id: cacef8fc-9d3d-41f7-956d-455c6e881bc5 type: similar status: test description: Detects PowerShell module creation where the module Contents are set to "function Get-VMRemoteFXPhysicalVideoAdapter". This could be a sign of potential abuse of the "RemoteFXvGPUDisablement.exe" binary which is known to be vulnerable to module load-order hijacking. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md - https://github.com/redcanaryco/AtomicTestHarnesses/blob/7e1e4da116801e3d6fcc6bedb207064577e40572/TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.ps1 author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2021-07-13 modified: 2023-05-09 tags: - attack.stealth - attack.t1218 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection: Payload|contains: ModuleContents=function Get-VMRemoteFXPhysicalVideoAdapter { condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters. Logsource: windows / process_creation. Rule: title: PUA - Seatbelt Execution id: 38646daa-e78f-4ace-9de0-55547b2d30da status: test description: Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters references: - https://github.com/GhostPack/Seatbelt - https://www.bluetangle.dev/2022/08/fastening-seatbelt-on-threat-hunting.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-18 modified: 2023-02-04 tags: - attack.discovery - attack.t1526 - attack.t1087 - attack.t1083 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \Seatbelt.exe - OriginalFileName: Seatbelt.exe - Description: Seatbelt - CommandLine|contains: - ' DpapiMasterKeys' - ' InterestingProcesses' - ' InterestingFiles' - ' CertificateThumbprints' - ' ChromiumBookmarks' - ' ChromiumHistory' - ' ChromiumPresence' - ' CloudCredentials' - ' CredEnum' - ' CredGuard' - ' FirefoxHistory' - ' ProcessCreationEvents' selection_group_list: CommandLine|contains: - ' -group=misc' - ' -group=remote' - ' -group=chromium' - ' -group=slack' - ' -group=system' - ' -group=user' - ' -group=all' selection_group_output: CommandLine|contains: ' -outputfile=' condition: selection_img or all of selection_group_* falsepositives: - Unlikely level: high
Query: vulnerability: Multiple cross-site request forgery (CSRF) vulnerabilities in the Spider Catalog module for Drupal allow remote attackers to hijack the authentication of administrators for request
Matching passage: CVE-2015-4350. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the Spider Catalog module for Drupal allow remote attackers to hijack the authentication of administrators for requests that delete (1) products, (2) ratings, or (3) categories via unspecified vectors.
Near-miss passage: CVE-2015-5188. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Web Console (web-console) in Red Hat Enterprise Application Platform before 6.4.4 and WildFly (formerly JBoss Application Server) before 2.0.0.CR9 allows remote attackers to hijack the authentication of administrators for requests that make arbitrary changes to an instance via vectors involving a file upload using a multipart/form-data submission.
Query: describe CVE-2015-8443
Matching passage: CVE-2015-8443. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8444, CVE-2015-8451, and CVE-2015-8455.
Near-miss passage: CVE-2015-6609. CWE: CWE-119. CVSS: 10.0. libutils in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file, aka internal bug 22953624.
Query: CVE similar to CVE-2015-6269
Matching passage: CVE-2015-6269. CWE: CWE-399. CVSS: 7.800000190734863. Cisco IOS XE before 2.2.3 on ASR 1000 devices allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted (1) IPv4 or (2) IPv6 packet, aka Bug ID CSCsw69990.
Near-miss passage: CVE-2015-1730. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Query: risk of Multiple cross-site scripting (XSS) vulnerabilities in the Calls to Action plugin before 2.5.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (
Matching passage: CVE-2015-8350. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in the Calls to Action plugin before 2.5.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) open-tab parameter in a wp_cta_global_settings action to wp-admin/edit.php or (2) wp-cta-variation-id parameter to ab-testing-call-to-action-example/.
Near-miss passage: CVE-2015-6475. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in IBC Solar ServeMaster TLP+ and Danfoss TLX Pro+ allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: vulnerability: Microsoft Access 2007 SP3, Excel 2007 SP3, InfoPath 2007 SP3, OneNote 2007 SP3, PowerPoint 2007 SP3, Project 2007 SP3, Publisher 2007 SP3, Visio 2007 SP3, Word 2007 SP3, Office 200
Matching passage: CVE-2015-2503. CWE: CWE-264. CVSS: 9.300000190734863. Microsoft Access 2007 SP3, Excel 2007 SP3, InfoPath 2007 SP3, OneNote 2007 SP3, PowerPoint 2007 SP3, Project 2007 SP3, Publisher 2007 SP3, Visio 2007 SP3, Word 2007 SP3, Office 2007 IME (Japanese) SP3, Access 2010 SP2, Excel 2010 SP2, InfoPath 2010 SP2, OneNote 2010 SP2, PowerPoint 2010 SP2, Project 2010 SP2, Publisher 2010 SP2, Visio 2010 SP2, Word 2010 SP2, Pinyin IME 2010, Access 2013 SP1, Excel 2013 SP1, InfoPath 2013 SP1, OneNote 2013 SP1, PowerPoint 2013 SP1, Project 2013 SP1, Publisher 2013 SP1, Visio 2013 SP1, Word 2013 SP1, Excel 2013 RT SP1, OneNote 2013 RT SP1, PowerPoint 2013 RT SP1, Word 2013 RT SP1, Access 2016, Excel 2016, OneNote 2016, PowerPoint 2016, Project 2016, Publisher 2016, Visio 2016, Word 2016, Skype for Business 2016, and Lync 2013 SP1 allow remote attackers to bypass a sandbox protection mechanism and gain privileges via a crafted web site that is accessed with Internet Explorer, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "Microsoft Office Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-5252. CWE: CWE-264. CVSS: 7.199999809265137. vfs.c in smbd in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, when share names with certain substring relationships exist, allows remote attackers to bypass intended file-access restrictions via a symlink that points outside of a share.
Query: CVE similar to CVE-2015-7503
Matching passage: CVE-2015-7503. CWE: CWE-320. CVSS: 7.5. Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key.
Near-miss passage: CVE-2015-8542. CWE: CWE-320. CVSS: 8.800000190734863. An issue was discovered in Open-Xchange Guard before 2.2.0-rev8. The "getprivkeybyid" API call is used to download a PGP Private Key for a specific user after providing authentication credentials. Clients provide the "id" and "cid" parameter to specify the current user by its user- and context-ID. The "auth" parameter contains a hashed password string which gets created by the client by asking the user to enter his or her OX Guard password. This parameter is used as single point of authentication when accessing PGP Private Keys. In case a user has set the same password as another user, it is possible to download another user's PGP Private Key by iterating the "id" and "cid" parameters. This kind of attack would also be able by brute-forcing login credentials, but since the "id" and "cid" parameters are sequential they are much easier to predict than a user's login name. At the same time, there are some obvious insecure standard passwords that are widely used. A attacker could send the hashed representation of typically weak passwords and randomly fetch Private Key of matching accounts. The attack can be executed by both internal users and "guests" which use the external mail reader.