alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: patch priority for CVE-2015-4508
Matching passage: CVE-2015-4508. CWE: CWE-254. CVSS: 2.5999999046325684. Mozilla Firefox before 41.0, when reader mode is enabled, allows remote attackers to spoof the relationship between address-bar URLs and web content via a crafted web site.
Near-miss passage: CVE-2015-1278. CWE: CWE-254. CVSS: 4.300000190734863. content/browser/web_contents/web_contents_impl.cc in Google Chrome before 44.0.2403.89 does not ensure that a PDF document's modal dialog is closed upon navigation to an interstitial page, which allows remote attackers to spoof URLs via a crafted document, as demonstrated by the alert_dialog.pdf document.
Query: patch priority for CVE-2015-5311
Matching passage: CVE-2015-5311. CWE: CWE-20. CVSS: 5.0. PowerDNS (aka pdns) Authoritative Server 3.4.4 before 3.4.7 allows remote attackers to cause a denial of service (assertion failure and server crash) via crafted query packets.
Near-miss passage: CVE-2015-1611. CWE: CWE-20. CVSS: 7.5. OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology and affect the flow of data, related to "fake LLDP injection."
Query: Sigma rule for Detects loading of a DLL by the VMware Xfer utility from the non-default directory which may be an attempt to sideload a
Matching passage: Sigma rule: Detects loading of a DLL by the VMware Xfer utility from the non-default directory which may be an attempt to sideload a. Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Via VMware Xfer id: 9313dc13-d04c-46d8-af4a-a930cc55d93b status: test description: Detects loading of a DLL by the VMware Xfer utility from the non-default directory which may be an attempt to sideload arbitrary DLL references: - https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-02 modified: 2023-02-17 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: product: windows category: image_load detection: selection: Image|endswith: \VMwareXferlogs.exe ImageLoaded|endswith: \glib-2.0.dll filter: ImageLoaded|startswith: C:\Program Files\VMware\ condition: selection and not filter falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects execution of Cmdl32 with the "/vpn" and "/lan" flags. Attackers can abuse this utility in order to download arbi. Logsource: windows / process_creation. Rule: title: Potential Arbitrary File Download Via Cmdl32.EXE id: f37aba28-a9e6-4045-882c-d5004043b337 status: test description: 'Detects execution of Cmdl32 with the "/vpn" and "/lan" flags. Attackers can abuse this utility in order to download arbitrary files via a configuration file. Inspect the location and the content of the file passed as an argument in order to determine if it is suspicious. ' references: - https://lolbas-project.github.io/lolbas/Binaries/Cmdl32/ - https://twitter.com/SwiftOnSecurity/status/1455897435063074824 - https://github.com/LOLBAS-Project/LOLBAS/pull/151 author: frack113 date: 2021-11-03 modified: 2024-04-22 tags: - attack.execution - attack.stealth - attack.t1218 - attack.t1202 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \cmdl32.exe - OriginalFileName: CMDL32.EXE selection_cli: CommandLine|contains|all: - /vpn - /lan condition: all of selection_* falsepositives: - Unknown level: medium
Query: CVE similar to CVE-2015-1745
Matching passage: CVE-2015-1745. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1735, CVE-2015-1740, CVE-2015-1744, and CVE-2015-1766.
Near-miss passage: CVE-2015-4942. CWE: CWE-399. CVSS: 5.300000190734863. IBM WebSphere MQ Light 1.x before 1.0.2 allows remote attackers to cause a denial of service (MQXR service crash) via a series of connect and disconnect actions, a different vulnerability than CVE-2015-4943.
Query: vulnerability: Botan before 1.10.13 and 1.11.x before 1.11.22 make it easier for remote attackers to conduct million-message attacks by measuring time differences, related to decoding of PKCS#1 p
Matching passage: CVE-2015-7827. CWE: CWE-200. CVSS: 7.5. Botan before 1.10.13 and 1.11.x before 1.11.22 make it easier for remote attackers to conduct million-message attacks by measuring time differences, related to decoding of PKCS#1 padding.
Near-miss passage: CVE-2015-7935. CWE: CWE-200. CVSS: 7.5. Motorola Solutions MOSCAD IP Gateway allows remote attackers to read arbitrary files via unspecified vectors.
Query: detect Detects when an attacker adds a new "Debugger" value to the "AeDebug" key in order to achieve persistence which will get in logs
Matching passage: Sigma rule: Detects when an attacker adds a new "Debugger" value to the "AeDebug" key in order to achieve persistence which will get. Logsource: windows / registry_set. Rule: title: Add Debugger Entry To AeDebug For Persistence id: 092af964-4233-4373-b4ba-d86ea2890288 status: test description: Detects when an attacker adds a new "Debugger" value to the "AeDebug" key in order to achieve persistence which will get invoked when an application crashes references: - https://persistence-info.github.io/Data/aedebug.html - https://learn.microsoft.com/en-us/windows/win32/debug/configuring-automatic-debugging author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-21 modified: 2023-08-17 tags: - attack.persistence logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\Debugger Details|endswith: .dll filter: Details: '"C:\WINDOWS\system32\vsjitdebugger.exe" -p %ld -e %ld -j 0x%p' condition: selection and not filter falsepositives: - Legitimate use of the key to setup a debugger. Which is often the case on developers machines level: medium
Near-miss passage: Sigma rule: Detects suspicious encoded payloads in WMI Event Consumers. Logsource: windows / wmi_event. Rule: title: Suspicious Encoded Scripts in a WMI Consumer id: 83844185-1c5b-45bc-bcf3-b5bf3084ca5b status: test description: Detects suspicious encoded payloads in WMI Event Consumers references: - https://github.com/RiccardoAncarani/LiquidSnake author: Florian Roth (Nextron Systems) date: 2021-09-01 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.execution - attack.t1047 - attack.persistence - attack.t1546.003 logsource: product: windows category: wmi_event detection: selection_destination: Destination|base64offset|contains: - WriteProcessMemory - This program cannot be run in DOS mode - This program must be run under Win32 condition: selection_destination falsepositives: - Unknown level: high
Query: describe CVE-2015-8262
Matching passage: CVE-2015-8262. CWE: UNKNOWN. CVSS: 6.800000190734863. Buffalo WZR-600DHP2 devices with firmware 2.09, 2.13, and 2.16 use an improper algorithm for selecting the ID value in the header of a DNS query, which makes it easier for remote attackers to spoof responses by predicting this value.
Near-miss passage: CVE-2015-0250. CWE: UNKNOWN. CVSS: 6.400000095367432. XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.
Query: risk of The Chat Room module 7.x-2.x before 7.x-2.2 for Drupal does not properly check permissions when setting up a websocket for chat messages, which allows remote attackers to bypass in
Matching passage: CVE-2015-8601. CWE: CWE-200. CVSS: 5.0. The Chat Room module 7.x-2.x before 7.x-2.2 for Drupal does not properly check permissions when setting up a websocket for chat messages, which allows remote attackers to bypass intended access restrictions and read messages from arbitrary Chat Rooms via unspecified vectors.
Near-miss passage: CVE-2015-5859. CWE: CWE-200. CVSS: 4.300000190734863. The CFNetwork HTTPProtocol component in Apple iOS before 9 and OS X before 10.11 does not properly recognize the HSTS preload list during a Safari private-browsing session, which makes it easier for remote attackers to obtain sensitive information by sniffing the network.
Query: mitigate Password Filter DLL
Matching passage: T1556.002 Password Filter DLL. Tactics: defense impairment, persistence, credential access. Description: Adversaries may register malicious password filter dynamic link libraries (DLLs) into the authentication process to acquire user credentials as they are validated. Windows password filters are password policy enforcement mechanisms for both domain and local accounts. Filters are implemented as DLLs containing a method to validate potential passwords against password policies. Filter DLLs can be positioned on local computers for local accounts and/or domain controllers for domain accounts. Before registering new passwords in the Security Accounts Manager (SAM), the Local Security Authority (LSA) requests validation from each registered filter. Any potential changes cannot take effect until every registered filter acknowledges validation. Adversaries can register malicious password filters to harvest credentials from local computers and/or entire domains. To perform proper validation, filters must receive plain-text credentials from the LSA. A malicious password filter would receive these plain-text credentials every time a password request is made.(Citation: Carnal Ownage Password Filters Sept 2013)
Near-miss passage: T1556.003 Pluggable Authentication Modules. Tactics: defense impairment, persistence, credential access. Description: Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted access to accounts. PAM is a modular system of configuration files, libraries, and executable files which guide authentication for many services. The most common authentication module is <code>pam_unix.so</code>, which retrieves, sets, and verifies account authentication information in <code>/etc/passwd</code> and <code>/etc/shadow</code>.(Citation: Apple PAM)(Citation: Man Pam_Unix)(Citation: Red Hat PAM) Adversaries may modify components of the PAM system to create backdoors. PAM components, such as <code>pam_unix.so</code>, can be patched to accept arbitrary adversary supplied values as legitimate credentials.(Citation: PAM Backdoor) Malicious modifications to the PAM system may also be abused to steal credentials. Adversaries may infect PAM resources with code to harvest user credentials, since the values exchanged with PAM components may be plain-text since PAM does not store passwords.(Citation: PAM Creds)(Citation: Apple PAM)
Query: rule covering Detects change the the "AutodialDLL" key which could be used as a persistence method to load custom DLL via the "ws2_32"
Matching passage: Sigma rule: Detects change the the "AutodialDLL" key which could be used as a persistence method to load custom DLL via the "ws2_32". Logsource: windows / registry_set. Rule: title: Potential Persistence Via AutodialDLL id: e6fe26ee-d063-4f5b-b007-39e90aaf50e3 status: test description: Detects change the the "AutodialDLL" key which could be used as a persistence method to load custom DLL via the "ws2_32" library references: - https://www.hexacorn.com/blog/2015/01/13/beyond-good-ol-run-key-part-24/ - https://persistence-info.github.io/Data/autodialdll.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-10 modified: 2023-08-17 tags: - attack.persistence logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Services\WinSock2\Parameters\AutodialDLL condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the use of curl with NTLM authentication and empty credentials (-u :), which can be abused to leak the currently. Logsource: windows / process_creation. Rule: title: NTLM Hash Leak Via Curl NTLM Authentication id: 916eb839-895e-47f8-99ee-3008bf377a3e status: test description: 'Detects the use of curl with NTLM authentication and empty credentials (-u :), which can be abused to leak the currently logged-in user''s NTLMv2 challenge-response to an attacker-controlled server, enabling offline cracking or relay attacks. When no credentials are provided, the Microsoft-shipped curl passes a NULL identity to Windows SSPI, which automatically falls back to the current user''s logon session credentials stored in LSASS — without requiring a plaintext password. This behavior is exclusive to the curl binary shipped by Microsoft (available since Windows 10 / Windows Server 2019), which is built with SSPI support. ' references: - https://github.com/curl/curl/blob/master/lib/vauth/ntlm_sspi.c#L128-L140 - https://learn.microsoft.com/en-us/windows/win32/secauthn/acquirecredentialshandle--ntlm - https://curl.se/docs/manpage.html#--ntlm author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-06-04 tags: - attack.credential-access - attack.t1187 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \curl.exe - OriginalFileName: curl.exe selection_ntlm_flag: CommandLine|contains: --ntlm selection_empty_creds: CommandLine|re: '(?i)\s(-u|--user)\s*:' condition: all of selection_* falsepositives: - Should be very rare as it's not widely known or used, but could occur in legitimate use cases where curl is used with NTLM authentication and empty credentials, such as in certain scripts or automation tasks. level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_ntlm_hash_leak_attempt/info.yml
Query: vulnerability: Platform Software before 4.4.5 in Cisco Unified Communications Domain Manager (CDM) 8.x has a hardcoded password for a privileged account, which allows remote attackers to obtain r
Matching passage: CVE-2015-4196. CWE: CWE-255. CVSS: 5.0. Platform Software before 4.4.5 in Cisco Unified Communications Domain Manager (CDM) 8.x has a hardcoded password for a privileged account, which allows remote attackers to obtain root access by leveraging knowledge of this password and entering it in an SSH session, aka Bug ID CSCuq45546.
Near-miss passage: CVE-2015-8611. CWE: CWE-255. CVSS: 9.800000190734863. BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, and PEM 12.0.0 before HF1 on the 2000, 4000, 5000, 7000, and 10000 platforms do not properly sync passwords with the Always-On Management (AOM) subsystem, which might allow remote attackers to obtain login access to AOM via an (1) expired or (2) default password.
Query: describe CVE-2015-5772
Matching passage: CVE-2015-5772. CWE: CWE-119. CVSS: 6.800000190734863. Heap-based buffer overflow in SceneKit in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code via a crafted Collada file.
Near-miss passage: CVE-2015-0795. CWE: CWE-119. CVSS: 6.800000190734863. Multiple stack-based buffer overflows in the SafeShellExecute method in the NetIQExecObject.NetIQExec.1 ActiveX control in NetIQExec.dll in NetIQ Security Solutions for iSeries 8.1 allow remote attackers to execute arbitrary code via long arguments, aka ZDI-CAN-2699.
Query: containment actions for SIEM correlation: stealth activity consistent with Cloud Accounts
Matching passage: Playbook for T1078.004 Cloud Accounts. 1) Validate alert telemetry against T1078.004. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth, persistence, privilege escalation, initial access. 5) Eradicate persistence and recover. Reference detection notes: Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cl
Near-miss passage: Playbook for T1078 Valid Accounts. Different response path focused on stealth, persistence, privilege escalation, initial access.
Query: detect Detects enumeration of local network configuration in logs
Matching passage: Sigma rule: Detects enumeration of local network configuration. Logsource: macos / process_creation. Rule: title: System Network Discovery - macOS id: 58800443-f9fc-4d55-ae0c-98a3966dfb97 status: test description: Detects enumeration of local network configuration references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md author: remotephone, oscd.community date: 2020-10-06 modified: 2024-08-29 tags: - attack.discovery - attack.t1016 logsource: product: macos category: process_creation detection: selection_1: Image|endswith: - /arp - /ifconfig - /netstat - /networksetup - /socketfilterfw selection_2: Image: /usr/bin/defaults CommandLine|contains|all: - /Library/Preferences/com.apple.alf - read filter_main_wifivelocityd: ParentImage|endswith: /wifivelocityd condition: 1 of selection_* and not 1 of filter_main_* falsepositives: - Legitimate administration activities level: informational
Near-miss passage: Sigma rule: Detects using register-cimprovider.exe to execute arbitrary dll file.. Logsource: windows / process_creation. Rule: title: DLL Execution Via Register-cimprovider.exe id: a2910908-e86f-4687-aeba-76a5f996e652 status: test description: Detects using register-cimprovider.exe to execute arbitrary dll file. references: - https://twitter.com/PhilipTsukerman/status/992021361106268161 - https://lolbas-project.github.io/lolbas/Binaries/Register-cimprovider/ author: Ivan Dyachkov, Yulia Fomina, oscd.community date: 2020-10-07 modified: 2021-11-27 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574 logsource: category: process_creation product: windows detection: selection: Image|endswith: \register-cimprovider.exe CommandLine|contains|all: - -path - dll condition: selection falsepositives: - Unknown level: medium
Query: write Sigma for Detects a highly relevant Antivirus alert that reports APT malware. This event must not be ignored just because the AV h
Matching passage: Sigma rule: Detects a highly relevant Antivirus alert that reports APT malware. This event must not be ignored just because the AV h. Logsource: antivirus. Rule: title: Antivirus - APT Malware Signature id: 101a1877-2cf4-474d-abfd-7f6ac4788d1a status: experimental description: 'Detects a highly relevant Antivirus alert that reports APT malware. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place. ' references: - https://www.nextron-systems.com/?s=antivirus author: Arnim Rupp (Nextron Systems) date: 2026-06-15 tags: - attack.execution - attack.t1203 - attack.command-and-control - attack.t1219.002 logsource: category: antivirus detection: selection: - Signature|re: - APT\d - ATK\d - UNC\d - UAC\d - Signature|contains: - '[APT]' - APT_ - APT- - BackOrder - BlindingCan - Blizzard - Chollima - Cleaver - Cobra - DarkHotel - Dragon - DTrack - Equation - GiftedCrook - GraphSteel - GreyEnergy - GEnergy - GrimPlant - Hydra - Jackal - Kitten - Kimsuky - Lazar - LightRail - Lotus - Luminous - LumiMoth - Nimbus - Manticore - MiniBike - MiniBrowse - MiniBus - MiniFast - MiniJuke - MiniUpdate - MuddyWater - NukeSped - OilRig - Panda - Sandstorm - SandWorm - Seamonkey - Sleet - SlugResin - SnailResin - Snake - Tempest - Tsunami - Turla - Typhoon - UAC_ - UAC- - UNC_ - UNC- - VinoSiren - Winnti condition: selection falsepositives: - Unlikely level: critical
Near-miss passage: Sigma rule: Commandline to launch powershell with a base64 payload. Logsource: windows / process_creation. Rule: title: Suspicious Execution of Powershell with Base64 id: fb843269-508c-4b76-8b8d-88679db22ce7 status: test description: Commandline to launch powershell with a base64 payload references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.001/T1059.001.md#atomic-test-20---powershell-invoke-known-malicious-cmdlets - https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/ - https://mikefrobbins.com/2017/06/15/simple-obfuscation-with-powershell-using-base64-encoding/ author: frack113 date: 2022-01-02 modified: 2023-01-05 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains: - ' -e ' - ' -en ' - ' -enc ' - ' -enco' - ' -ec ' filter_encoding: CommandLine|contains: ' -Encoding ' filter_azure: ParentImage|contains: - C:\Packages\Plugins\Microsoft.GuestConfiguration.ConfigurationforWindows\ - \gc_worker.exe condition: selection and not 1 of filter_* falsepositives: - Unknown level: medium
Query: exploit The RPC service in Tripwire (formerly nCircle) IP360 VnE Manager 7.2.2 before 7.2.6 allows remote attackers to bypass authentication and (1) enumerate users, (2) reset passwords, o
Matching passage: CVE-2015-6237. CWE: CWE-287. CVSS: 9.800000190734863. The RPC service in Tripwire (formerly nCircle) IP360 VnE Manager 7.2.2 before 7.2.6 allows remote attackers to bypass authentication and (1) enumerate users, (2) reset passwords, or (3) manipulate IP filter restrictions via crafted "privileged commands."
Near-miss passage: CVE-2015-3442. CWE: CWE-287. CVSS: 9.800000190734863. Soreco Xpert.Line 3.0 allows local users to spoof users and consequently gain privileges by intercepting a Windows API call.
Query: CVE similar to CVE-2015-4278
Matching passage: CVE-2015-4278. CWE: CWE-20. CVSS: 4.300000190734863. Cisco Email Security Appliance (ESA) devices with software 8.5.6-106 and 9.5.0-201 allow remote attackers to cause a denial of service (per-domain e-mail reception outage) by placing malformed DMARC policy data in DNS TXT records for a domain, aka Bug ID CSCuv14806.
Near-miss passage: CVE-2015-0635. CWE: CWE-20. CVSS: 9.0. The Autonomic Networking Infrastructure (ANI) implementation in Cisco IOS 12.2, 12.4, 15.0, 15.2, 15.3, and 15.4 and IOS XE 3.10.xS through 3.13.xS before 3.13.1S allows remote attackers to spoof Autonomic Networking Registration Authority (ANRA) responses, and consequently bypass intended device and node access restrictions or cause a denial of service (disrupted domain access), via crafted AN messages, aka Bug ID CSCup62191.
Query: exploit Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.
Matching passage: CVE-2015-8645. CWE: CWE-119. CVSS: 8.800000190734863. Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8459, CVE-2015-8460, and CVE-2015-8636.
Near-miss passage: CVE-2015-3117. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3123, CVE-2015-3130, CVE-2015-3133, CVE-2015-3134, and CVE-2015-4431.