alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: Untrusted search path vulnerability in Schneider Electric Wonderware System Platform before 2014 R2 Patch 01 allows local users to gain privileges via a Trojan horse DLL in an unsp
Matching passage: CVE-2015-3940. CWE: CWE-22. CVSS: 6.900000095367432. Untrusted search path vulnerability in Schneider Electric Wonderware System Platform before 2014 R2 Patch 01 allows local users to gain privileges via a Trojan horse DLL in an unspecified directory.
Near-miss passage: CVE-2015-7603. CWE: CWE-22. CVSS: 7.800000190734863. Directory traversal vulnerability in Konica Minolta FTP Utility 1.0 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in a RETR command.
Query: exploit Off-by-one error in IOAcceleratorFamily in Apple OS X through 10.10.2 allows attackers to execute arbitrary code in a privileged context via a crafted app.
Matching passage: CVE-2015-1066. CWE: CWE-189. CVSS: 10.0. Off-by-one error in IOAcceleratorFamily in Apple OS X through 10.10.2 allows attackers to execute arbitrary code in a privileged context via a crafted app.
Near-miss passage: CVE-2015-6130. CWE: CWE-189. CVSS: 9.300000190734863. Integer underflow in Uniscribe in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows remote attackers to execute arbitrary code via a crafted font, aka "Windows Integer Underflow Vulnerability."
Query: weakness Insufficient Control Flow Management
Matching passage: CWE-691 Insufficient Control Flow Management. The code does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.
Near-miss passage: CWE-1231 Improper Prevention of Lock Bit Modification. The product uses a trusted lock bit for restricting access to registers, address regions, or other resources, but the product does not prevent the value of the lock bit from being modified after it has been set.
Query: vulnerability: The nsZipArchive::BuildFileList function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory l
Matching passage: CVE-2015-2736. CWE: CWE-17. CVSS: 9.300000190734863. The nsZipArchive::BuildFileList function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, which allows remote attackers to have an unspecified impact via a crafted ZIP archive.
Near-miss passage: CVE-2015-2682. CWE: CWE-17. CVSS: 5.0. Citrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 allows remote attackers to obtain credentials via a direct request to conf/securitydbData.xml.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects execution of a renamed autohotkey.exe binary based on PE metadata fields. Logsource: windows / process_creation. Rule: title: Renamed AutoHotkey.EXE Execution id: 0f16d9cf-0616-45c8-8fad-becc11b5a41c status: test description: Detects execution of a renamed autohotkey.exe binary based on PE metadata fields references: - https://www.autohotkey.com/download/ - https://thedfirreport.com/2023/02/06/collect-exfiltrate-sleep-repeat/ author: Nasreddine Bencherchali date: 2023-02-07 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: - Product|contains: AutoHotkey - Description|contains: AutoHotkey - OriginalFileName: - AutoHotkey.exe - AutoHotkey.rc filter: - Image|endswith: - \AutoHotkey.exe - \AutoHotkey32.exe - \AutoHotkey32_UIA.exe - \AutoHotkey64.exe - \AutoHotkey64_UIA.exe - \AutoHotkeyA32.exe - \AutoHotkeyA32_UIA.exe - \AutoHotkeyU32.exe - \AutoHotkeyU32_UIA.exe - \AutoHotkeyU64.exe - \AutoHotkeyU64_UIA.exe - Image|contains: \AutoHotkey condition: selection and not filter falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the creation of a new service using the "sc.exe" utility.. Logsource: windows / process_creation. Rule: title: New Service Creation Using Sc.EXE id: 85ff530b-261d-48c6-a441-facaa2e81e48 related: - id: c02e96b7-c63a-4c47-bd83-4a9f74afcfb2 type: similar status: test description: Detects the creation of a new service using the "sc.exe" utility. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1543.003/T1543.003.md author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community date: 2023-02-20 modified: 2025-09-01 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 logsource: category: process_creation product: windows detection: selection: Image|endswith: \sc.exe CommandLine|contains|all: - create - binPath filter_optional_dropbox: ParentImage|startswith: - C:\Program Files (x86)\Dropbox\Client\ - C:\Program Files\Dropbox\Client\ ParentImage|endswith: \Dropbox.exe condition: selection and not 1 of filter_optional_* falsepositives: - Legitimate administrator or user creates a service for legitimate reasons. - Software installation level: low
Query: Sigma YAML for opencanary / application
Matching passage: Sigma rule: Detects instances where an OpenCanary node has been targeted by a NMAP OS Scan. Logsource: opencanary / application. Rule: title: OpenCanary - NMAP OS Scan id: e8a677fd-248c-4eab-94df-de2f6f645884 status: experimental description: Detects instances where an OpenCanary node has been targeted by a NMAP OS Scan references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Marco Pedrinazzi (@pedrinazziM) date: 2026-01-06 tags: - attack.discovery - attack.t1046 logsource: category: application product: opencanary detection: selection: logtype: 5002 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects suspicious Django web application framework exceptions that could indicate exploitation attempts. Logsource: django / application. Rule: title: Django Framework Exceptions id: fd435618-981e-4a7c-81f8-f78ce480d616 status: stable description: Detects suspicious Django web application framework exceptions that could indicate exploitation attempts references: - https://docs.djangoproject.com/en/1.11/ref/exceptions/ - https://docs.djangoproject.com/en/1.11/topics/logging/#django-security author: Thomas Patzke date: 2017-08-05 modified: 2020-09-01 tags: - attack.initial-access - attack.t1190 logsource: category: application product: django detection: keywords: - SuspiciousOperation - DisallowedHost - DisallowedModelAdminLookup - DisallowedModelAdminToField - DisallowedRedirect - InvalidSessionKey - RequestDataTooBig - SuspiciousFileOperation - SuspiciousMultipartForm - SuspiciousSession - TooManyFieldsSent - PermissionDenied condition: keywords falsepositives: - Application bugs level: medium
Query: describe CVE-2015-8252
Matching passage: CVE-2015-8252. CWE: CWE-200. CVSS: 5.900000095367432. The Frontel protocol before 3 on RSI Video Technologies Videofied devices sends a cleartext serial number, which allows remote attackers to determine a hardcoded key by sniffing the network and performing a "jumbled up" calculation with this number.
Near-miss passage: CVE-2015-5041. CWE: CWE-200. CVSS: 9.100000381469727. The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20, 7 before SR9 FP30, and 7 R1 before SR3 FP30 allows remote attackers to obtain sensitive information or inject data by invoking non-public interface methods.
Query: how to detect Wordlist Scanning
Matching passage: T1595.003 Wordlist Scanning. Tactics: reconnaissance. Description: Adversaries may iteratively probe infrastructure using brute-forcing and crawling techniques. While this technique employs similar methods to [Brute Force](https://attack.mitre.org/techniques/T1110), its goal is the identification of content and infrastructure rather than the discovery of valid credentials. Wordlists used in these scans may contain generic, commonly used names and file extensions or terms specific to a particular software. Adversaries may also create custom, target-specific wordlists using data gathered from other Reconnaissance techniques (ex: [Gather Victim Org Information](https://attack.mitre.org/techniques/T1591), or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)). For example, adversaries may use web content discovery tools such as Dirb, DirBuster, and GoBuster and generic or custom wordlists to enumerate a website’s pages and directories.(Citation: ClearSky Lebanese Cedar Jan 2021) This can help them to discover old, vulnerable pages or hidden administrative portals that could become the target of further operations (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190) or [Brute Force](https://attack.mitre.org/techniques/T1110)). As cloud storage solutions typically use globally unique names, adversaries may also use target-specific wordlists and tools such as s3recon and GCPBucketBrute to enumerate public and private buckets on cloud infrastructure.(Citation: S3Recon GitHub)(Citation: GCPBucketBrute) Once storage objects are discovered, adversaries may leverage [Data from Cloud Storage](https://attack.mitre.org/techniques/T1530) to access valuable information that can be exfiltrated or used to escalate privileges and move laterally.
Near-miss passage: T1595.001 Scanning IP Blocks. Tactics: reconnaissance. Description: Adversaries may scan victim IP blocks to gather information that can be used during targeting. Public IP addresses may be allocated to organizations by block, or a range of sequential addresses. Adversaries may scan IP blocks in order to [Gather Victim Network Information](https://attack.mitre.org/techniques/T1590), such as which IP addresses are actively in use as well as more detailed information about hosts assigned these addresses. Scans may range from simple pings (ICMP requests and responses) to more nuanced scans that may reveal host software/versions via server banners or other network artifacts.(Citation: Botnet Scan) Information from these scans may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133)).
Query: patch priority for CVE-2015-7262
Matching passage: CVE-2015-7262. CWE: CWE-18. CVSS: 7.5. QNAP iArtist Lite before 1.4.54, as distributed with QNAP Signage Station before 2.0.1, allows remote authenticated users to gain privileges by registering an executable file, and then waiting for this file to be run in a privileged context after a reboot.
Near-miss passage: CVE-2015-0962. CWE: CWE-18. CVSS: 4.300000190734863. Barracuda Web Filter 7.x and 8.x before 8.1.0.005, when SSL Inspection is enabled, uses the same root Certification Authority certificate across different customers' installations, which makes it easier for remote attackers to conduct man-in-the-middle attacks against SSL sessions by leveraging the certificate's trust relationship.
Query: exploit Multiple cross-site scripting (XSS) vulnerabilities in the management web UI in the RabbitMQ management plugin before 3.4.3 allow remote authenticated users to inject arbitrary web
Matching passage: CVE-2015-0862. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in the management web UI in the RabbitMQ management plugin before 3.4.3 allow remote authenticated users to inject arbitrary web script or HTML via (1) message details when a message is unqueued, such as headers or arguments; (2) policy names, which are not properly handled when viewing policies; (3) details for AMQP network clients, such as the version; allow remote authenticated administrators to inject arbitrary web script or HTML via (4) user names, (5) the cluster name; or allow RabbitMQ cluster administrators to (6) modify unspecified content.
Near-miss passage: CVE-2015-6960. CWE: CWE-79. CVSS: 6.099999904632568. edx-platform before 2015-09-17 allows XSS via a team name.
Query: EDR alert: possible Source (T1153)
Matching passage: T1153 Source. Tactics: execution. Description: **This technique has been deprecated and should no longer be used.** The <code>source</code> command loads functions into the current shell or executes files in the current context. This built-in command can be run in two different ways <code>source /path/to/filename [arguments]</code> or <code>.**This technique has been deprecated and should no longer be used.** /path/to/filename [arguments]</code>. Take note of the space after the ".". Without a space, a new shell is created that runs the program instead of running the program within the current context. This is often used to make certain features or functions available to a shell or to update a specific shell's environment.(Citation: Source Manual) Adversaries can abuse this functionality to execute programs. The file executed with this technique does not need to be marked executable beforehand.
Near-miss passage: T1569.003 Systemctl. Tactics: execution. Description: Adversaries may abuse systemctl to execute commands or programs. Systemctl is the primary interface for systemd, the Linux init system and service manager. Typically invoked from a shell, Systemctl can also be integrated into scripts or applications. Adversaries may use systemctl to execute commands or programs as [Systemd Service](https://attack.mitre.org/techniques/T1543/002)s. Common subcommands include: `systemctl start`, `systemctl stop`, `systemctl enable`, `systemctl disable`, and `systemctl status`.(Citation: Red Hat Systemctl 2022)
Query: CVE similar to CVE-2015-8743
Matching passage: CVE-2015-8743. CWE: CWE-125. CVSS: 7.099999904632568. QEMU (aka Quick Emulator) built with the NE2000 device emulation support is vulnerable to an OOB r/w access issue. It could occur while performing 'ioport' r/w operations. A privileged (CAP_SYS_RAWIO) user/process could use this flaw to leak or corrupt QEMU memory bytes.
Near-miss passage: CVE-2015-8984. CWE: CWE-125. CVSS: 5.900000095367432. The fnmatch function in the GNU C Library (aka glibc or libc6) before 2.22 might allow context-dependent attackers to cause a denial of service (application crash) via a malformed pattern, which triggers an out-of-bounds read.
Query: how to detect Malicious Image
Matching passage: T1204.003 Malicious Image. Tactics: execution. Description: Adversaries may rely on a user running a malicious image to facilitate execution. Amazon Web Services (AWS) Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be backdoored. Backdoored images may be uploaded to a public repository via [Upload Malware](https://attack.mitre.org/techniques/T1608/001), and users may then download and deploy an instance or container from the image without realizing the image is malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that executes cryptocurrency mining, in the instance or container.(Citation: Summit Route Malicious AMIs) Adversaries may also name images a certain way to increase the chance of users mistakenly deploying an instance or container from the image (ex: [Match Legitimate Resource Name or Location](https://attack.mitre.org/techniques/T1036/005)).(Citation: Aqua Security Cloud Native Threat Report June 2021)
Near-miss passage: T1204.001 Malicious Link. Tactics: execution. Description: An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will typically be observed as follow-on behavior from [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002). Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203). Links may also lead users to download files that require execution via [Malicious File](https://attack.mitre.org/techniques/T1204/002).
Query: CVE similar to CVE-2015-4316
Matching passage: CVE-2015-4316. CWE: CWE-20. CVSS: 5.5. The Mobile and Remote Access (MRA) endpoint-validation feature in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 improperly validates the phone line used for registration, which allows remote authenticated users to conduct impersonation attacks via a crafted registration, aka Bug ID CSCuv40396.
Near-miss passage: CVE-2015-4951. CWE: CWE-20. CVSS: 5.300000190734863. Client Acceptor Daemon (CAD) in the client in IBM Spectrum Protect (formerly Tivoli Storage Manager) 5.5 and 6.x before 6.3.2.5, 6.4 before 6.4.3.1, and 7.1 before 7.1.3 allows remote attackers to cause a denial of service (daemon crash) via a crafted Web client URL.
Query: detect Detects commandline operations on shell history files in logs
Matching passage: Sigma rule: Detects commandline operations on shell history files. Logsource: linux / auditd. Rule: title: Suspicious History File Operations - Linux id: eae8ce9f-bde9-47a6-8e79-f20d18419910 status: test description: Detects commandline operations on shell history files references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md author: Mikhail Larin, oscd.community date: 2020-10-17 modified: 2022-11-28 tags: - attack.credential-access - attack.t1552.003 logsource: product: linux service: auditd detection: execve: type: EXECVE history: - .bash_history - .zsh_history - .zhistory - .history - .sh_history - fish_history condition: execve and history falsepositives: - Legitimate administrative activity - Legitimate software, cleaning hist file level: medium
Near-miss passage: Sigma rule: Detects Cmdlet names from PowerView of the PowerSploit exploitation framework.. Logsource: windows / ps_script. Rule: title: PowerView PowerShell Cmdlets - ScriptBlock id: dcd74b95-3f36-4ed9-9598-0490951643aa related: - id: b2317cfa-4a47-4ead-b3ff-297438c0bc2d type: similar status: test description: Detects Cmdlet names from PowerView of the PowerSploit exploitation framework. references: - https://powersploit.readthedocs.io/en/stable/Recon/README - https://github.com/PowerShellMafia/PowerSploit/tree/master/Recon - https://thedfirreport.com/2020/10/08/ryuks-return - https://adsecurity.org/?p=2277 author: Bhabesh Raj date: 2021-05-18 modified: 2023-11-22 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - Export-PowerViewCSV - Find-DomainLocalGroupMember - Find-DomainObjectPropertyOutlier - Find-DomainProcess - Find-DomainShare - Find-DomainUserEvent - Find-DomainUserLocation - Find-ForeignGroup - Find-ForeignUser - Find-GPOComputerAdmin - Find-GPOLocation - Find-InterestingDomain - Find-InterestingFile - Find-LocalAdminAccess - Find-ManagedSecurityGroups - Get-CachedRDPConnection - Get-DFSshare - Get-DomainDFSShare - Get-DomainDNSRecord - Get-DomainDNSZone - Get-DomainFileServer - Get-DomainGPOComputerLocalGroupMapping - Get-DomainGPOLocalGroup - Get-DomainGPOUserLocalGroupMapping - Get-LastLoggedOn - Get-LoggedOnLocal - Get-NetFileServer - Get-NetForest - Get-NetGPOGroup - Get-NetProcess - Get-NetRDPSession - Get-RegistryMountedDrive - Get-RegLoggedOn - Get-WMIRegCachedRDPConnection - Get-WMIRegLastLoggedOn - Get-WMIRegMountedDrive - Get-WMIRegProxy - Invoke-ACLScanner - Invoke-CheckLocalAdminAccess - Invoke-EnumerateLocalAdmin - Invoke-EventHunter - Invoke-FileFinder - Invoke-Kerberoast - Invoke-MapDomainTrust - Invoke-ProcessHunter - Invoke-RevertToSelf - Invoke-ShareFinder - Invoke-UserHunter - Invoke-UserImpersonation - Remove-RemoteConnection - Request-SPNTicket - Resolve-IPAddress condition: selection falsepositives: - Unknown level: high
Query: vulnerability: A vulnerability was found in OpenSeaMap online_chart 1.2. It has been classified as problematic. Affected is the function init of the file index.php. The manipulation of the argume
Matching passage: CVE-2015-10074. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability was found in OpenSeaMap online_chart 1.2. It has been classified as problematic. Affected is the function init of the file index.php. The manipulation of the argument mtext leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version staging is able to address this issue. The patch is identified as 8649157158f921590d650e2d2f4bdf0df1017e9d. It is recommended to upgrade the affected component. VDB-220218 is the identifier assigned to this vulnerability.
Near-miss passage: CVE-2015-2329. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.3.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via a crafted order.
Query: risk of Directory traversal vulnerability in unshield 1.0-1.
Matching passage: CVE-2015-1386. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in unshield 1.0-1.
Near-miss passage: CVE-2015-7669. CWE: CWE-22. CVSS: 9.800000190734863. Multiple directory traversal vulnerabilities in (1) includes/MapImportCSV2.php and (2) includes/MapImportCSV.php in the Easy2Map plugin before 1.3.0 for WordPress allow remote attackers to include and execute arbitrary files via the csvfile parameter related to "upload file functionality."
Query: CVE similar to CVE-2015-2811
Matching passage: CVE-2015-2811. CWE: UNKNOWN. CVSS: 5.0. XML external entity (XXE) vulnerability in ReportXmlViewer in SAP NetWeaver Portal 7.31.201109172004 allows remote attackers to send requests to intranet servers via crafted XML, aka SAP Security Note 2111939.
Near-miss passage: CVE-2015-4831. CWE: UNKNOWN. CVSS: 4.900000095367432. Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect availability via unknown vectors related to Solaris Kernel Zones, a different vulnerability than CVE-2015-4822.
Query: exploit WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and appli
Matching passage: CVE-2015-7095. CWE: CWE-119. CVSS: 6.800000190734863. WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7096, CVE-2015-7097, CVE-2015-7098, CVE-2015-7099, CVE-2015-7100, CVE-2015-7101, CVE-2015-7102, and CVE-2015-7103.
Near-miss passage: CVE-2015-5547. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5544, CVE-2015-5545, CVE-2015-5546, CVE-2015-5548, CVE-2015-5549, CVE-2015-5552, and CVE-2015-5553.
Query: secure coding against Improper Neutralization of Invalid Characters in Identifiers in Web Pages
Matching passage: CWE-86 Improper Neutralization of Invalid Characters in Identifiers in Web Pages. The product does not neutralize or incorrectly neutralizes invalid characters or byte sequences in the middle of tag names, URI schemes, and other identifiers.
Near-miss passage: CWE-620 Unverified Password Change. When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.