alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit Cross-site scripting (XSS) vulnerability in PHPVibe before 4.21 allows remote authenticated users to inject arbitrary web script or HTML via a comment.
Matching passage: CVE-2015-5399. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in PHPVibe before 4.21 allows remote authenticated users to inject arbitrary web script or HTML via a comment.
Near-miss passage: CVE-2015-1026. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in ZOHO ManageEngine ADManager Plus before 6.2 Build 6270 allow remote attackers to inject arbitrary web script or HTML via the (1) technicianSearchText parameter to the Help Desk Technician page or (2) rolesSearchText parameter to the Help Desk Roles.
Query: write Sigma for Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class
Matching passage: Sigma rule: Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class. Logsource: windows / image_load. Rule: title: Potential DCOM InternetExplorer.Application DLL Hijack - Image Load id: f354eba5-623b-450f-b073-0b5b2773b6aa related: - id: e554f142-5cf3-4e55-ace9-a1b59e0def65 type: obsolete - id: 2f7979ae-f82b-45af-ac1d-2b10e93b0baa type: similar status: test description: Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class references: - https://threathunterplaybook.com/hunts/windows/201009-RemoteDCOMIErtUtilDLLHijack/notebook.html author: Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR), wagga date: 2020-10-12 modified: 2022-12-18 tags: - attack.lateral-movement - attack.t1021.002 - attack.t1021.003 logsource: product: windows category: image_load detection: selection: Image|endswith: \Internet Explorer\iexplore.exe ImageLoaded|endswith: \Internet Explorer\iertutil.dll condition: selection falsepositives: - Unknown level: critical
Near-miss passage: Sigma rule: Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or fir. Logsource: windows / process_creation. Rule: title: PUA - Fast Reverse Proxy (FRP) Execution id: 32410e29-5f94-4568-b6a3-d91a8adad863 status: test description: Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or firewall to the Internet. references: - https://asec.ahnlab.com/en/38156/ - https://github.com/fatedier/frp author: frack113, Florian Roth date: 2022-09-02 modified: 2024-11-23 tags: - attack.command-and-control - attack.t1090 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: - \frpc.exe - \frps.exe selection_cli: CommandLine|contains: \frpc.ini selection_hashes: Hashes|contains: - MD5=7D9C233B8C9E3F0EA290D2B84593C842 - SHA1=06DDC9280E1F1810677935A2477012960905942F - SHA256=57B0936B8D336D8E981C169466A15A5FD21A7D5A2C7DAF62D5E142EE860E387C condition: 1 of selection_* falsepositives: - Legitimate use level: high
Query: CVE similar to CVE-2015-4633
Matching passage: CVE-2015-4633. CWE: CWE-89. CVSS: 9.800000190734863. Multiple SQL injection vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow (1) remote attackers to execute arbitrary SQL commands via the number parameter to opac-tags_subject.pl in the OPAC interface or (2) remote authenticated users to execute arbitrary SQL commands via the Filter or (3) Criteria parameter to reports/borrowers_out.pl in the Staff interface.
Near-miss passage: CVE-2015-4592. CWE: CWE-89. CVSS: 8.800000190734863. eClinicalWorks Population Health (CCMR) suffers from an SQL injection vulnerability in portalUserService.jsp which allows remote authenticated users to inject arbitrary malicious database commands as part of user input.
Query: exploit In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, and SD 820A,
Matching passage: CVE-2015-9114. CWE: CWE-476. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, and SD 820A, lack of address argument validation in qsee_query_counter syscall could lead to untrusted pointer dereference.
Near-miss passage: CVE-2015-9072. CWE: CWE-476. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, an untrusted pointer dereference can occur in a TrustZone syscall.
Query: vulnerability: Multiple cross-site scripting (XSS) vulnerabilities in unspecified frontend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allow remote authenticated editors to injec
Matching passage: CVE-2015-8758. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in unspecified frontend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allow remote authenticated editors to inject arbitrary web script or HTML via unknown vectors.
Near-miss passage: CVE-2015-0766. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the administrative web interface in the Management Center component in Cisco FireSIGHT System Software 6.0.0 allow remote attackers to inject arbitrary web script or HTML via unspecified fields, aka Bug IDs CSCus93566, CSCut31557, and CSCut47196.
Query: risk of Unspecified vulnerability in HP Integrated Lights-Out (iLO) firmware 3 before 1.85 and 4 before 2.22 allows remote authenticated users to cause a denial of service via unknown vect
Matching passage: CVE-2015-5435. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in HP Integrated Lights-Out (iLO) firmware 3 before 1.85 and 4 before 2.22 allows remote authenticated users to cause a denial of service via unknown vectors.
Near-miss passage: CVE-2015-3127. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3118, CVE-2015-3124, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, CVE-2015-4430, and CVE-2015-5117.
Query: detect Detects a Chromium based browser process with the 'load-extension' flag to start a instance with a custom extension in logs
Matching passage: Sigma rule: Detects a Chromium based browser process with the 'load-extension' flag to start a instance with a custom extension. Logsource: windows / process_creation. Rule: title: Chromium Browser Instance Executed With Custom Extension id: 88d6e60c-759d-4ac1-a447-c0f1466c2d21 related: - id: 27ba3207-dd30-4812-abbf-5d20c57d474e type: similar status: test description: Detects a Chromium based browser process with the 'load-extension' flag to start a instance with a custom extension references: - https://redcanary.com/blog/chromeloader/ - https://emkc.org/s/RJjuLa - https://www.mandiant.com/resources/blog/lnk-between-browsers author: Aedan Russell, frack113, X__Junior (Nextron Systems) date: 2022-06-19 modified: 2023-11-28 tags: - attack.persistence - attack.t1176.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \brave.exe - \chrome.exe - \msedge.exe - \opera.exe - \vivaldi.exe CommandLine|contains: --load-extension= condition: selection falsepositives: - Usage of Chrome Extensions in testing tools such as BurpSuite will trigger this alert level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_chromium_load_extension/info.yml
Near-miss passage: Sigma rule: Show when a monitor or a span/rspan is setup or modified. Logsource: cisco / aaa. Rule: title: Cisco Sniffing id: b9e1f193-d236-4451-aaae-2f3d2102120d status: test description: Show when a monitor or a span/rspan is setup or modified author: Austin Clark date: 2019-08-11 modified: 2023-01-04 tags: - attack.credential-access - attack.discovery - attack.t1040 logsource: product: cisco service: aaa detection: keywords: - monitor capture point - set span - set rspan condition: keywords falsepositives: - Admins may setup new or modify old spans, or use a monitor for troubleshooting level: medium
Query: actor TTPs: Web Services
Matching passage: T1584.006 Web Services. Tactics: resource development. Description: Adversaries may compromise access to third-party web services that can be used during targeting. A variety of popular websites exist for legitimate users to register for web-based services, such as GitHub, Twitter, Dropbox, Google, SendGrid, etc. Adversaries may try to take ownership of a legitimate user's access to a web service and use that web service as infrastructure in support of cyber operations. Such web services can be abused during later stages of the adversary lifecycle, such as during Command and Control ([Web Service](https://attack.mitre.org/techniques/T1102)), [Exfiltration Over Web Service](https://attack.mitre.org/techniques/T1567), or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Recorded Future Turla Infra 2020) Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, particularly when access is stolen from legitimate users, adversaries can make it difficult to physically tie back operations to them. Additionally, leveraging compromised web-based email services may allow adversaries to leverage the trust associated with legitimate domains.
Near-miss passage: T1584.004 Server. Tactics: resource development. Description: Adversaries may compromise third-party servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, including for Command and Control.(Citation: TrendMicro EarthLusca 2022) Instead of purchasing a [Server](https://attack.mitre.org/techniques/T1583/004) or [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003), adversaries may compromise third-party servers in support of operations. Adversaries may also compromise web servers to support watering hole operations, as in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), or email servers to support [Phishing](https://attack.mitre.org/techniques/T1566) operations.
Query: describe CVE-2015-3119
Matching passage: CVE-2015-3119. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-3120, CVE-2015-3121, CVE-2015-3122, and CVE-2015-4433.
Near-miss passage: CVE-2015-8049. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in the TextField object implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via a crafted autoSize property value, a different vulnerability than CVE-2015-8048, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: risk of The Unity Settings Daemon before 14.04.0+14.04.20150825-0ubuntu2 and 15.04.x before 15.04.1+15.04.20150408-0ubuntu1.2 does not properly detect if the screen is locked, which allows
Matching passage: CVE-2015-1319. CWE: CWE-20. CVSS: 2.0999999046325684. The Unity Settings Daemon before 14.04.0+14.04.20150825-0ubuntu2 and 15.04.x before 15.04.1+15.04.20150408-0ubuntu1.2 does not properly detect if the screen is locked, which allows physically proximate attackers to mount removable media while the screen is locked as demonstrated by inserting a USB thumb drive.
Near-miss passage: CVE-2015-5230. CWE: CWE-20. CVSS: 7.5. The DNS packet parsing/generation code in PowerDNS (aka pdns) Authoritative Server 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (crash) via crafted query packets.
Query: CVE similar to CVE-2015-8955
Matching passage: CVE-2015-8955. CWE: CWE-264. CVSS: 7.300000190734863. arch/arm64/kernel/perf_event.c in the Linux kernel before 4.1 on arm64 platforms allows local users to gain privileges or cause a denial of service (invalid pointer dereference) via vectors involving events that are mishandled during a span of multiple HW PMUs.
Near-miss passage: CVE-2015-6265. CWE: CWE-264. CVSS: 4.300000190734863. The CLI in Cisco Application Control Engine (ACE) 4700 A5 3.0 and earlier allows local users to bypass intended access restrictions, and read or write to files, by entering an unspecified CLI command with a crafted file as this command's input, aka Bug ID CSCur23662.
Query: write Sigma for Detect PetitPotam coerced authentication activity.
Matching passage: Sigma rule: Detect PetitPotam coerced authentication activity.. Logsource: windows / security. Rule: title: Possible PetitPotam Coerce Authentication Attempt id: 1ce8c8a3-2723-48ed-8246-906ac91061a6 status: test description: Detect PetitPotam coerced authentication activity. references: - https://github.com/topotam/PetitPotam - https://github.com/splunk/security_content/blob/0dd6de32de2118b2818550df9e65255f4109a56d/detections/endpoint/petitpotam_network_share_access_request.yml author: Mauricio Velazco, Michael Haag date: 2021-09-02 modified: 2022-08-11 tags: - attack.credential-access - attack.t1187 logsource: product: windows service: security definition: The advanced audit policy setting "Object Access > Detailed File Share" must be configured for Success/Failure detection: selection: EventID: 5145 ShareName|startswith: \\\\ ShareName|endswith: \IPC$ RelativeTargetName: lsarpc SubjectUserName: ANONYMOUS LOGON condition: selection falsepositives: - Unknown. Feedback welcomed. level: high
Near-miss passage: Sigma rule: Detects execution of "VSDiagnostics.exe" with the "start" command in order to launch and proxy arbitrary binaries.. Logsource: windows / process_creation. Rule: title: Potential Binary Proxy Execution Via VSDiagnostics.EXE id: ac1c92b4-ac81-405a-9978-4604d78cc47e status: test description: Detects execution of "VSDiagnostics.exe" with the "start" command in order to launch and proxy arbitrary binaries. references: - https://twitter.com/0xBoku/status/1679200664013135872 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-03 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \VSDiagnostics.exe - OriginalFileName: VSDiagnostics.exe selection_cli_start: CommandLine|contains: start selection_cli_launch: CommandLine|contains: - ' /launch:' - ' -launch:' condition: all of selection_* falsepositives: - Legitimate usage for tracing and diagnostics purposes level: medium
Query: Sigma YAML for windows / system
Matching passage: Sigma rule: Detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mappin. Logsource: windows / system. Rule: title: Certificate Use With No Strong Mapping id: 993c2665-e6ef-40e3-a62a-e1a97686af79 status: test description: 'Detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mapping, key trust mapping, or a SID) This could be a sign of exploitation of the elevation of privilege vulnerabilities (CVE-2022-34691, CVE-2022-26931, CVE-2022-26923) that can occur when the KDC allows certificate spoofing by not requiring a strong mapping. Events where the AccountName and CN of the Subject do not match, or where the CN ends in a dollar sign indicating a machine, may indicate certificate spoofing. ' references: - https://support.microsoft.com/en-us/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16 author: '@br4dy5' date: 2023-10-09 modified: 2025-09-22 tags: - attack.privilege-escalation logsource: product: windows service: system detection: selection: Provider_Name: - Kerberos-Key-Distribution-Center - Microsoft-Windows-Kerberos-Key-Distribution-Center EventID: - 39 - 41 condition: selection falsepositives: - If prevalent in the environment, filter on events where the AccountName and CN of the Subject do not reference the same user - If prevalent in the environment, filter on CNs that end in a dollar sign indicating it is a machine name level: medium
Near-miss passage: Sigma rule: Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been. Logsource: macos / process_creation. Rule: title: Remote Access Tool - Team Viewer Session Started On MacOS Host id: f459ccb4-9805-41ea-b5b2-55e279e2424a related: - id: ab70c354-d9ac-4e11-bbb6-ec8e3b153357 type: similar - id: 1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d type: similar status: test description: 'Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder. ' references: - Internal Research author: Josh Nickels, Qi Nan date: 2024-03-11 tags: - attack.persistence - attack.initial-access - attack.t1133 logsource: category: process_creation product: macos detection: selection: ParentImage|endswith: /TeamViewer_Service Image|endswith: /TeamViewer_Desktop CommandLine|endswith: /TeamViewer_Desktop --IPCport 5939 --Module 1 condition: selection falsepositives: - Legitimate usage of TeamViewer level: low
Query: exploit IBM InfoSphere Information Server could allow a local user under special circumstances to execute commands during installation processes that could expose sensitive information.
Matching passage: CVE-2015-7493. CWE: CWE-200. CVSS: 4.699999809265137. IBM InfoSphere Information Server could allow a local user under special circumstances to execute commands during installation processes that could expose sensitive information.
Near-miss passage: CVE-2015-5831. CWE: CWE-200. CVSS: 5.0. NetworkExtension in the kernel in Apple iOS before 9 does not properly initialize an unspecified data structure, which allows attackers to obtain sensitive memory-layout information via a crafted app.
Query: rule covering Turn off logging locally or remote
Matching passage: Sigma rule: Turn off logging locally or remote. Logsource: cisco / aaa. Rule: title: Cisco Disabling Logging id: 9e8f6035-88bf-4a63-96b6-b17c0508257e status: test description: Turn off logging locally or remote references: - https://www.cisco.com/en/US/docs/ios/security/command/reference/sec_a2.pdf author: Austin Clark date: 2019-08-11 modified: 2023-01-04 tags: - attack.defense-impairment - attack.t1685 logsource: product: cisco service: aaa detection: keywords: - no logging - no aaa new-model condition: keywords falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the creation of a schtask via PowerSploit or Empire Default Configuration.. Logsource: windows / process_creation. Rule: title: HackTool - Default PowerSploit/Empire Scheduled Task Creation id: 56c217c3-2de2-479b-990f-5c109ba8458f status: test description: Detects the creation of a schtask via PowerSploit or Empire Default Configuration. references: - https://github.com/0xdeadbeefJERKY/PowerSploit/blob/8690399ef70d2cad10213575ac67e8fa90ddf7c3/Persistence/Persistence.psm1 - https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/lib/modules/powershell/persistence/userland/schtasks.py author: Markus Neis, @Karneades date: 2018-03-06 modified: 2023-03-03 tags: - attack.execution - attack.persistence - attack.privilege-escalation - attack.s0111 - attack.g0022 - attack.g0060 - car.2013-08-001 - attack.t1053.005 - attack.t1059.001 logsource: product: windows category: process_creation detection: selection: ParentImage|endswith: - \powershell.exe - \pwsh.exe Image|endswith: \schtasks.exe CommandLine|contains|all: - /Create - powershell.exe -NonI - /TN Updater /TR CommandLine|contains: - /SC ONLOGON - /SC DAILY /ST - /SC ONIDLE - /SC HOURLY condition: selection falsepositives: - Unlikely level: high
Query: risk of qdPM 8.3 allows remote attackers to obtain sensitive information via invalid ID value to index.php/users/info/id/[ID], which reveals the installation path in an error message.
Matching passage: CVE-2015-3882. CWE: CWE-200. CVSS: 5.300000190734863. qdPM 8.3 allows remote attackers to obtain sensitive information via invalid ID value to index.php/users/info/id/[ID], which reveals the installation path in an error message.
Near-miss passage: CVE-2015-1000012. CWE: CWE-200. CVSS: 7.5. Local File Inclusion Vulnerability in mypixs v0.3 wordpress plugin
Query: vulnerability: The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and 
Matching passage: CVE-2015-2550. CWE: CWE-264. CVSS: 7.199999809265137. The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka "Windows Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-8236. CWE: CWE-264. CVSS: 10.0. Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.1 allows remote attackers to execute arbitrary code as root by leveraging management-plane access, aka Bug 138716.
Query: patch priority for CVE-2015-2778
Matching passage: CVE-2015-2778. CWE: CWE-399. CVSS: 5.0. Quassel before 0.12-rc1 uses an incorrect data-type size when splitting a message, which allows remote attackers to cause a denial of service (crash) via a long CTCP query containing only multibyte characters.
Near-miss passage: CVE-2015-1730. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."