alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit Cross-site scripting (XSS) vulnerability in the Taxonews module before 6.x-1.2 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer taxonomy
Matching passage: CVE-2015-3369. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Taxonews module before 6.x-1.2 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via a term name in a block.
Near-miss passage: CVE-2015-0766. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the administrative web interface in the Management Center component in Cisco FireSIGHT System Software 6.0.0 allow remote attackers to inject arbitrary web script or HTML via unspecified fields, aka Bug IDs CSCus93566, CSCut31557, and CSCut47196.
Query: exploit Belkin F9K1102 2 devices with firmware 2.10.17 use an improper algorithm for selecting the ID value in the header of a DNS query, which makes it easier for remote attackers to spoo
Matching passage: CVE-2015-5987. CWE: UNKNOWN. CVSS: 8.600000381469727. Belkin F9K1102 2 devices with firmware 2.10.17 use an improper algorithm for selecting the ID value in the header of a DNS query, which makes it easier for remote attackers to spoof responses by predicting this value.
Near-miss passage: CVE-2015-4880. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 10.1.3.5.1 allows remote attackers to affect integrity via unknown vectors related to Content Server, a different vulnerability than CVE-2015-4867.
Query: risk of Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to cause a denial of service (NUL
Matching passage: CVE-2015-0328. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2015-0325 and CVE-2015-0326.
Near-miss passage: CVE-2015-1243. CWE: UNKNOWN. CVSS: 7.5. Use-after-free vulnerability in the MutationObserver::disconnect function in core/dom/MutationObserver.cpp in the DOM implementation in Blink, as used in Google Chrome before 42.0.2311.135, allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering an attempt to unregister a MutationObserver object that is not currently registered.
Query: write Sigma for Detects the execution of an MSI file using PowerShell and the WMI Win32_Product class
Matching passage: Sigma rule: Detects the execution of an MSI file using PowerShell and the WMI Win32_Product class. Logsource: windows / ps_script. Rule: title: PowerShell WMI Win32_Product Install MSI id: 91109523-17f0-4248-a800-f81d9e7c081d status: test description: Detects the execution of an MSI file using PowerShell and the WMI Win32_Product class references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md author: frack113 date: 2022-04-24 tags: - attack.stealth - attack.t1218.007 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - 'Invoke-CimMethod ' - '-ClassName ' - 'Win32_Product ' - '-MethodName ' - .msi condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the creation of a new bits job by PowerShell. Logsource: windows / bits-client. Rule: title: New BITS Job Created Via PowerShell id: fe3a2d49-f255-4d10-935c-bda7391108eb status: test description: Detects the creation of a new bits job by PowerShell references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md author: frack113 date: 2022-03-01 modified: 2023-03-27 tags: - attack.persistence - attack.execution - attack.stealth - attack.t1197 logsource: product: windows service: bits-client detection: selection: EventID: 3 processPath|endswith: - \powershell.exe - \pwsh.exe condition: selection falsepositives: - Administrator PowerShell scripts level: low
Query: detection rule: Detects inline execution of PowerShell code from a file
Matching passage: Sigma rule: Detects inline execution of PowerShell code from a file. Logsource: windows / process_creation. Rule: title: Powershell Inline Execution From A File id: ee218c12-627a-4d27-9e30-d6fb2fe22ed2 status: test description: Detects inline execution of PowerShell code from a file references: - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=50 author: frack113 date: 2022-12-25 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: process_creation detection: selection_exec: CommandLine|contains: - 'iex ' - 'Invoke-Expression ' - 'Invoke-Command ' - 'icm ' selection_read: CommandLine|contains: - 'cat ' - 'get-content ' - 'type ' selection_raw: CommandLine|contains: ' -raw' condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects attempts to inject a sidecar container into a running deployment. A sidecar container is an additional container. Logsource: kubernetes / application / audit. Rule: title: Potential Sidecar Injection Into Running Deployment id: ad9012a6-e518-4432-9890-f3b82b8fc71f status: test description: 'Detects attempts to inject a sidecar container into a running deployment. A sidecar container is an additional container within a pod, that resides alongside the main container. One way to add containers to running resources like Deployments/DeamonSets/StatefulSets, is via a "kubectl patch" operation. By injecting a new container within a legitimate pod, an attacker can run their code and hide their activity, instead of running their own separated pod in the cluster. ' references: - https://kubernetes.io/docs/tasks/manage-kubernetes-objects/update-api-object-kubectl-patch - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Sidecar%20Injection/ author: Leo Tsaousis (@laripping) date: 2024-03-26 tags: - attack.t1609 - attack.execution logsource: category: application product: kubernetes service: audit detection: selection: verb: patch apiGroup: apps objectRef.resource: deployments condition: selection falsepositives: - Unknown level: medium
Query: vulnerability: 2Checkout Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Matching passage: CVE-2015-9364. CWE: CWE-79. CVSS: 6.099999904632568. 2Checkout Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Near-miss passage: CVE-2015-0156. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.6.0 and WebSphere Lombardi Edition (WLE) 7.2.x through 7.2.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Query: alert when Detects the Installation of a Exchange Transport Agent
Matching passage: Sigma rule: Detects the Installation of a Exchange Transport Agent. Logsource: windows / process_creation. Rule: title: MSExchange Transport Agent Installation id: 83809e84-4475-4b69-bc3e-4aad8568612f related: - id: 83809e84-4475-4b69-bc3e-4aad8568612f type: similar status: test description: Detects the Installation of a Exchange Transport Agent references: - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=7 author: Tobias Michalski (Nextron Systems) date: 2021-06-08 modified: 2022-10-09 tags: - attack.persistence - attack.t1505.002 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: Install-TransportAgent condition: selection falsepositives: - Legitimate installations of exchange TransportAgents. AssemblyPath is a good indicator for this. level: medium
Near-miss passage: Sigma rule: setupapi.dll library provide InstallHinfSection function for processing INF files. INF file may contain instructions all. Logsource: windows / process_creation. Rule: title: Suspicious Rundll32 Setupapi.dll Activity id: 285b85b1-a555-4095-8652-a8a4106af63f status: test description: setupapi.dll library provide InstallHinfSection function for processing INF files. INF file may contain instructions allowing to create values in the registry, modify files and install drivers. This technique could be used to obtain persistence via modifying one of Run or RunOnce registry keys, run process or use other DLLs chain calls (see references) InstallHinfSection function in setupapi.dll calls runonce.exe executable regardless of actual content of INF file. references: - https://lolbas-project.github.io/lolbas/Libraries/Setupapi/ - https://gist.githubusercontent.com/bohops/0cc6586f205f3691e04a1ebf1806aabd/raw/baf7b29891bb91e76198e30889fbf7d6642e8974/calc_exe.inf - https://raw.githubusercontent.com/huntresslabs/evading-autoruns/master/shady.inf - https://twitter.com/Z3Jpa29z/status/1313742350292746241?s=20 author: Konstantin Grishchenko, oscd.community date: 2020-10-07 modified: 2021-11-27 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection: Image|endswith: \runonce.exe ParentImage|endswith: \rundll32.exe ParentCommandLine|contains|all: - setupapi.dll - InstallHinfSection condition: selection falsepositives: - Scripts and administrative tools that use INF files for driver installation with setupapi.dll level: medium
Query: vulnerability: The firmware in MNS before 4.5.6 on Belden GarrettCom Magnum 6K and Magnum 10K switches uses hardcoded RSA private keys and certificates across different customers' installations, 
Matching passage: CVE-2015-3960. CWE: CWE-310. CVSS: 4.300000190734863. The firmware in MNS before 4.5.6 on Belden GarrettCom Magnum 6K and Magnum 10K switches uses hardcoded RSA private keys and certificates across different customers' installations, which makes it easier for remote attackers to defeat cryptographic protection mechanisms for HTTPS sessions by leveraging knowledge of a private key from another installation.
Near-miss passage: CVE-2015-4056. CWE: CWE-310. CVSS: 6.699999809265137. The System Library in VCE Vision Intelligent Operations before 2.6.5 does not properly implement cryptography, which makes it easier for local users to discover credentials by leveraging administrative access.
Query: detection rule: Detect suspicious parent processes of well-known Windows processes
Matching passage: Sigma rule: Detect suspicious parent processes of well-known Windows processes. Logsource: windows / process_creation. Rule: title: Windows Processes Suspicious Parent Directory id: 96036718-71cc-4027-a538-d1587e0006a7 status: test description: Detect suspicious parent processes of well-known Windows processes references: - https://web.archive.org/web/20180718061628/https://securitybytes.io/blue-team-fundamentals-part-two-windows-processes-759fe15965e2 - https://www.carbonblack.com/2014/06/10/screenshot-demo-hunt-evil-faster-than-ever-with-carbon-black/ - https://www.13cubed.com/downloads/windows_process_genealogy_v2.pdf author: vburov date: 2019-02-23 modified: 2025-03-06 tags: - attack.stealth - attack.t1036.003 - attack.t1036.005 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \svchost.exe - \taskhost.exe - \lsm.exe - \lsass.exe - \services.exe - \lsaiso.exe - \csrss.exe - \wininit.exe - \winlogon.exe filter_sys: - ParentImage|endswith: - \SavService.exe - \ngen.exe - ParentImage|contains: - \System32\ - \SysWOW64\ filter_msmpeng: ParentImage|contains: - \Windows Defender\ - \Microsoft Security Client\ ParentImage|endswith: \MsMpEng.exe filter_null: - ParentImage: null - ParentImage: - '' - '-' condition: selection and not 1 of filter_* falsepositives: - Some security products seem to spawn these level: low
Near-miss passage: Sigma rule: Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon parent process or directory. Logsource: windows / file_event. Rule: title: NTDS.DIT Creation By Uncommon Parent Process id: 4e7050dd-e548-483f-b7d6-527ab4fa784d related: - id: 11b1ed55-154d-4e82-8ad7-83739298f720 type: similar status: test description: Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon parent process or directory references: - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration - https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/ - https://pentestlab.blog/tag/ntds-dit/ - https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Gather/Copy-VSS.ps1 author: Florian Roth (Nextron Systems) date: 2022-03-11 modified: 2023-01-05 tags: - attack.credential-access - attack.t1003.003 logsource: product: windows category: file_event definition: 'Requirements: The "ParentImage" field is not available by default on EID 11 of Sysmon logs. To be able to use this rule to the full extent you need to enrich the log with additional ParentImage data' detection: selection_file: TargetFilename|endswith: \ntds.dit selection_process_parent: ParentImage|endswith: - \cscript.exe - \httpd.exe - \nginx.exe - \php-cgi.exe - \powershell.exe - \pwsh.exe - \w3wp.exe - \wscript.exe selection_process_parent_path: ParentImage|contains: - \apache - \tomcat - \AppData\ - \Temp\ - \Public\ - \PerfLogs\ condition: selection_file and 1 of selection_process_* falsepositives: - Unknown level: high
Query: exploit The ssl-proxy-openssl.c function in Dovecot before 2.2.17, when SSLv3 is disabled, allow remote attackers to cause a denial of service (login process crash) via vectors related to 
Matching passage: CVE-2015-3420. CWE: CWE-295. CVSS: 5.900000095367432. The ssl-proxy-openssl.c function in Dovecot before 2.2.17, when SSLv3 is disabled, allow remote attackers to cause a denial of service (login process crash) via vectors related to handshake failures.
Near-miss passage: CVE-2015-0210. CWE: CWE-295. CVSS: 5.900000095367432. wpa_supplicant 2.0-16 does not properly check certificate subject name, which allows remote attackers to cause a man-in-the-middle attack.
Query: CVE similar to CVE-2015-1000012
Matching passage: CVE-2015-1000012. CWE: CWE-200. CVSS: 7.5. Local File Inclusion Vulnerability in mypixs v0.3 wordpress plugin
Near-miss passage: CVE-2015-5340. CWE: CWE-200. CVSS: 4.300000190734863. Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not consider the moodle/badges:viewbadges capability, which allows remote authenticated users to obtain sensitive badge information via a request involving (1) badges/overview.php or (2) badges/view.php.
Query: CVE similar to CVE-2015-5940
Matching passage: CVE-2015-5940. CWE: CWE-119. CVSS: 6.800000190734863. The Accelerate Framework component in Apple iOS before 9.1 and OS X before 10.11.1, when multi-threading is enabled, omits certain validation and locking steps, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Near-miss passage: CVE-2015-7894. CWE: CWE-119. CVSS: 8.800000190734863. The DCMProvider service in Samsung LibQjpeg on a Samsung SM-G925V device running build number LRX22G.G925VVRU1AOE2 allows remote attackers to cause a denial of service (segmentation fault and process crash) and execute arbitrary code via a crafted JPG.
Query: Sigma rule for Detects the use of Tor or Tor-Browser to connect to onion routing networks
Matching passage: Sigma rule: Detects the use of Tor or Tor-Browser to connect to onion routing networks. Logsource: windows / process_creation. Rule: title: Tor Client/Browser Execution id: 62f7c9bf-9135-49b2-8aeb-1e54a6ecc13c status: test description: Detects the use of Tor or Tor-Browser to connect to onion routing networks references: - https://www.logpoint.com/en/blog/detecting-tor-use-with-logpoint/ author: frack113 date: 2022-02-20 modified: 2025-10-27 tags: - attack.command-and-control - attack.t1090.003 logsource: category: process_creation product: windows detection: selection: - Description: Tor Browser - Product: Tor Browser - Image|endswith: - \tor.exe - \Tor Browser\Browser\firefox.exe condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_tor_execution/info.yml
Near-miss passage: Sigma rule: Detects the execution of some potentially unwanted tools such as PsExec, Procdump, etc. (part of the Sysinternals suite). Logsource: windows / registry_set. Rule: title: PUA - Sysinternals Tools Execution - Registry id: c7da8edc-49ae-45a2-9e61-9fd860e4e73d related: - id: 25ffa65d-76d8-4da5-a832-3f2b0136e133 type: derived - id: 9841b233-8df8-4ad7-9133-b0b4402a9014 type: obsolete status: test description: Detects the execution of some potentially unwanted tools such as PsExec, Procdump, etc. (part of the Sysinternals suite) via the creation of the "accepteula" registry key. references: - https://twitter.com/Moti_B/status/1008587936735035392 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-24 modified: 2025-10-26 tags: - attack.resource-development - attack.t1588.002 logsource: product: windows category: registry_set detection: selection: TargetObject|contains: - \Active Directory Explorer - \Handle - \LiveKd - \Process Explorer - \ProcDump - \PsExec - \PsLoglist - \PsPasswd - \SDelete - \Sysinternals TargetObject|endswith: \EulaAccepted condition: selection falsepositives: - Legitimate use of SysInternals tools. Filter the legitimate paths used in your environment level: medium regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_pua_sysinternals_susp_execution_via_eula/info.yml
Query: exploit In all Android releases from CAF using the Linux kernel, a DRM key was exposed to QTEE applications.
Matching passage: CVE-2015-9032. CWE: CWE-200. CVSS: 3.299999952316284. In all Android releases from CAF using the Linux kernel, a DRM key was exposed to QTEE applications.
Near-miss passage: CVE-2015-5898. CWE: CWE-200. CVSS: 2.0999999046325684. CFNetwork in Apple iOS before 9 relies on the hardware UID for its cache encryption key, which makes it easier for physically proximate attackers to obtain sensitive information by obtaining this UID.
Query: vulnerability: Cross-site request forgery (CSRF) vulnerability in SecuritySetting/UserSecurity/UserManagement.aspx in B.A.S C2Box before 4.0.0 (r19171) allows remote attackers to hijack the authe
Matching passage: CVE-2015-4460. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in SecuritySetting/UserSecurity/UserManagement.aspx in B.A.S C2Box before 4.0.0 (r19171) allows remote attackers to hijack the authentication of administrators for requests that add administrator accounts via certain vectors.
Near-miss passage: CVE-2015-9432. CWE: CWE-352. CVSS: 6.5. The alpine-photo-tile-for-instagram plugin before 1.2.7.6 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=alpine-photo-tile-for-instagram-settings tab parameter.
Query: Encoded PowerShell / command-line abuse matching Transmitted Data Manipulation
Matching passage: T1565.002 Transmitted Data Manipulation. Tactics: impact. Description: Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating transmitted data, adversaries may attempt to affect a business process, organizational understanding, and decision making. Manipulation may be possible over a network connection or between system processes where there is an opportunity deploy a tool that will intercept and change information. The type of modification and the impact it will have depends on the target transmission mechanism as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
Near-miss passage: T1565.001 Stored Data Manipulation. Tactics: impact. Description: Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating stored data, adversaries may attempt to affect a business process, organizational understanding, and decision making. Stored data could include a variety of file formats, such as Office files, databases, stored emails, and custom file formats. The type of modification and the impact it will have depends on the type of data as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
Query: describe CVE-2015-8058
Matching passage: CVE-2015-8058. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Near-miss passage: CVE-2015-0706. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in Cisco FireSIGHT System Software 5.3.1.1, 5.3.1.2, and 6.0.0 in FireSIGHT Management Center allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted HTTP header, aka Bug IDs CSCut06060, CSCut06056, and CSCus98966.