alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Detects usage of wsudo (Windows Sudo Utility). Which is a tool that let the user execute programs with different permiss
Matching passage: Sigma rule: Detects usage of wsudo (Windows Sudo Utility). Which is a tool that let the user execute programs with different permiss. Logsource: windows / process_creation. Rule: title: PUA - Wsudo Suspicious Execution id: bdeeabc9-ff2a-4a51-be59-bb253aac7891 status: test description: Detects usage of wsudo (Windows Sudo Utility). Which is a tool that let the user execute programs with different permissions (System, Trusted Installer, Administrator...etc) references: - https://github.com/M2Team/Privexec/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-02 modified: 2023-02-14 tags: - attack.execution - attack.privilege-escalation - attack.t1059 logsource: category: process_creation product: windows detection: selection_metadata: - Image|endswith: \wsudo.exe - OriginalFileName: wsudo.exe - Description: Windows sudo utility - ParentImage|endswith: \wsudo-bridge.exe selection_cli: CommandLine|contains: - -u System - -uSystem - -u TrustedInstaller - -uTrustedInstaller - ' --ti ' condition: 1 of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when an attacker modifies the "REG_MULTI_SZ" value named "Extensions" to include a custom DLL to achieve persist. Logsource: windows / registry_set. Rule: title: Potential Persistence Via LSA Extensions id: 41f6531d-af6e-4c6e-918f-b946f2b85a36 status: test description: 'Detects when an attacker modifies the "REG_MULTI_SZ" value named "Extensions" to include a custom DLL to achieve persistence via lsass. The "Extensions" list contains filenames of DLLs being automatically loaded by lsass.exe. Each DLL has its InitializeLsaExtension() method called after loading. ' references: - https://persistence-info.github.io/Data/lsaaextension.html - https://twitter.com/0gtweet/status/1476286368385019906 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-21 modified: 2023-08-17 tags: - attack.persistence logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \SYSTEM\CurrentControlSet\Control\LsaExtensionConfig\LsaSrv\Extensions condition: selection falsepositives: - Unlikely level: high
Query: alert when Detects applications being added to the "allowed applications" list of exploit guard in order to bypass controlled folde
Matching passage: Sigma rule: Detects applications being added to the "allowed applications" list of exploit guard in order to bypass controlled folde. Logsource: windows / registry_set. Rule: title: Suspicious Application Allowed Through Exploit Guard id: 42205c73-75c8-4a63-9db1-e3782e06fda0 status: test description: Detects applications being added to the "allowed applications" list of exploit guard in order to bypass controlled folder settings references: - https://www.microsoft.com/security/blog/2017/10/23/windows-defender-exploit-guard-reduce-the-attack-surface-against-next-generation-malware/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-05 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection_key: TargetObject|contains: SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\AllowedApplications selection_paths: TargetObject|contains: - \Users\Public\ - \AppData\Local\Temp\ - \Desktop\ - \PerfLogs\ - \Windows\Temp\ condition: all of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects Obfuscated use of stdin to execute PowerShell. Logsource: windows / system. Rule: title: Invoke-Obfuscation STDIN+ Launcher - System id: 72862bf2-0eb1-11eb-adc1-0242ac120002 status: test description: Detects Obfuscated use of stdin to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-15 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows service: system detection: selection_main: Provider_Name: Service Control Manager EventID: 7045 ImagePath|contains|all: - cmd - powershell ImagePath|contains: - /c - /r selection_other: - ImagePath|contains: noexit - ImagePath|contains|all: - input - $ condition: all of selection_* falsepositives: - Unknown level: high
Query: vulnerability: Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, 
Matching passage: CVE-2015-7634. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-7625, CVE-2015-7626, CVE-2015-7627, CVE-2015-7630, and CVE-2015-7633.
Near-miss passage: CVE-2015-7087. CWE: CWE-119. CVSS: 6.599999904632568. Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7086, CVE-2015-7088, CVE-2015-7089, CVE-2015-7090, CVE-2015-7091, CVE-2015-7092, and CVE-2015-7117.
Query: Sigma rule for Detects when verclsid.exe is used to run COM object via GUID
Matching passage: Sigma rule: Detects when verclsid.exe is used to run COM object via GUID. Logsource: windows / process_creation. Rule: title: Verclsid.exe Runs COM Object id: d06be4b9-8045-428b-a567-740a26d9db25 status: test description: Detects when verclsid.exe is used to run COM object via GUID references: - https://lolbas-project.github.io/lolbas/Binaries/Verclsid/ - https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5 - https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/ author: Victor Sergeev, oscd.community date: 2020-10-09 modified: 2025-10-07 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \verclsid.exe - OriginalFileName: verclsid.exe selection_cli: CommandLine|contains|all: - /S - /C filter_main_runtimebroker: ParentImage|endswith: C:\Windows\System32\RuntimeBroker.exe CommandLine|contains|all: - verclsid.exe" /S /C { - '} /I {' condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Monitor and alert for changes to the device registration policy.. Logsource: azure / auditlogs. Rule: title: Changes to Device Registration Policy id: 9494bff8-959f-4440-bbce-fb87a208d517 status: test description: Monitor and alert for changes to the device registration policy. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#device-registrations-and-joins-outside-policy author: Michael Epping, '@mepples21' date: 2022-06-28 tags: - attack.privilege-escalation - attack.defense-impairment - attack.t1484 logsource: product: azure service: auditlogs detection: selection: Category: Policy ActivityDisplayName: Set device registration policies condition: selection falsepositives: - Unknown level: high
Query: risk of The glob implementation in tnftpd (formerly lukemftpd), as used in Apple OS X before 10.11, allows remote attackers to cause a denial of service (memory consumption and daemon outa
Matching passage: CVE-2015-5917. CWE: CWE-119. CVSS: 5.0. The glob implementation in tnftpd (formerly lukemftpd), as used in Apple OS X before 10.11, allows remote attackers to cause a denial of service (memory consumption and daemon outage) via a STAT command containing a crafted pattern, as demonstrated by multiple instances of the {..,..,..}/* substring.
Near-miss passage: CVE-2015-7064. CWE: CWE-119. CVSS: 6.800000190734863. OpenGL in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2015-7066.
Query: vulnerability: Heap-based buffer overflow in the Microsoft Word document conversion feature in Corel WordPerfect allows remote attackers to execute arbitrary code via a crafted document.
Matching passage: CVE-2015-6948. CWE: CWE-119. CVSS: 6.800000190734863. Heap-based buffer overflow in the Microsoft Word document conversion feature in Corel WordPerfect allows remote attackers to execute arbitrary code via a crafted document.
Near-miss passage: CVE-2015-9070. CWE: CWE-119. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer over-read vulnerability exists in a TrustZone syscall.
Query: exploit Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability," a differen
Matching passage: CVE-2015-1743. CWE: CWE-367. CVSS: 5.099999904632568. Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-1748.
Near-miss passage: CVE-2015-7810. CWE: CWE-367. CVSS: 4.699999809265137. libbluray MountManager class has a time-of-check time-of-use (TOCTOU) race when expanding JAR files
Query: risk of Huawei Sophia-L10 smartphones with software before P7-L10C900B852 allow attackers to cause a denial of service (system panic) via a crafted application with the system or camera pr
Matching passage: CVE-2015-8305. CWE: CWE-20. CVSS: 5.5. Huawei Sophia-L10 smartphones with software before P7-L10C900B852 allow attackers to cause a denial of service (system panic) via a crafted application with the system or camera privilege.
Near-miss passage: CVE-2015-3830. CWE: CWE-20. CVSS: 6.5. The stock Android browser address bar in all Android operating systems suffers from Address Bar Spoofing, which allows remote attackers to trick a victim by displaying a malicious page for legitimate domain names.
Query: exploit The Autonomic Networking Infrastructure (ANI) implementation in Cisco IOS allows remote attackers to trigger self-referential adjacencies via a crafted Autonomic Networking (AN) me
Matching passage: CVE-2015-0659. CWE: UNKNOWN. CVSS: 5.0. The Autonomic Networking Infrastructure (ANI) implementation in Cisco IOS allows remote attackers to trigger self-referential adjacencies via a crafted Autonomic Networking (AN) message, aka Bug ID CSCup62157.
Near-miss passage: CVE-2015-4892. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 allows remote authenticated users to affect integrity via unknown vectors related to Security, a different vulnerability than CVE-2015-4917.
Query: exploit JBoss RichFaces before 4.5.4 allows remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via the do parameter.
Matching passage: CVE-2015-0279. CWE: CWE-94. CVSS: 6.800000190734863. JBoss RichFaces before 4.5.4 allows remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via the do parameter.
Near-miss passage: CVE-2015-5646. CWE: CWE-94. CVSS: 8.5. Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 allows remote authenticated users to execute arbitrary PHP code via unspecified vectors, aka CyVDB-863 and CyVDB-867.
Query: vulnerability: Absolute path traversal vulnerability in eFront CMS 3.6.15.4 and earlier allows remote Professor users to obtain sensitive information via a full pathname in the other parameter.
Matching passage: CVE-2015-4461. CWE: CWE-22. CVSS: 6.5. Absolute path traversal vulnerability in eFront CMS 3.6.15.4 and earlier allows remote Professor users to obtain sensitive information via a full pathname in the other parameter.
Near-miss passage: CVE-2015-6003. CWE: CWE-22. CVSS: 9.300000190734863. Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.
Query: common weakness: SQL Injection: Hibernate
Matching passage: CWE-564 SQL Injection: Hibernate. Using Hibernate to execute a dynamic SQL statement built with user-controlled input can allow an attacker to modify the statement's meaning or to execute arbitrary SQL commands.
Near-miss passage: CWE-598 Use of HTTP Request With Sensitive Query String. The web application uses an HTTP method to process a request, but the request includes sensitive information in the query string.
Query: CVE similar to CVE-2015-0265
Matching passage: CVE-2015-0265. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the Policy Admin Tool in Apache Ranger before 0.5.0 allows remote attackers to inject arbitrary web script or HTML via the HTTP User-Agent header.
Near-miss passage: CVE-2015-4608. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the BE User Log (beko_beuserlog) extension 1.1.1 and earlier for TYPO3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Query: alert when Detects modifications to shell open registry keys that point to suspicious locations typically used by malware for persi
Matching passage: Sigma rule: Detects modifications to shell open registry keys that point to suspicious locations typically used by malware for persi. Logsource: windows / registry_set. Rule: title: Suspicious Shell Open Command Registry Modification id: 9e8894c0-0ae0-11ef-9d85-1f2942bec57c status: experimental description: 'Detects modifications to shell open registry keys that point to suspicious locations typically used by malware for persistence. Generally, modifications to the `*\shell\open\command` registry key can indicate an attempt to change the default action for opening files, and various UAC bypass or persistence techniques involve modifying these keys to execute malicious scripts or binaries. ' references: - https://www.trendmicro.com/en_us/research/25/f/water-curse.html author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-01-24 tags: - attack.privilege-escalation - attack.persistence - attack.t1548.002 - attack.t1546.001 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \shell\open\command\ Details|contains: - \$Recycle.Bin\ - \AppData\Local\Temp\ - \Contacts\ - \Music\ - \PerfLogs\ - \Photos\ - \Pictures\ - \Users\Public\ - \Videos\ - \Windows\Temp\ - '%AppData%' - '%LocalAppData%' - '%Temp%' - '%tmp%' condition: selection falsepositives: - Legitimate software installations or updates that modify the shell open command registry keys to these locations. level: medium
Near-miss passage: Sigma rule: Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the c. Logsource: windows / security. Rule: title: Invoke-Obfuscation Obfuscated IEX Invocation - Security id: fd0f5778-d3cb-4c9a-9695-66759d04702a related: - id: 51aa9387-1c53-4153-91cc-d73c59ae1ca9 type: derived status: test description: Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block linked in the references references: - https://github.com/danielbohannon/Invoke-Obfuscation/blob/f20e7f843edd0a3a7716736e9eddfa423395dd26/Out-ObfuscatedStringCommand.ps1#L873-L888 author: Daniel Bohannon (@Mandiant/@FireEye), oscd.community date: 2019-11-08 modified: 2022-11-27 tags: - attack.stealth - attack.t1027 logsource: product: windows service: security definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697 detection: selection_eid: EventID: 4697 selection_servicefilename: - ServiceFileName|re: \$PSHome\[\s*\d{1,3}\s*\]\s*\+\s*\$PSHome\[ - ServiceFileName|re: \$ShellId\[\s*\d{1,3}\s*\]\s*\+\s*\$ShellId\[ - ServiceFileName|re: \$env:Public\[\s*\d{1,3}\s*\]\s*\+\s*\$env:Public\[ - ServiceFileName|re: \$env:ComSpec\[(\s*\d{1,3}\s*,){2} - ServiceFileName|re: \\*mdr\*\W\s*\)\.Name - ServiceFileName|re: \$VerbosePreference\.ToString\( - ServiceFileName|re: \String\]\s*\$VerbosePreference condition: all of selection_* falsepositives: - Unknown level: high
Query: adversary uses Steal or Forge Kerberos Tickets
Matching passage: T1558 Steal or Forge Kerberos Tickets. Tactics: credential access. Description: Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003). Kerberos is an authentication protocol widely used in modern Windows domain environments. In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC).(Citation: ADSecurity Kerberos Ring Decoder) Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated. The KDC is responsible for both authentication and ticket granting. Adversaries may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access. On Windows, the built-in <code>klist</code> utility can be used to list and analyze cached Kerberos tickets.(Citation: Microsoft Klist)
Near-miss passage: T1558.004 AS-REP Roasting. Tactics: credential access. Description: Adversaries may reveal credentials of accounts that have disabled Kerberos preauthentication by [Password Cracking](https://attack.mitre.org/techniques/T1110/002) Kerberos messages.(Citation: Harmj0y Roasting AS-REPs Jan 2017) Preauthentication offers protection against offline [Password Cracking](https://attack.mitre.org/techniques/T1110/002). When enabled, a user requesting access to a resource initiates communication with the Domain Controller (DC) by sending an Authentication Server Request (AS-REQ) message with a timestamp that is encrypted with the hash of their password. If and only if the DC is able to successfully decrypt the timestamp with the hash of the user’s password, it will then send an Authentication Server Response (AS-REP) message that contains the Ticket Granting Ticket (TGT) to the user. Part of the AS-REP message is signed with the user’s password.(Citation: Microsoft Kerberos Preauth 2014) For each account found without preauthentication, an adversary may send an AS-REQ message without the encrypted timestamp and receive an AS-REP message with TGT data which may be encrypted with an insecure algorithm such as RC4. The recovered encrypted data may be vulnerable to offline [Password Cracking](https://attack.mitre.org/techniques/T1110/002) attacks similarly to [Kerberoasting](https://attack.mitre.org/techniques/T1558/003) and expose plaintext credentials. (Citation: Harmj0y Roasting AS-REPs Jan 2017)(Citation: Stealthbits Cracking AS-REP Roasting Jun 2019) An account registered to a domain, with or without special privileges, can be abused to list all domain accounts that have preauthentication disabled by utilizing Windows tools like [PowerShell](https://attack.mitre.org/techniques/T1059/001) with an LDAP filter. Alternatively, the adversary may send an AS-REQ message for each user. If the DC responds without errors, the account does not require preauthentication and the AS-REP message will already contain the encrypted data. (Citation: Harmj0y
Query: vulnerability: Cross-site request forgery (CSRF) vulnerability in Cisco TelePresence Video Communication Server (VCS) X8.5.1 allows remote attackers to hijack the authentication of arbitrary user
Matching passage: CVE-2015-6376. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Cisco TelePresence Video Communication Server (VCS) X8.5.1 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuv72412.
Near-miss passage: CVE-2015-1424. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Gecko CMS 2.2 and 2.3 allows remote attackers to hijack the authentication of administrators for requests that add an administrator user via a newuser request to admin/index.php.
Query: describe CVE-2015-0102
Matching passage: CVE-2015-0102. CWE: CWE-287. CVSS: 8.100000381469727. IBM Workflow for Bluemix does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
Near-miss passage: CVE-2015-8332. CWE: CWE-287. CVSS: 8.800000190734863. Huawei Video Content Management (VCM) before V100R001C10SPC001 does not properly "authenticate online user identities and privileges," which allows remote authenticated users to gain privileges and perform a case operation as another user via a crafted message, aka "Horizontal Privilege Escalation Vulnerability."
Query: patch priority for CVE-2015-10082
Matching passage: CVE-2015-10082. CWE: CWE-611. CVSS: 9.800000190734863. A vulnerability classified as problematic has been found in UIKit0 libplist 1.12. This affects the function plist_from_xml of the file src/xplist.c of the component XML Handler. The manipulation leads to xml external entity reference. The patch is named c086cb139af7c82845f6d565e636073ff4b37440. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-221499.
Near-miss passage: CVE-2015-8866. CWE: CWE-611. CVSS: 9.600000381469727. ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, which allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document, a related issue to CVE-2015-5161.
Query: vulnerability: The CLI in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows local users to obtain root privileges by writing script arguments to an unspecified file, ak
Matching passage: CVE-2015-4327. CWE: CWE-20. CVSS: 7.199999809265137. The CLI in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows local users to obtain root privileges by writing script arguments to an unspecified file, aka Bug ID CSCuv12542.
Near-miss passage: CVE-2015-8678. CWE: CWE-20. CVSS: 5.5. The ION driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230 and Mate S smartphones with software CRR-TL00 before CRR-TL00C01B160SP01, CRR-UL00 before CRR-UL00C00B160, and CRR-CL00 before CRR-CL00C92B161 allows remote attackers to cause a denial of service (crash) via a crafted application.
Query: risk of Multiple cross-site request forgery (CSRF) vulnerabilities in the Log Watcher module before 6.x-1.2 for Drupal allow remote attackers to hijack the authentication of administrators
Matching passage: CVE-2015-3351. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the Log Watcher module before 6.x-1.2 for Drupal allow remote attackers to hijack the authentication of administrators for requests that (1) enable, (2) disable, or (3) delete a report via unspecified vectors.
Near-miss passage: CVE-2015-6541. CWE: CWE-352. CVSS: 8.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the Mail interface in Zimbra Collaboration Server (ZCS) before 8.5 allow remote attackers to hijack the authentication of arbitrary users for requests that change account preferences via a SOAP request to service/soap/BatchRequest.