alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: explain CWE-758
Matching passage: CWE-758 Reliance on Undefined, Unspecified, or Implementation-Defined Behavior. The product uses an API function, data structure, or other entity in a way that relies on properties that are not always guaranteed to hold for that entity.
Near-miss passage: CWE-433 Unparsed Raw Web Content Delivery. The product stores raw content or supporting code under the web document root with an extension that is not specifically handled by the server.
Query: rule covering Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission gr
Matching passage: Sigma rule: Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission gr. Logsource: windows / ps_script. Rule: title: AD Groups Or Users Enumeration Using PowerShell - ScriptBlock id: 88f0884b-331d-403d-a3a1-b668cf035603 status: test description: 'Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.002/T1069.002.md author: frack113 date: 2021-12-15 modified: 2022-12-25 tags: - attack.discovery - attack.t1069.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: test_2: ScriptBlockText|contains: get-ADPrincipalGroupMembership test_7: ScriptBlockText|contains|all: - get-aduser - '-f ' - '-pr ' - DoesNotRequirePreAuth condition: 1 of test_* falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects relevant ClamAV messages. Logsource: linux / clamav. Rule: title: Relevant ClamAV Message id: 36aa86ca-fd9d-4456-814e-d3b1b8e1e0bb status: stable description: Detects relevant ClamAV messages references: - https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/clam_av_rules.xml author: Florian Roth (Nextron Systems) date: 2017-03-01 tags: - attack.resource-development - attack.t1588.001 logsource: product: linux service: clamav detection: keywords: - Trojan*FOUND - VirTool*FOUND - Webshell*FOUND - Rootkit*FOUND - Htran*FOUND condition: keywords falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-8605
Matching passage: CVE-2015-8605. CWE: CWE-20. CVSS: 6.5. ISC DHCP 4.x before 4.1-ESV-R12-P1, 4.2.x, and 4.3.x before 4.3.3-P1 allows remote attackers to cause a denial of service (application crash) via an invalid length field in a UDP IPv4 packet.
Near-miss passage: CVE-2015-8740. CWE: CWE-20. CVSS: 5.300000190734863. The dissect_tds7_colmetadata_token function in epan/dissectors/packet-tds.c in the TDS dissector in Wireshark 2.0.x before 2.0.1 does not validate the number of columns, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted packet.
Query: CVE similar to CVE-2015-2376
Matching passage: CVE-2015-2376. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Office for Mac 2011, Excel Viewer 2007 SP3, Office Compatibility Pack SP3, Excel Services on SharePoint Server 2007 SP3, Excel Services on SharePoint Server 2010 SP2, and Excel Services on SharePoint Server 2013 SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-6609. CWE: CWE-119. CVSS: 10.0. libutils in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file, aka internal bug 22953624.
Query: patch priority for CVE-2015-2221
Matching passage: CVE-2015-2221. CWE: CWE-399. CVSS: 5.0. ClamAV before 0.98.7 allows remote attackers to cause a denial of service (infinite loop) via a crafted y0da cryptor file.
Near-miss passage: CVE-2015-0335. CWE: CWE-399. CVSS: 10.0. Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0332, CVE-2015-0333, and CVE-2015-0339.
Query: CVE similar to CVE-2015-6538
Matching passage: CVE-2015-6538. CWE: UNKNOWN. CVSS: 9.800000190734863. The login page in Epiphany Cardio Server 3.3, 4.0, and 4.1 mishandles authentication requests, which allows remote attackers to conduct LDAP injection attacks, and consequently bypass intended access restrictions, via a crafted URL.
Near-miss passage: CVE-2015-4802. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition, a different vulnerability than CVE-2015-4792.
Query: risk of IDE SCM in Apple Xcode before 7.2 does not recognize .gitignore files, which allows remote attackers to obtain sensitive information in opportunistic circumstances by leveraging th
Matching passage: CVE-2015-7056. CWE: CWE-200. CVSS: 5.0. IDE SCM in Apple Xcode before 7.2 does not recognize .gitignore files, which allows remote attackers to obtain sensitive information in opportunistic circumstances by leveraging the presence of a file matching an ignore pattern.
Near-miss passage: CVE-2015-5041. CWE: CWE-200. CVSS: 9.100000381469727. The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20, 7 before SR9 FP30, and 7 R1 before SR3 FP30 allows remote attackers to obtain sensitive information or inject data by invoking non-public interface methods.
Query: vulnerability: Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote FTP servers to execute arbitrary code 
Matching passage: CVE-2015-4022. CWE: CWE-189. CVSS: 7.5. Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command, leading to a heap-based buffer overflow.
Near-miss passage: CVE-2015-8891. CWE: CWE-189. CVSS: 7.800000190734863. Multiple integer overflows in app/aboot/aboot.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices allow attackers to bypass intended access restrictions via a crafted image, aka Android internal bug 28842418 and Qualcomm internal bug CR813930.
Query: playbook for alert: Lateral movement indicators for Permission Groups Discovery
Matching passage: Playbook for T1069 Permission Groups Discovery. 1) Validate alert telemetry against T1069. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: discovery. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may attempt to discover group and permission settings. This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions. Adversaries may attempt to discover group permission settings in many different ways. This data may provide the adversary with information
Near-miss passage: Playbook for T1069.003 Cloud Groups. Different response path focused on discovery.
Query: exploit Use-after-free vulnerability in the SVG implementation in Blink, as used in Google Chrome before 43.0.2357.65, allows remote attackers to cause a denial of service or possibly have
Matching passage: CVE-2015-1256. CWE: UNKNOWN. CVSS: 7.5. Use-after-free vulnerability in the SVG implementation in Blink, as used in Google Chrome before 43.0.2357.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document that leverages improper handling of a shadow tree for a use element.
Near-miss passage: CVE-2015-2617. CWE: UNKNOWN. CVSS: 6.5. Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Partition.
Query: CVE similar to CVE-2015-3115
Matching passage: CVE-2015-3115. CWE: CWE-284. CVSS: 5.0. Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2014-0578, CVE-2015-3116, CVE-2015-3125, and CVE-2015-5116.
Near-miss passage: CVE-2015-3672. CWE: CWE-284. CVSS: 7.199999809265137. Admin Framework in Apple OS X before 10.10.4 does not properly handle authentication errors, which allows local users to obtain admin privileges via unspecified vectors.
Query: vulnerability: The ssl3_get_cert_verify function in s3_srvr.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k accepts client authentication with a Diffie-Hellman (DH) certificate without r
Matching passage: CVE-2015-0205. CWE: CWE-310. CVSS: 5.0. The ssl3_get_cert_verify function in s3_srvr.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k accepts client authentication with a Diffie-Hellman (DH) certificate without requiring a CertificateVerify message, which allows remote attackers to obtain access without knowledge of a private key via crafted TLS Handshake Protocol traffic to a server that recognizes a Certification Authority with DH support.
Near-miss passage: CVE-2015-1637. CWE: CWE-310. CVSS: 4.300000190734863. Schannel (aka Secure Channel) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly restrict TLS state transitions, which makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORT_RSA ciphers via crafted TLS traffic, related to the "FREAK" issue, a different vulnerability than CVE-2015-0204 and CVE-2015-1067.
Query: detect Detects a command that accesses the VolumeShadowCopy in order to extract sensitive files such as the Security or SAM reg in logs
Matching passage: Sigma rule: Detects a command that accesses the VolumeShadowCopy in order to extract sensitive files such as the Security or SAM reg. Logsource: windows / process_creation. Rule: title: Sensitive File Access Via Volume Shadow Copy Backup id: f57f8d16-1f39-4dcb-a604-6c73d9b54b3d status: test description: 'Detects a command that accesses the VolumeShadowCopy in order to extract sensitive files such as the Security or SAM registry hives or the AD database (ntds.dit) ' references: - https://twitter.com/vxunderground/status/1423336151860002816?s=20 - https://www.virustotal.com/gui/file/03e9b8c2e86d6db450e5eceec057d7e369ee2389b9daecaf06331a95410aa5f8/detection - https://pentestlab.blog/2018/07/04/dumping-domain-password-hashes/ author: Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems) date: 2021-08-09 modified: 2024-01-18 tags: - attack.impact - attack.t1490 logsource: category: process_creation product: windows detection: selection_1: CommandLine|contains: \\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy selection_2: CommandLine|contains: - \\NTDS.dit - \\SYSTEM - \\SECURITY condition: all of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects powershell scripts that creates sockets/listeners which could be indicative of tunneling activity. Logsource: windows / ps_script. Rule: title: Suspicious TCP Tunnel Via PowerShell Script id: bd33d2aa-497e-4651-9893-5c5364646595 status: test description: Detects powershell scripts that creates sockets/listeners which could be indicative of tunneling activity references: - https://github.com/Arno0x/PowerShellScripts/blob/a6b7d5490fbf0b20f91195838f3a11156724b4f7/proxyTunnel.ps1 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-08 tags: - attack.command-and-control - attack.t1090 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - '[System.Net.HttpWebRequest]' - System.Net.Sockets.TcpListener - AcceptTcpClient condition: selection falsepositives: - Unknown level: medium
Query: describe CVE-2015-4850
Matching passage: CVE-2015-4850. CWE: UNKNOWN. CVSS: 5.5. Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Talent Acquisition Management.
Near-miss passage: CVE-2015-0469. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
Query: CWE for Improper Handling of Missing Special Element
Matching passage: CWE-166 Improper Handling of Missing Special Element. The product receives input from an upstream component, but it does not handle or incorrectly handles when an expected special element is missing.
Near-miss passage: CWE-109 Struts: Validator Turned Off. Automatic filtering via a Struts bean has been turned off, which disables the Struts Validator and custom validation logic. This exposes the application to other weaknesses related to insufficient input validation.
Query: detect Powerup tool's Write Hijack DLL exploits DLL hijacking for privilege escalation. In it's default mode, it builds a self in logs
Matching passage: Sigma rule: Powerup tool's Write Hijack DLL exploits DLL hijacking for privilege escalation. In it's default mode, it builds a self. Logsource: windows / file_event. Rule: title: HackTool - Powerup Write Hijack DLL id: 602a1f13-c640-4d73-b053-be9a2fa58b96 status: test description: 'Powerup tool''s Write Hijack DLL exploits DLL hijacking for privilege escalation. In it''s default mode, it builds a self deleting .bat file which executes malicious command. The detection rule relies on creation of the malicious bat file (debug.bat by default). ' references: - https://powersploit.readthedocs.io/en/latest/Privesc/Write-HijackDll/ author: Subhash Popuri (@pbssubhash) date: 2021-08-21 modified: 2024-06-27 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: file_event product: windows detection: selection: Image|endswith: - \powershell.exe - \pwsh.exe TargetFilename|endswith: .bat condition: selection falsepositives: - Any powershell script that creates bat files level: high
Near-miss passage: Sigma rule: Detects access to Okta admin functions through proxy.. Logsource: okta / okta. Rule: title: Okta Admin Functions Access Through Proxy id: 9058ca8b-f397-4fd1-a9fa-2b7aad4d6309 status: test description: Detects access to Okta admin functions through proxy. references: - https://www.beyondtrust.com/blog/entry/okta-support-unit-breach - https://dataconomy.com/2023/10/23/okta-data-breach/ - https://blog.cloudflare.com/how-cloudflare-mitigated-yet-another-okta-compromise/ author: Muhammad Faisal @faisalusuf date: 2023-10-25 tags: - attack.credential-access logsource: service: okta product: okta detection: selection: debugContext.debugData.requestUri|contains: admin securityContext.isProxy: 'true' condition: selection falsepositives: - False positives are expected if administrators access these function through proxy legitimatly. Apply additional filters if necessary level: medium
Query: exploit Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to aff
Matching passage: CVE-2015-4884. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality via unknown vectors related to Single Signon.
Near-miss passage: CVE-2015-5371. CWE: UNKNOWN. CVSS: 10.0. The AuthenticationFilter class in SolarWinds Storage Manager allows remote attackers to upload and execute arbitrary scripts via unspecified vectors.
Query: patch priority for CVE-2015-7030
Matching passage: CVE-2015-7030. CWE: CWE-17. CVSS: 7.5. The Swift implementation in Apple Xcode before 7.1 mishandles type conversion, which has unspecified impact and attack vectors.
Near-miss passage: CVE-2015-1157. CWE: CWE-17. CVSS: 7.800000190734863. CoreText in Apple iOS 8.x through 8.3 allows remote attackers to cause a denial of service (reboot and messaging disruption) via crafted Unicode text that is not properly handled during display truncation in the Notifications feature, as demonstrated by Arabic characters in (1) an SMS message or (2) a WhatsApp message.
Query: write Sigma for Detects logon events that have characteristics of events generated during an attack with RottenPotato and the like
Matching passage: Sigma rule: Detects logon events that have characteristics of events generated during an attack with RottenPotato and the like. Logsource: windows / security. Rule: title: RottenPotato Like Attack Pattern id: 16f5d8ca-44bd-47c8-acbe-6fc95a16c12f status: test description: Detects logon events that have characteristics of events generated during an attack with RottenPotato and the like references: - https://twitter.com/SBousseaden/status/1195284233729777665 author: '@SBousseaden, Florian Roth' date: 2019-11-15 modified: 2022-12-22 tags: - attack.collection - attack.privilege-escalation - attack.credential-access - attack.t1557.001 logsource: product: windows service: security detection: selection: EventID: 4624 LogonType: 3 TargetUserName: ANONYMOUS LOGON WorkstationName: '-' IpAddress: - 127.0.0.1 - ::1 condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of a potential recon command where the results are piped to "findstr". This is meant to trigger on. Logsource: windows / process_creation. Rule: title: Recon Command Output Piped To Findstr.EXE id: ccb5742c-c248-4982-8c5c-5571b9275ad3 related: - id: fe63010f-8823-4864-a96b-a7b4a0f7b929 type: derived status: test description: 'Detects the execution of a potential recon command where the results are piped to "findstr". This is meant to trigger on inline calls of "cmd.exe" via the "/c" or "/k" for example. Attackers often time use this technique to extract specific information they require in their reconnaissance phase. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/02cb591f75064ffe1e0df9ac3ed5972a2e491c97/atomics/T1057/T1057.md#atomic-test-6---discover-specific-process---tasklist - https://www.hhs.gov/sites/default/files/manage-engine-vulnerability-sector-alert-tlpclear.pdf - https://www.trendmicro.com/en_us/research/22/d/spring4shell-exploited-to-deploy-cryptocurrency-miners.html author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2023-07-06 modified: 2025-10-08 tags: - attack.discovery - attack.t1057 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - ipconfig*|*find - net*|*find - netstat*|*find - ping*|*find - systeminfo*|*find - tasklist*|*find - whoami*|*find filter_optional_xampp: CommandLine|contains|all: - cmd.exe /c TASKLIST /V | - FIND /I - \xampp\ - \catalina_start.bat condition: selection and not 1 of filter_optional_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_findstr_recon_pipe_output/info.yml
Query: risk of Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5 and 3.6 allow remote attackers to inject arbitrary web script or HTML via the Business Search (search_no
Matching passage: CVE-2015-3935. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5 and 3.6 allow remote attackers to inject arbitrary web script or HTML via the Business Search (search_nom) field to (1) htdocs/societe/societe.php or (2) htdocs/societe/admin/societe.php.
Near-miss passage: CVE-2015-4380. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Linear Case module 6.x-1.x before 6.x-1.3 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
Query: weakness Collapse of Data into Unsafe Value
Matching passage: CWE-182 Collapse of Data into Unsafe Value. The product filters data in a way that causes it to be reduced or collapsed into an unsafe value that violates an expected security property.
Near-miss passage: CWE-319 Cleartext Transmission of Sensitive Information. The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
Query: describe CVE-2015-0660
Matching passage: CVE-2015-0660. CWE: CWE-284. CVSS: 7.199999809265137. Cisco Virtual TelePresence Server Software does not properly restrict use of the serial port, which allows local users to execute arbitrary OS commands as root by leveraging vSphere controller administrative privileges, aka Bug ID CSCus61123.
Near-miss passage: CVE-2015-1464. CWE: CWE-284. CVSS: 6.400000095367432. RT (aka Request Tracker) before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to hijack sessions via an RSS feed URL.