alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows local users with access to the plcm account to gain privileges via a script in /var/polycom/cma/upgrade/scripts, 
Matching passage: CVE-2015-4685. CWE: CWE-264. CVSS: 7.0. Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows local users with access to the plcm account to gain privileges via a script in /var/polycom/cma/upgrade/scripts, related to a sudo misconfiguration.
Near-miss passage: CVE-2015-9012. CWE: CWE-264. CVSS: 9.800000190734863. An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36384691.
Query: CVE similar to CVE-2015-8798
Matching passage: CVE-2015-8798. CWE: CWE-22. CVSS: 8.0. Directory traversal vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedded Security: Critical System Protection for Controllers and Devices (SES:CSP) 6.5.0 before MP1, Critical System Protection (SCSP) before 5.2.9 MP6, Data Center Security: Server Advanced Server (DCS:SA) 6.x before 6.5 MP1 and 6.6 before MP1, and Data Center Security: Server Advanced Server and Agents (DCS:SA) through 6.6 MP1 allows remote authenticated users to execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-7780. CWE: CWE-22. CVSS: 6.5. Directory traversal vulnerability in ManageEngine Firewall Analyzer before 8.0.
Query: exploit IOSurface in Apple iOS before 8.2, Apple OS X through 10.10.2, and Apple TV before 7.1 allows attackers to execute arbitrary code in a privileged context via a crafted app that lev
Matching passage: CVE-2015-1061. CWE: CWE-94. CVSS: 9.300000190734863. IOSurface in Apple iOS before 8.2, Apple OS X through 10.10.2, and Apple TV before 7.1 allows attackers to execute arbitrary code in a privileged context via a crafted app that leverages "type confusion" during serialized-object handling.
Near-miss passage: CVE-2015-9272. CWE: CWE-94. CVSS: 9.800000190734863. The videowhisper-video-presentation plugin 3.31.17 for WordPress allows remote attackers to execute arbitrary code because vp/vw_upload.php considers a file safe when "html" are the last four characters, as demonstrated by a .phtml file containing PHP code.
Query: risk of Integer overflow in layout.c++ in Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 allows remote peers to cause a denial of service or possibly obtain sensitive inform
Matching passage: CVE-2015-2310. CWE: CWE-190. CVSS: 9.100000381469727. Integer overflow in layout.c++ in Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 allows remote peers to cause a denial of service or possibly obtain sensitive information from memory via a crafted message, related to pointer validation.
Near-miss passage: CVE-2015-8931. CWE: CWE-190. CVSS: 7.800000190734863. Multiple integer overflows in the (1) get_time_t_max and (2) get_time_t_min functions in archive_read_support_format_mtree.c in libarchive before 3.2.0 allow remote attackers to have unspecified impact via a crafted mtree file, which triggers undefined behavior.
Query: exploit Directory traversal vulnerability in Contao before 3.2.19, and 3.4.x before 3.4.4 allows remote authenticated "back end" users to view files outside their file mounts or the docume
Matching passage: CVE-2015-0269. CWE: CWE-22. CVSS: 4.300000190734863. Directory traversal vulnerability in Contao before 3.2.19, and 3.4.x before 3.4.4 allows remote authenticated "back end" users to view files outside their file mounts or the document root via unspecified vectors.
Near-miss passage: CVE-2015-0171. CWE: CWE-22. CVSS: 5.5. Directory traversal vulnerability in IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows remote authenticated users to write to arbitrary files via unspecified vectors.
Query: vulnerability: Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Mem
Matching passage: CVE-2015-6143. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6140, CVE-2015-6142, CVE-2015-6153, CVE-2015-6158, CVE-2015-6159, and CVE-2015-6160.
Near-miss passage: CVE-2015-0324. CWE: CWE-119. CVSS: 10.0. Buffer overflow in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code via unspecified vectors.
Query: write Sigma for Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket.
Matching passage: Sigma rule: Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket.. Logsource: windows / openssh. Rule: title: OpenSSH Server Listening On Socket id: 3ce8e9a4-bc61-4c9b-8e69-d7e2492a8781 status: test description: Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket. references: - https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0008-Lateral%20Movement/T1021.004-Remote%20Service%20SSH - https://winaero.com/enable-openssh-server-windows-10/ - https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse - https://virtualizationreview.com/articles/2020/05/21/ssh-server-on-windows-10.aspx - https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16 author: mdecrevoisier date: 2022-10-25 tags: - attack.lateral-movement - attack.t1021.004 logsource: product: windows service: openssh detection: selection: EventID: 4 process: sshd payload|startswith: 'Server listening on ' condition: selection falsepositives: - Legitimate administrator activity level: medium
Near-miss passage: Sigma rule: Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy. Logsource: windows / process_creation. Rule: title: Potential Suspicious Activity Using SeCEdit id: c2c76b77-32be-4d1f-82c9-7e544bdfe0eb status: test description: Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy references: - https://blueteamops.medium.com/secedit-and-i-know-it-595056dee53d - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/secedit author: Janantha Marasinghe date: 2022-11-18 modified: 2022-12-30 tags: - attack.collection - attack.discovery - attack.persistence - attack.credential-access - attack.privilege-escalation - attack.execution - attack.stealth - attack.defense-impairment - attack.t1685.001 - attack.t1547.001 - attack.t1505.005 - attack.t1556.002 - attack.t1685 - attack.t1574.007 - attack.t1564.002 - attack.t1546.008 - attack.t1546.007 - attack.t1547.014 - attack.t1547.010 - attack.t1547.002 - attack.t1557 - attack.t1082 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \secedit.exe - OriginalFileName: SeCEdit selection_flags_discovery: CommandLine|contains|all: - /export - /cfg selection_flags_configure: CommandLine|contains|all: - /configure - /db condition: selection_img and (1 of selection_flags_*) falsepositives: - Legitimate administrative use level: medium
Query: write Sigma for Detects potentially suspicious execution of the Regasm/Regsvcs utilities from a potentially suspicious location
Matching passage: Sigma rule: Detects potentially suspicious execution of the Regasm/Regsvcs utilities from a potentially suspicious location. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location id: cc368ed0-2411-45dc-a222-510ace303cb2 related: - id: e9f8f8cc-07cc-4e81-b724-f387db9175e4 type: derived status: test description: Detects potentially suspicious execution of the Regasm/Regsvcs utilities from a potentially suspicious location references: - https://www.fortiguard.com/threat-signal-report/4718?s=09 - https://lolbas-project.github.io/lolbas/Binaries/Regasm/ - https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-25 modified: 2023-02-13 tags: - attack.stealth - attack.t1218.009 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \Regsvcs.exe - \Regasm.exe - OriginalFileName: - RegSvcs.exe - RegAsm.exe selection_dir: CommandLine|contains: - \AppData\Local\Temp\ - \Microsoft\Windows\Start Menu\Programs\Startup\ - \PerfLogs\ - \Users\Public\ - \Windows\Temp\ condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects when a user creates a Lambda function URL configuration, which could be used to expose the function to the inter. Logsource: aws / cloudtrail. Rule: title: New AWS Lambda Function URL Configuration Created id: ec541962-c05a-4420-b9ea-84de072d18f4 status: experimental description: 'Detects when a user creates a Lambda function URL configuration, which could be used to expose the function to the internet and potentially allow unauthorized access to the function''s IAM role for AWS API calls. This could give an adversary access to the privileges associated with the Lambda service role that is attached to that function. ' references: - https://docs.aws.amazon.com/lambda/latest/dg/API_CreateFunctionUrlConfig.html - https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lambda-privesc - https://www.wiz.io/blog/how-to-set-secure-defaults-on-aws author: Ivan Saakov date: 2024-12-19 tags: - attack.initial-access - attack.privilege-escalation logsource: product: aws service: cloudtrail detection: selection: eventSource: lambda.amazonaws.com eventName: CreateFunctionUrlConfig condition: selection falsepositives: - Creating a Lambda function URL configuration may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Creating a Lambda function URL configuration from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: common weakness: Data Resource Access without Use of Connection Pooling
Matching passage: CWE-1072 Data Resource Access without Use of Connection Pooling. The product accesses a data resource through a database without using a connection pooling capability.
Near-miss passage: CWE-615 Inclusion of Sensitive Information in Source Code Comments. While adding general comments is very useful, some programmers tend to leave important data, such as: filenames related to the web application, old links or links which were not meant to be browsed by users, old code fragments, etc.
Query: detection rule: One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and Microsoft Edge by usi
Matching passage: Sigma rule: One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and Microsoft Edge by usi. Logsource: windows / process_creation. Rule: title: Esentutl Steals Browser Information id: 6a69f62d-ce75-4b57-8dce-6351eb55b362 status: test description: One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and Microsoft Edge by using the built-in utility esentutl.exe references: - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/ - https://redcanary.com/threat-detection-report/threats/qbot/ - https://thedfirreport.com/2022/10/31/follina-exploit-leads-to-domain-compromise/ author: frack113 date: 2022-02-13 modified: 2024-03-05 tags: - attack.collection - attack.t1005 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \esentutl.exe - OriginalFileName: esentutl.exe selection_flag: CommandLine|contains|windash: -r selection_webcache: CommandLine|contains: \Windows\WebCache condition: all of selection* falsepositives: - Legitimate use level: medium
Near-miss passage: Sigma rule: Detects usage of winget to add new potentially suspicious download sources. Logsource: windows / process_creation. Rule: title: Add Potential Suspicious New Download Source To Winget id: c15a46a0-07d4-4c87-b4b6-89207835a83b related: - id: 05ebafc8-7aa2-4bcd-a269-2aec93f9e842 type: similar - id: 81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2 type: similar status: test description: Detects usage of winget to add new potentially suspicious download sources references: - https://learn.microsoft.com/en-us/windows/package-manager/winget/source - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-17 modified: 2023-12-04 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \winget.exe - OriginalFileName: winget.exe selection_cli: CommandLine|contains|all: - 'source ' - 'add ' selection_source_direct_ip: CommandLine|re: ://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} condition: all of selection_* falsepositives: - Unknown level: medium
Query: CWE for Reachable Assertion
Matching passage: CWE-617 Reachable Assertion. The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Near-miss passage: CWE-1101 Reliance on Runtime Component in Generated Code. The product uses automatically-generated code that cannot be executed without a specific runtime support component.
Query: describe CVE-2015-0311
Matching passage: CVE-2015-0311. CWE: UNKNOWN. CVSS: 9.800000190734863. Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.202.438 on Linux allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in January 2015.
Near-miss passage: CVE-2015-8058. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: exploit The display-widgets plugin before 2.04 for WordPress has XSS via the wp-admin/admin-ajax.php?action=dw_show_widget id_base, widget_number, or instance parameter.
Matching passage: CVE-2015-9438. CWE: CWE-79. CVSS: 5.400000095367432. The display-widgets plugin before 2.04 for WordPress has XSS via the wp-admin/admin-ajax.php?action=dw_show_widget id_base, widget_number, or instance parameter.
Near-miss passage: CVE-2015-1363. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Free Reprintables ArticleFR 3.0.5 allows remote attackers to inject arbitrary web script or HTML via the q parameter to search/v/.
Query: Sigma YAML for windows / sysmon
Matching passage: Sigma rule: Triggers on any Sysmon "FileExecutableDetected" event, which triggers every time a PE that is monitored by the config is. Logsource: windows / sysmon. Rule: title: Sysmon File Executable Creation Detected id: 693a44e9-7f26-4cb6-b787-214867672d3a status: test description: Triggers on any Sysmon "FileExecutableDetected" event, which triggers every time a PE that is monitored by the config is created. references: - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon - https://medium.com/@olafhartong/sysmon-15-0-file-executable-detected-40fd64349f36 author: frack113 date: 2023-07-20 tags: - attack.defense-impairment logsource: product: windows service: sysmon detection: selection: EventID: 29 condition: selection falsepositives: - Unlikely level: medium
Near-miss passage: Sigma rule: Rundll32 can be use by Cobalt Strike with StartW function to load DLLs from the command line.. Logsource: windows / process_creation. Rule: title: CobaltStrike Load by Rundll32 id: ae9c6a7c-9521-42a6-915e-5aaa8689d529 status: test description: Rundll32 can be use by Cobalt Strike with StartW function to load DLLs from the command line. references: - https://www.cobaltstrike.com/help-windows-executable - https://redcanary.com/threat-detection-report/ - https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/ author: Wojciech Lesicki date: 2021-06-01 modified: 2022-09-16 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection_rundll: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE - CommandLine|contains: - rundll32.exe - 'rundll32 ' selection_params: CommandLine|contains: .dll CommandLine|endswith: - ' StartW' - ',StartW' condition: all of selection* falsepositives: - Unknown level: high
Query: detect Detects various execution patterns of the CrackMapExec pentesting framework in logs
Matching passage: Sigma rule: Detects various execution patterns of the CrackMapExec pentesting framework. Logsource: windows / process_creation. Rule: title: HackTool - CrackMapExec Execution Patterns id: 058f4380-962d-40a5-afce-50207d36d7e2 status: stable description: Detects various execution patterns of the CrackMapExec pentesting framework references: - https://github.com/byt3bl33d3r/CrackMapExec author: Thomas Patzke date: 2020-05-22 modified: 2023-11-06 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1047 - attack.t1053 - attack.t1059.003 - attack.t1059.001 - attack.s0106 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - cmd.exe /Q /c * 1> \\\\*\\*\\* 2>&1 - cmd.exe /C * > \\\\*\\*\\* 2>&1 - cmd.exe /C * > *\\Temp\\* 2>&1 - powershell.exe -exec bypass -noni -nop -w 1 -C " - 'powershell.exe -noni -nop -w 1 -enc ' condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects an issue in apache logs that reports threading related errors. Logsource: apache. Rule: title: Apache Threading Error id: e9a2b582-3f6a-48ac-b4a1-6849cdc50b3c status: test description: Detects an issue in apache logs that reports threading related errors references: - https://github.com/hannob/apache-uaf/blob/da40f2be3684c8095ec6066fa68eb5c07a086233/README.md author: Florian Roth (Nextron Systems) date: 2019-01-22 modified: 2021-11-27 tags: - attack.initial-access - attack.lateral-movement - attack.t1190 - attack.t1210 logsource: service: apache definition: 'Requirements: Must be able to collect the error.log file' detection: keywords: - '__pthread_tpp_change_priority: Assertion `new_prio == -1 || (new_prio >= fifo_min_prio && new_prio <= fifo_max_prio)' condition: keywords falsepositives: - 3rd party apache modules - https://bz.apache.org/bugzilla/show_bug.cgi?id=46185 level: medium
Query: rule covering Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location
Matching passage: Sigma rule: Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location. Logsource: windows / image_load. Rule: title: Microsoft Office DLL Sideload id: 829a3bdf-34da-4051-9cf4-8ed221a8ae4f status: test description: Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location references: - https://hijacklibs.net/ author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research) date: 2022-08-17 modified: 2023-03-15 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \outllib.dll filter: ImageLoaded|startswith: - C:\Program Files\Microsoft Office\OFFICE - C:\Program Files (x86)\Microsoft Office\OFFICE - C:\Program Files\Microsoft Office\Root\OFFICE - C:\Program Files (x86)\Microsoft Office\Root\OFFICE condition: selection and not filter falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects usage of crontab to list the tasks of the user. Logsource: linux / process_creation. Rule: title: Crontab Enumeration id: 403ed92c-b7ec-4edd-9947-5b535ee12d46 status: test description: Detects usage of crontab to list the tasks of the user references: - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/ - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-06-02 tags: - attack.discovery - attack.t1007 logsource: product: linux category: process_creation detection: selection: Image|endswith: /crontab CommandLine|contains: ' -l' condition: selection falsepositives: - Legitimate use of crontab level: low
Query: exploit Multiple cross-site scripting (XSS) vulnerabilities in the Paid Memberships Pro (PMPro) plugin before 1.8.4.3 for WordPress allow remote attackers to inject arbitrary web script or
Matching passage: CVE-2015-5532. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in the Paid Memberships Pro (PMPro) plugin before 1.8.4.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) s parameter to membershiplevels.php, (2) memberslist.php, or (3) orders.php in adminpages/ or the (4) edit parameter to adminpages/membershiplevels.php.
Near-miss passage: CVE-2015-10089. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability classified as problematic has been found in flame.js. This affects an unknown part. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named e6c49b5f6179e31a534b7c3264e1d36aa99728ac. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-222291.