alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: patch priority for CVE-2015-2806
Matching passage: CVE-2015-2806. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in asn1_der_decoding in libtasn1 before 4.4 allows remote attackers to have unspecified impact via unknown vectors.
Near-miss passage: CVE-2015-1896. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in the FastBackMount process in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.11.1 allows remote attackers to execute arbitrary code via unspecified vectors.
Query: vulnerability: The AirPDcapPacketProcess function in epan/crypt/airpdcap.c in the 802.11 dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate the relationship betw
Matching passage: CVE-2015-8723. CWE: CWE-20. CVSS: 5.5. The AirPDcapPacketProcess function in epan/crypt/airpdcap.c in the 802.11 dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate the relationship between the total length and the capture length, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted packet.
Near-miss passage: CVE-2015-4327. CWE: CWE-20. CVSS: 7.199999809265137. The CLI in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows local users to obtain root privileges by writing script arguments to an unspecified file, aka Bug ID CSCuv12542.
Query: Sigma rule for Well-known DNS Exfiltration tools execution
Matching passage: Sigma rule: Well-known DNS Exfiltration tools execution. Logsource: windows / process_creation. Rule: title: DNS Exfiltration and Tunneling Tools Execution id: 98a96a5a-64a0-4c42-92c5-489da3866cb0 status: test description: Well-known DNS Exfiltration tools execution references: - https://github.com/iagox86/dnscat2 - https://github.com/yarrick/iodine author: Daniil Yugoslavskiy, oscd.community date: 2019-10-24 modified: 2021-11-27 tags: - attack.exfiltration - attack.t1048.001 - attack.command-and-control - attack.t1071.004 - attack.t1132.001 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \iodine.exe - Image|contains: \dnscat2 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects potential credential harvesting attempts through LSASS memory dumps using ProcDump. This rule identifies suspici. Logsource: windows / process_creation. Rule: title: Potential LSASS Process Dump Via Procdump id: 5afee48e-67dd-4e03-a783-f74259dcf998 status: stable description: 'Detects potential credential harvesting attempts through LSASS memory dumps using ProcDump. This rule identifies suspicious command-line patterns that combine memory dump flags (-ma, -mm, -mp) with LSASS-related process markers. LSASS (Local Security Authority Subsystem Service) contains sensitive authentication data including plaintext passwords, NTLM hashes, and Kerberos tickets in memory. Attackers commonly dump LSASS memory to extract credentials for lateral movement and privilege escalation. ' references: - https://learn.microsoft.com/en-us/sysinternals/downloads/procdump - https://research.splunk.com/endpoint/3742ebfe-64c2-11eb-ae93-0242ac130002 - https://x.com/wietze/status/1958302556033065292?s=12 author: Florian Roth (Nextron Systems) date: 2018-10-30 modified: 2025-10-19 tags: - attack.stealth - attack.t1036 - attack.credential-access - attack.t1003.001 - car.2013-05-009 logsource: category: process_creation product: windows detection: selection_flags: CommandLine|contains|windash: - ' -ma ' - ' -mm ' - ' -mp ' selection_process: CommandLine|contains: - ' ls' - ' keyiso' - ' samss' condition: all of selection_* falsepositives: - Unlikely, because no one should dump an lsass process memory - Another tool that uses command line flags similar to ProcDump level: high
Query: detection rule: Monitor and alert on group membership additions of groups that have CA policy modification access
Matching passage: Sigma rule: Monitor and alert on group membership additions of groups that have CA policy modification access. Logsource: azure / auditlogs. Rule: title: User Added To Group With CA Policy Modification Access id: 91c95675-1f27-46d0-bead-d1ae96b97cd3 status: test description: Monitor and alert on group membership additions of groups that have CA policy modification access references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure#conditional-access author: Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner' date: 2022-08-04 tags: - attack.privilege-escalation - attack.credential-access - attack.persistence - attack.defense-impairment - attack.t1548 - attack.t1556 logsource: product: azure service: auditlogs detection: selection: properties.message: Add member from group condition: selection falsepositives: - User removed from the group is approved level: medium
Near-miss passage: Sigma rule: Detects registry modifications that disable Privacy Settings Experience. Logsource: windows / registry_set. Rule: title: Disable Privacy Settings Experience in Registry id: 0372e1f9-0fd2-40f7-be1b-a7b2b848fa7b status: test description: Detects registry modifications that disable Privacy Settings Experience references: - https://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1562.001/T1562.001.md author: frack113 date: 2022-10-02 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \SOFTWARE\Policies\Microsoft\Windows\OOBE\DisablePrivacyExperience Details: DWORD (0x00000000) condition: selection falsepositives: - Legitimate admin script level: medium
Query: mitigate Revert Cloud Instance
Matching passage: T1578.004 Revert Cloud Instance. Tactics: defense impairment. Description: An adversary may revert changes made to a cloud instance after they have performed malicious activities in attempt to evade detection and remove evidence of their presence. In highly virtualized environments, such as cloud-based infrastructure, this may be accomplished by restoring virtual machine (VM) or data storage snapshots through the cloud management dashboard or cloud APIs. Another variation of this technique is to utilize temporary storage attached to the compute instance. Most cloud providers provide various types of storage including persistent, local, and/or ephemeral, with the ephemeral types often reset upon stop/restart of the VM.(Citation: Tech Republic - Restore AWS Snapshots)(Citation: Google - Restore Cloud Snapshot)
Near-miss passage: T1578.005 Modify Cloud Compute Configurations. Tactics: defense impairment. Description: Adversaries may modify settings that directly affect the size, locations, and resources available to cloud compute infrastructure in order to evade defenses. These settings may include service quotas, subscription associations, tenant-wide policies, or other configurations that impact available compute. Such modifications may allow adversaries to abuse the victim’s compute resources to achieve their goals, potentially without affecting the execution of running instances and/or revealing their activities to the victim. For example, cloud providers often limit customer usage of compute resources via quotas. Customers may request adjustments to these quotas to support increased computing needs, though these adjustments may require approval from the cloud provider. Adversaries who compromise a cloud environment may similarly request quota adjustments in order to support their activities, such as enabling additional [Resource Hijacking](https://attack.mitre.org/techniques/T1496) without raising suspicion by using up a victim’s entire quota.(Citation: Microsoft Cryptojacking 2023) Adversaries may also increase allowed resource usage by modifying any tenant-wide policies that limit the sizes of deployed virtual machines.(Citation: Microsoft Azure Policy) Adversaries may also modify settings that affect where cloud resources can be deployed, such as enabling [Unused/Unsupported Cloud Regions](https://attack.mitre.org/techniques/T1535).
Query: describe CVE-2015-4626
Matching passage: CVE-2015-4626. CWE: CWE-189. CVSS: 7.5. B.A.S C2Box before 4.0.0 (r19171) relies on client-side validation, which allows remote attackers to "corrupt the business logic" via a negative value in an overdraft.
Near-miss passage: CVE-2015-1804. CWE: CWE-189. CVSS: 8.5. The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not properly perform type conversion for metrics values, which allows remote authenticated users to cause a denial of service (out-of-bounds memory access) and possibly execute arbitrary code via a crafted BDF font file.
Query: containment actions for Persistence mechanism resembling PowerShell Profile
Matching passage: Playbook for T1546.013 PowerShell Profile. 1) Validate alert telemetry against T1546.013. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: privilege escalation, persistence. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may gain persistence and elevate privileges by executing malicious content triggered by PowerShell profiles. A PowerShell profile (<code>profile.ps1</code>) is a script that runs when [PowerShell](https://attack.mitre.org/techniques/T1059/001) starts and can be used as a logon script to customize user environments. [PowerShell](https://attack.mitre.org/techniques/T1059/001) supports se
Near-miss passage: Playbook for T1546.008 Accessibility Features. Different response path focused on privilege escalation, persistence.
Query: Sigma rule for Generic rule for SQL exceptions in Python according to PEP 249
Matching passage: Sigma rule: Generic rule for SQL exceptions in Python according to PEP 249. Logsource: python / application. Rule: title: Python SQL Exceptions id: 19aefed0-ffd4-47dc-a7fc-f8b1425e84f9 status: stable description: Generic rule for SQL exceptions in Python according to PEP 249 references: - https://www.python.org/dev/peps/pep-0249/#exceptions author: Thomas Patzke date: 2017-08-12 modified: 2020-09-01 tags: - attack.initial-access - attack.t1190 logsource: category: application product: python detection: keywords: - DataError - IntegrityError - ProgrammingError - OperationalError condition: keywords falsepositives: - Application bugs level: medium
Near-miss passage: Sigma rule: Detects process creation with a renamed BrowserCore.exe (used to extract Azure tokens). Logsource: windows / process_creation. Rule: title: Renamed BrowserCore.EXE Execution id: 8a4519e8-e64a-40b6-ae85-ba8ad2177559 status: test description: Detects process creation with a renamed BrowserCore.exe (used to extract Azure tokens) references: - https://twitter.com/mariuszbit/status/1531631015139102720 author: Max Altgelt (Nextron Systems) date: 2022-06-02 modified: 2023-02-03 tags: - attack.credential-access - attack.stealth - attack.t1528 - attack.t1036.003 logsource: category: process_creation product: windows detection: selection: OriginalFileName: BrowserCore.exe filter_realbrowsercore: Image|endswith: \BrowserCore.exe condition: selection and not 1 of filter_* falsepositives: - Unknown level: high
Query: common weakness: CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations
Matching passage: CWE-1252 CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations. The CPU is not configured to provide hardware support for exclusivity of write and execute operations on memory. This allows an attacker to execute data from all of memory.
Near-miss passage: CWE-460 Improper Cleanup on Thrown Exception. The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.
Query: describe CVE-2015-1567
Matching passage: CVE-2015-1567. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the admin page in the GD Infinite Scroll module before 7.x-1.4 for Drupal allows remote authenticated users with the "edit gd infinite scroll settings" permission to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-10072. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability classified as problematic was found in NREL api-umbrella-web 0.7.1. This vulnerability affects unknown code of the component Flash Message Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 0.8.0 is able to address this issue. The name of the patch is bcc0e922c61d30367678c8f17a435950969315cd. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-220060.
Query: detect Detects potential DLL side loading of DLLs that are part of the Wazuh security platform in logs
Matching passage: Sigma rule: Detects potential DLL side loading of DLLs that are part of the Wazuh security platform. Logsource: windows / image_load. Rule: title: Potential Wazuh Security Platform DLL Sideloading id: db77ce78-7e28-4188-9337-cf30e2b3ba9f status: test description: Detects potential DLL side loading of DLLs that are part of the Wazuh security platform references: - https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html author: X__Junior (Nextron Systems) date: 2023-03-13 modified: 2023-05-12 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: - \libwazuhshared.dll - \libwinpthread-1.dll filter_main_generic: ImageLoaded|startswith: - C:\Program Files\ - C:\Program Files (x86)\ filter_optional_mingw64: ImageLoaded|contains: - \AppData\Local\ - \ProgramData\ ImageLoaded|endswith: \mingw64\bin\libwinpthread-1.dll condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Many legitimate applications leverage this DLL. (Visual Studio, JetBrains, Ruby, Anaconda, GithubDesktop, etc.) level: medium
Near-miss passage: Sigma rule: Detects programs on a Windows system that should not write an archive to disk. Logsource: windows / file_event. Rule: title: Legitimate Application Dropped Archive id: 654fcc6d-840d-4844-9b07-2c3300e54a26 status: test description: Detects programs on a Windows system that should not write an archive to disk references: - https://github.com/Neo23x0/sysmon-config/blob/3f808d9c022c507aae21a9346afba4a59dd533b9/sysmonconfig-export-block.xml#L1326 author: frack113, Florian Roth date: 2022-08-21 tags: - attack.stealth - attack.t1218 logsource: product: windows category: file_event detection: selection: Image|endswith: - \winword.exe - \excel.exe - \powerpnt.exe - \msaccess.exe - \mspub.exe - \eqnedt32.exe - \visio.exe - \wordpad.exe - \wordview.exe - \certutil.exe - \certoc.exe - \CertReq.exe - \Desktopimgdownldr.exe - \esentutl.exe - \finger.exe - \notepad.exe - \AcroRd32.exe - \RdrCEF.exe - \mshta.exe - \hh.exe TargetFilename|endswith: - .zip - .rar - .7z - .diagcab - .appx condition: selection falsepositives: - Unknown level: high
Query: risk of The Remote Agent component in Schneider Electric InduSoft Web Studio before 8.0 allows remote attackers to execute arbitrary code via unspecified vectors, aka ZDI-CAN-2649.
Matching passage: CVE-2015-7374. CWE: CWE-20. CVSS: 7.5. The Remote Agent component in Schneider Electric InduSoft Web Studio before 8.0 allows remote attackers to execute arbitrary code via unspecified vectors, aka ZDI-CAN-2649.
Near-miss passage: CVE-2015-6783. CWE: CWE-20. CVSS: 4.300000190734863. The FindStartOffsetOfFileInZipFile function in crazy_linker_zip.cpp in crazy_linker (aka Crazy Linker) in Android 5.x and 6.x, as used in Google Chrome before 47.0.2526.73, improperly searches for an EOCD record, which allows attackers to bypass a signature-validation requirement via a crafted ZIP archive.
Query: risk of Mail in Apple OS X before 10.11 does not properly recognize user preferences, which allows attackers to obtain sensitive information via an unspecified action during the printing o
Matching passage: CVE-2015-7761. CWE: CWE-200. CVSS: 5.0. Mail in Apple OS X before 10.11 does not properly recognize user preferences, which allows attackers to obtain sensitive information via an unspecified action during the printing of an e-mail message, a different vulnerability than CVE-2015-7760.
Near-miss passage: CVE-2015-7207. CWE: CWE-200. CVSS: 5.0. Mozilla Firefox before 43.0 does not properly restrict the availability of IFRAME Resource Timing API times, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaScript code that leverages history.back and performance.getEntries calls, a related issue to CVE-2015-1300.
Query: risk of The bj-lazy-load plugin before 1.0 for WordPress has Remote File Inclusion.
Matching passage: CVE-2015-9415. CWE: CWE-20. CVSS: 7.5. The bj-lazy-load plugin before 1.0 for WordPress has Remote File Inclusion.
Near-miss passage: CVE-2015-1379. CWE: CWE-20. CVSS: 7.5. The signal handler implementations in socat before 1.7.3.0 and 2.0.0-b8 allow remote attackers to cause a denial of service (process freeze or crash).
Query: detect Detect malicious GPO modifications can be used to implement many other malicious behaviors. in logs
Matching passage: Sigma rule: Detect malicious GPO modifications can be used to implement many other malicious behaviors.. Logsource: windows / process_creation. Rule: title: Modify Group Policy Settings id: ada4b0c4-758b-46ac-9033-9004613a150d related: - id: b7216a7d-687e-4c8d-82b1-3080b2ad961f type: similar status: test description: Detect malicious GPO modifications can be used to implement many other malicious behaviors. references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1484.001/T1484.001.md author: frack113 date: 2022-08-19 tags: - attack.privilege-escalation - attack.defense-impairment - attack.t1484.001 logsource: category: process_creation product: windows detection: selection_reg: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_path: CommandLine|contains: \SOFTWARE\Policies\Microsoft\Windows\System selection_key: CommandLine|contains: - GroupPolicyRefreshTimeDC - GroupPolicyRefreshTimeOffsetDC - GroupPolicyRefreshTime - GroupPolicyRefreshTimeOffset - EnableSmartScreen - ShellSmartScreenLevel condition: all of selection_* falsepositives: - Legitimate use level: medium
Near-miss passage: Sigma rule: Detects DNS queries to domains commonly used by threat actors to host malware payloads or redirect through URL shortener. Logsource: windows / dns_query. Rule: title: DNS Query To Common Malware Hosting and Shortener Services id: f8c1e80b-c73a-476a-ae24-6c72528b1521 status: experimental description: 'Detects DNS queries to domains commonly used by threat actors to host malware payloads or redirect through URL shorteners. These include platforms like Cloudflare Workers, TryCloudflare, InfinityFree, and URL shorteners such as tinyurl and lihi.cc. Such DNS activity can indicate potential delivery or command-and-control communication attempts. ' references: - https://cloud.google.com/blog/topics/threat-intelligence/apt41-innovative-tactics author: Ahmed Nosir (@egycondor) date: 2025-06-02 tags: - attack.command-and-control - attack.t1071.004 logsource: product: windows category: dns_query detection: selection: QueryName|contains: - msapp.workers.dev - trycloudflare.com - infinityfreeapp.com - my5353.com - reurl.cc - lihi.cc - tinyurl.com condition: selection falsepositives: - Legitimate use of these services is possible but rare in enterprise environments level: medium
Query: ATT&CK technique for InstallUtil
Matching passage: T1218.004 InstallUtil. Tactics: stealth. Description: Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. (Citation: MSDN InstallUtil) The InstallUtil binary may also be digitally signed by Microsoft and located in the .NET directories on a Windows system: <code>C:\Windows\Microsoft.NET\Framework\v<version>\InstallUtil.exe</code> and <code>C:\Windows\Microsoft.NET\Framework64\v<version>\InstallUtil.exe</code>. InstallUtil may also be used to bypass application control through use of attributes within the binary that execute the class decorated with the attribute <code>[System.ComponentModel.RunInstaller(true)]</code>. (Citation: LOLBAS Installutil)
Near-miss passage: T1218.001 Compiled HTML File. Tactics: stealth. Description: Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. (Citation: Microsoft HTML Help May 2018) CHM content is displayed using underlying components of the Internet Explorer browser (Citation: Microsoft HTML Help ActiveX) loaded by the HTML Help executable program (hh.exe). (Citation: Microsoft HTML Help Executable Program) A custom CHM file containing embedded payloads could be delivered to a victim then triggered by [User Execution](https://attack.mitre.org/techniques/T1204). CHM execution may also bypass application application control on older and/or unpatched systems that do not account for execution of binaries through hh.exe. (Citation: MsitPros CHM Aug 2017) (Citation: Microsoft CVE-2017-8625 Aug 2017)
Query: describe CVE-2015-5659
Matching passage: CVE-2015-5659. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in Network Applied Communication Laboratory Pref Shimane CMS 2.x before 2.0.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-9451. CWE: CWE-89. CVSS: 9.800000190734863. The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_mailchimp pmfb_tid parameter.
Query: CVE similar to CVE-2015-9146
Matching passage: CVE-2015-9146. CWE: CWE-20. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9625, MDM9635M, MDM9645, MDM9650, MDM9655, SD 400, SD 800, SD 835, SD 845, SD 850, and SDX20, when QDI read, write, or ioctl are called, the passed-in pointer is not properly validated before accessing it for the delayed response.
Near-miss passage: CVE-2015-0679. CWE: CWE-20. CVSS: 6.099999904632568. The web-authentication functionality on Cisco Wireless LAN Controller (WLC) devices 7.3(103.8) and 7.4(110.0) allows remote attackers to cause a denial of service (device reload) via a malformed password, aka Bug ID CSCui57980.