alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing.
Matching passage: Sigma rule: Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing.. Logsource: juniper / bgp. Rule: title: Juniper BGP Missing MD5 id: a7c0ae48-8df8-42bf-91bd-2ea57e2f9d43 status: test description: Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing. references: - https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-convery-franz-v3.pdf author: Tim Brown date: 2023-01-09 modified: 2023-01-23 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation - attack.credential-access - attack.collection - attack.stealth - attack.t1078 - attack.t1110 - attack.t1557 logsource: product: juniper service: bgp definition: 'Requirements: juniper bgp logs need to be enabled and ingested' detection: keywords_bgp_juniper: '|all': - :179 - missing MD5 digest condition: keywords_bgp_juniper falsepositives: - Unlikely. Except due to misconfigurations level: low
Near-miss passage: Sigma rule: Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing. The pattern ". Logsource: zeek / dns. Rule: title: Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network id: 5588576c-5898-4fac-bcdd-7475a60e8f43 related: - id: b07e58cf-cacc-4135-8473-ccb2eba63dd2 type: similar - id: e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c type: similar status: experimental description: 'Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts. It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073. ' references: - https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025 - https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-06-20 tags: - attack.collection - attack.credential-access - attack.persistence - attack.privilege-escalation - attack.t1557.001 - attack.t1187 logsource: product: zeek service: dns detection: selection: query|contains|all: - UWhRCA - BAAAA condition: selection falsepositives: - Unknown level: high
Query: weakness Reliance on Insufficiently Trustworthy Component
Matching passage: CWE-1357 Reliance on Insufficiently Trustworthy Component. The product is built from multiple separate components, but it uses a component that is not sufficiently trusted to meet expectations for security, reliability, updateability, and maintainability.
Near-miss passage: CWE-183 Permissive List of Allowed Inputs. The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.
Query: patch priority for CVE-2015-1069
Matching passage: CVE-2015-1069. CWE: CWE-399. CVSS: 6.800000190734863. WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Near-miss passage: CVE-2015-8877. CWE: CWE-399. CVSS: 7.5. The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in PHP before 5.6.12, uses inconsistent allocate and free approaches, which allows remote attackers to cause a denial of service (memory consumption) via a crafted call, as demonstrated by a call to the PHP imagescale function.
Query: CVE similar to CVE-2015-6544
Matching passage: CVE-2015-6544. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in application/dashboard.class.inc.php in Combodo iTop before 2.2.0-2459 allows remote attackers to inject arbitrary web script or HTML via a dashboard title.
Near-miss passage: CVE-2015-3620. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the advanced dataset reports page in Fortinet FortiAnalyzer 5.0.0 through 5.0.10 and 5.2.0 through 5.2.1 and FortiManager 5.0.3 through 5.0.10 and 5.2.0 through 5.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: patch priority for CVE-2015-7264
Matching passage: CVE-2015-7264. CWE: CWE-74. CVSS: 9.800000190734863. The SPDY/2 codec in Facebook Proxygen before 2015-11-09 truncates a certain field to two bytes, which allows hijacking and injection attacks.
Near-miss passage: CVE-2015-5377. CWE: CWE-74. CVSS: 9.800000190734863. Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the transport protocol. NOTE: ZDI appears to claim that CVE-2015-3253 and CVE-2015-5377 are the same vulnerability
Query: CVE similar to CVE-2015-4682
Matching passage: CVE-2015-4682. CWE: CWE-200. CVSS: 6.5. Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows remote authenticated users to obtain the installation path via an HTTP POST request to PlcmRmWeb/JConfigManager.
Near-miss passage: CVE-2015-6747. CWE: CWE-200. CVSS: 5.0. Basware Banking (Maksuliikenne) 8.90.07.X does not properly prevent access to private keys, which allows remote attackers to spoof communications with banks via unspecified vectors. NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 due to different vulnerability types. NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-6746.
Query: CVE similar to CVE-2015-6486
Matching passage: CVE-2015-6486. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability on Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices before B FRN 15.003 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-0780. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in the GetReRequestData method of the GetStoredResult class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Query: CVE similar to CVE-2015-4279
Matching passage: CVE-2015-4279. CWE: CWE-78. CVSS: 7.199999809265137. The Manager component in Cisco Unified Computing System (UCS) 2.2(3b) on B Blade Server devices allows local users to gain privileges for executing arbitrary CLI commands by leveraging access to the subordinate fabric interconnect, aka Bug ID CSCut32778.
Near-miss passage: CVE-2015-7611. CWE: CWE-78. CVSS: 8.100000381469727. Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified vectors.
Query: write Sigma for Detects read access to a domain user from a non-machine account
Matching passage: Sigma rule: Detects read access to a domain user from a non-machine account. Logsource: windows / security. Rule: title: Potential AD User Enumeration From Non-Machine Account id: ab6bffca-beff-4baa-af11-6733f296d57a status: test description: Detects read access to a domain user from a non-machine account references: - https://www.specterops.io/assets/resources/an_ace_up_the_sleeve.pdf - http://www.stuffithoughtiknew.com/2019/02/detecting-bloodhound.html - https://learn.microsoft.com/en-us/windows/win32/adschema/attributes-all - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4662 author: Maxime Thiebaut (@0xThiebaut) date: 2020-03-30 modified: 2022-11-08 tags: - attack.discovery - attack.t1087.002 logsource: product: windows service: security definition: 'Requirements: The "Read all properties" permission on the user object needs to be audited for the "Everyone" principal' detection: selection: EventID: 4662 ObjectType|contains: bf967aba-0de6-11d0-a285-00aa003049e2 AccessMask|endswith: - 1? - 3? - 4? - 7? - 9? - B? - D? - F? filter_main_machine_accounts: SubjectUserName|endswith: $ filter_main_msql: SubjectUserName|startswith: MSOL_ condition: selection and not 1 of filter_main_* falsepositives: - Administrators configuring new users. level: medium
Near-miss passage: Sigma rule: Detects potential persistence activity via startup add-ins that load when Microsoft Office starts (.wll/.xll are simply. Logsource: windows / file_event. Rule: title: Potential Persistence Via Microsoft Office Add-In id: 8e1cb247-6cf6-42fa-b440-3f27d57e9936 status: test description: Detects potential persistence activity via startup add-ins that load when Microsoft Office starts (.wll/.xll are simply .dll fit for Word or Excel). references: - Internal Research - https://labs.withsecure.com/publications/add-in-opportunities-for-office-persistence - https://github.com/redcanaryco/atomic-red-team/blob/4ae9580a1a8772db87a1b6cdb0d03e5af231e966/atomics/T1137.006/T1137.006.md author: NVISO date: 2020-05-11 modified: 2023-02-08 tags: - attack.persistence - attack.t1137.006 logsource: category: file_event product: windows detection: selection_wlldropped: TargetFilename|contains: \Microsoft\Word\Startup\ TargetFilename|endswith: .wll selection_xlldropped: TargetFilename|contains: \Microsoft\Excel\Startup\ TargetFilename|endswith: .xll selection_xladropped: TargetFilename|contains: Microsoft\Excel\XLSTART\ TargetFilename|endswith: .xlam selection_generic: TargetFilename|contains: \Microsoft\Addins\ TargetFilename|endswith: - .xlam - .xla - .ppam condition: 1 of selection_* falsepositives: - Legitimate add-ins level: high
Query: risk of Heap-based buffer overflow in libaxl 0.6.9 allows attackers to cause a denial of service (memory corruption) or execute arbitrary code via a crafted XML document.
Matching passage: CVE-2015-3450. CWE: CWE-119. CVSS: 8.800000190734863. Heap-based buffer overflow in libaxl 0.6.9 allows attackers to cause a denial of service (memory corruption) or execute arbitrary code via a crafted XML document.
Near-miss passage: CVE-2015-3702. CWE: CWE-119. CVSS: 7.199999809265137. Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-3695, CVE-2015-3696, CVE-2015-3697, CVE-2015-3698, CVE-2015-3699, CVE-2015-3700, and CVE-2015-3701.
Query: Sigma rule for Detects piping the password to an anydesk instance via CMD and the '--set-password' flag.
Matching passage: Sigma rule: Detects piping the password to an anydesk instance via CMD and the '--set-password' flag.. Logsource: windows / process_creation. Rule: title: Remote Access Tool - AnyDesk Piped Password Via CLI id: b1377339-fda6-477a-b455-ac0923f9ec2c status: test description: Detects piping the password to an anydesk instance via CMD and the '--set-password' flag. references: - https://redcanary.com/blog/misbehaving-rats/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-28 modified: 2023-03-05 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - '/c ' - 'echo ' - .exe --set-password condition: selection falsepositives: - Legitimate piping of the password to anydesk - Some FP could occur with similar tools that uses the same command line '--set-password' level: medium
Near-miss passage: Sigma rule: Potential threat actor tampering with Sysmon manifest and eventually disabling it. Logsource: windows / security. Rule: title: Sysmon Channel Reference Deletion id: 18beca67-ab3e-4ee3-ba7a-a46ca8d7d0cc status: test description: Potential threat actor tampering with Sysmon manifest and eventually disabling it references: - https://twitter.com/Flangvik/status/1283054508084473861 - https://twitter.com/SecurityJosh/status/1283027365770276866 - https://securityjosh.github.io/2020/04/23/Mute-Sysmon.html - https://gist.github.com/Cyb3rWard0g/cf08c38c61f7e46e8404b38201ca01c8 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-07-14 modified: 2025-10-22 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows service: security detection: selection1: EventID: 4657 ObjectName|contains: - WINEVT\Publishers\{5770385f-c22a-43e0-bf4c-06f5698ffbd9} - WINEVT\Channels\Microsoft-Windows-Sysmon/Operational ObjectValueName: Enabled NewValue: 0 selection2: EventID: 4663 ObjectName|contains: - WINEVT\Publishers\{5770385f-c22a-43e0-bf4c-06f5698ffbd9} - WINEVT\Channels\Microsoft-Windows-Sysmon/Operational AccessMask: '0x10000' condition: 1 of selection* falsepositives: - Unknown level: high
Query: alert when Detects the creation of a file with the ".dmp"/".hdmp" extension by a shell or scripting application such as "cmd", "pow
Matching passage: Sigma rule: Detects the creation of a file with the ".dmp"/".hdmp" extension by a shell or scripting application such as "cmd", "pow. Logsource: windows / file_event. Rule: title: Potentially Suspicious DMP/HDMP File Creation id: aba15bdd-657f-422a-bab3-ac2d2a0d6f1c related: - id: 3a525307-d100-48ae-b3b9-0964699d7f97 type: similar status: test description: Detects the creation of a file with the ".dmp"/".hdmp" extension by a shell or scripting application such as "cmd", "powershell", etc. Often created by software during a crash. Memory dumps can sometimes contain sensitive information such as credentials. It's best to determine the source of the crash. references: - https://learn.microsoft.com/en-us/windows/win32/wer/collecting-user-mode-dumps author: Nasreddine Bencherchali (Nextron Systems) date: 2023-09-07 tags: - attack.stealth logsource: category: file_event product: windows detection: selection: Image|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \wscript.exe TargetFilename|endswith: - .dmp - .dump - .hdmp condition: selection falsepositives: - Some administrative PowerShell or VB scripts might have the ability to collect dumps and move them to other folders which might trigger a false positive. level: medium regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_dump_file_susp_creation/info.yml
Near-miss passage: Sigma rule: Detects potential LethalHTA technique where the "mshta.exe" is spawned by an "svchost.exe" process. Logsource: windows / process_creation. Rule: title: Potential LethalHTA Technique Execution id: ed5d72a6-f8f4-479d-ba79-02f6a80d7471 status: test description: Detects potential LethalHTA technique where the "mshta.exe" is spawned by an "svchost.exe" process references: - https://codewhitesec.blogspot.com/2018/07/lethalhta.html author: Markus Neis date: 2018-06-07 modified: 2023-02-07 tags: - attack.stealth - attack.t1218.005 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \svchost.exe Image|endswith: \mshta.exe condition: selection falsepositives: - Unknown level: high
Query: SOC runbook when seeing Encoded PowerShell / command-line abuse matching TFTP Boot
Matching passage: Playbook for T1542.005 TFTP Boot. 1) Validate alert telemetry against T1542.005. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth, persistence. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server. TFTP boot (netbooting) is commonly used by network administrators to load configuration-controlled network device images from a centralized management server. Netbooting is one option in the boot sequence and can be used to centralize, manage, and control de
Near-miss passage: Playbook for T1542.003 Bootkit. Different response path focused on stealth, persistence.
Query: patch priority for CVE-2015-8013
Matching passage: CVE-2015-8013. CWE: CWE-310. CVSS: 7.5. s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allows remote attackers to bypass authentication if message decryption is used as an authentication mechanism via a crafted symmetrically encrypted PGP message.
Near-miss passage: CVE-2015-1596. CWE: CWE-310. CVSS: 5.800000190734863. The Siemens SPCanywhere application for Android and iOS does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Query: vulnerability: Stack-based buffer overflow in the agent in Persistent Accelerite Radia Client Automation (formerly HP Client Automation), possibly before 9.1, allows remote attackers to execute a
Matching passage: CVE-2015-7860. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in the agent in Persistent Accelerite Radia Client Automation (formerly HP Client Automation), possibly before 9.1, allows remote attackers to execute arbitrary code by sending a large amount of data in an environment that lacks relationship-based firewalling.
Near-miss passage: CVE-2015-3665. CWE: CWE-119. CVSS: 6.800000190734863. QT Media Foundation in Apple QuickTime before 7.7.7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, a different vulnerability than CVE-2015-3664 and CVE-2015-3669.
Query: SOC runbook when seeing Multiple failed authentications followed by Dynamic API Resolution
Matching passage: Playbook for T1027.007 Dynamic API Resolution. 1) Validate alert telemetry against T1027.007. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may obfuscate then dynamically resolve API functions called by their malware in order to conceal malicious functionalities and impair defensive analysis. Malware commonly uses various [Native API](https://attack.mitre.org/techniques/T1106) functions provided by the OS to perform various tasks such as those involving processes, files, and other system artifacts. API functions called by
Near-miss passage: Playbook for T1027.014 Polymorphic Code. Different response path focused on stealth.
Query: adversary uses Selective Exclusion
Matching passage: T1679 Selective Exclusion. Tactics: stealth. Description: Adversaries may intentionally exclude certain files, folders, directories, file types, or system components from encryption or tampering during a ransomware or malicious payload execution. Some file extensions that adversaries may avoid encrypting include `.dll`, `.exe`, and `.lnk`.(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024) Adversaries may perform this behavior to avoid alerting users, to evade detection by security tools and analysts, or, in the case of ransomware, to ensure that the system remains operational enough to deliver the ransom notice. Exclusions may target files and components whose corruption would cause instability, break core services, or immediately expose the attack. By carefully avoiding these areas, adversaries maintain system responsiveness while minimizing indicators that could trigger alarms or otherwise inhibit achieving their goals.
Near-miss passage: T1055.002 Portable Executable Injection. Tactics: stealth, privilege escalation. Description: Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges. PE injection is a method of executing arbitrary code in the address space of a separate live process. PE injection is commonly performed by copying code (perhaps without a file on disk) into the virtual address space of the target process before invoking it via a new thread. The write can be performed with native Windows API calls such as <code>VirtualAllocEx</code> and <code>WriteProcessMemory</code>, then invoked with <code>CreateRemoteThread</code> or additional code (ex: shellcode). The displacement of the injected code does introduce the additional requirement for functionality to remap memory references. (Citation: Elastic Process Injection July 2017) Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via PE injection may also evade detection from security products since the execution is masked under a legitimate process.
Query: describe CVE-2015-2630
Matching passage: CVE-2015-2630. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Technology stack component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.3 allows remote attackers to affect integrity via unknown vectors related to Applet startup.
Near-miss passage: CVE-2015-9216. CWE: UNKNOWN. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9625, MDM9635M, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 808, and SD 810, improper handling of simultaneous interrupt in USB module during USB RESET and EP COMPLETE.
Query: patch priority for CVE-2015-7349
Matching passage: CVE-2015-7349. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the sample feedback.inc file in VASCO DIGIPASS authentication plug-in for Citrix Web Interface allows remote attackers to inject arbitrary web script or HTML via the failmessage parameter.
Near-miss passage: CVE-2015-5520. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Users module in Orchard 1.7.3 through 1.8.2 and 1.9.x before 1.9.1 allows remote attackers to inject arbitrary web script or HTML via the username when creating a new user account, which is not properly handled when deleting an account.
Query: explain CWE-625
Matching passage: CWE-625 Permissive Regular Expression. The product uses a regular expression that does not sufficiently restrict the set of allowed values.
Near-miss passage: CWE-1394 Use of Default Cryptographic Key. The product uses a default cryptographic key for potentially critical functionality.
Query: risk of Cross-site scripting (XSS) vulnerability in shared/shortcodes/inbound-shortcodes.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to inj
Matching passage: CVE-2015-4065. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in shared/shortcodes/inbound-shortcodes.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the post parameter to wp-admin/post-new.php.
Near-miss passage: CVE-2015-5520. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Users module in Orchard 1.7.3 through 1.8.2 and 1.9.x before 1.9.1 allows remote attackers to inject arbitrary web script or HTML via the username when creating a new user account, which is not properly handled when deleting an account.