alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.
Matching passage: CVE-2015-8654. CWE: CWE-787. CVSS: 8.800000190734863. Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (out-of-bounds read and memory corruption) via crafted MPEG-4 data, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, CVE-2015-8451, CVE-2015-8455, CVE-2015-8652, CVE-2015-8656, CVE-2015-8657, CVE-2015-8658, and CVE-2015-8820.
Near-miss passage: CVE-2015-2502. CWE: CWE-787. CVSS: 8.800000190734863. Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," as exploited in the wild in August 2015.
Query: Sigma rule for Detects the addition of a new firewall policy on a Fortinet FortiGate Firewall.
Matching passage: Sigma rule: Detects the addition of a new firewall policy on a Fortinet FortiGate Firewall.. Logsource: fortigate / event. Rule: title: FortiGate - New Firewall Policy Added id: f24ab7a8-f09a-4319-82c1-915586aa642b status: experimental description: Detects the addition of a new firewall policy on a Fortinet FortiGate Firewall. references: - https://www.fortiguard.com/psirt/FG-IR-24-535 - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/333889629/config-firewall-policy - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) date: 2025-11-01 modified: 2026-05-04 tags: - attack.defense-impairment - attack.t1686.002 logsource: product: fortigate service: event detection: selection: action: Add cfgpath: firewall.policy condition: selection falsepositives: - A firewall policy can be added for legitimate purposes. level: medium
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via Stdin in Scripts. Logsource: windows / system. Rule: title: Invoke-Obfuscation Via Stdin - System id: 487c7524-f892-4054-b263-8a0ace63fc25 status: test description: Detects Obfuscated Powershell via Stdin in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2020-10-12 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ImagePath|contains|all: - set - '&&' ImagePath|contains: - environment - invoke - input condition: selection falsepositives: - Unknown level: high
Query: detect Once established within a system or network, an adversary may use automated techniques for collecting internal data in logs
Matching passage: Sigma rule: Once established within a system or network, an adversary may use automated techniques for collecting internal data. Logsource: windows / ps_script. Rule: title: Recon Information for Export with PowerShell id: a9723fcc-881c-424c-8709-fd61442ab3c3 status: test description: Once established within a system or network, an adversary may use automated techniques for collecting internal data references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1119/T1119.md author: frack113 date: 2021-07-30 modified: 2022-12-25 tags: - attack.collection - attack.t1119 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_action: ScriptBlockText|contains: - 'Get-Service ' - 'Get-ChildItem ' - 'Get-Process ' selection_redirect: ScriptBlockText|contains: '> $env:TEMP\' condition: all of selection* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via VAR++ LAUNCHER. Logsource: windows / process_creation. Rule: title: Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION id: e9f55347-2928-4c06-88e5-1a7f8169942e status: test description: Detects Obfuscated Powershell via VAR++ LAUNCHER references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Timur Zinniatullin, oscd.community date: 2020-10-13 modified: 2022-11-16 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - '&&set' - cmd - /c - -f CommandLine|contains: - '{0}' - '{1}' - '{2}' - '{3}' - '{4}' - '{5}' condition: selection falsepositives: - Unknown level: high
Query: EDR alert: possible Serverless (T1583.007)
Matching passage: T1583.007 Serverless. Tactics: resource development. Description: Adversaries may purchase and configure serverless cloud infrastructure, such as Cloudflare Workers, AWS Lambda functions, or Google Apps Scripts, that can be used during targeting. By utilizing serverless infrastructure, adversaries can make it more difficult to attribute infrastructure used during operations back to them. Once acquired, the serverless runtime environment can be leveraged to either respond directly to infected machines or to [Proxy](https://attack.mitre.org/techniques/T1090) traffic to an adversary-owned command and control server.(Citation: BlackWater Malware Cloudflare Workers)(Citation: AWS Lambda Redirector)(Citation: GWS Apps Script Abuse 2021) As traffic generated by these functions will appear to come from subdomains of common cloud providers, it may be difficult to distinguish from ordinary traffic to these providers - making it easier to [Hide Infrastructure](https://attack.mitre.org/techniques/T1665).(Citation: Detecting Command & Control in the Cloud)(Citation: BlackWater Malware Cloudflare Workers)
Near-miss passage: T1583.002 DNS Server. Tactics: resource development. Description: Adversaries may set up their own Domain Name System (DNS) servers that can be used during targeting. During post-compromise activity, adversaries may utilize DNS traffic for various tasks, including for Command and Control (ex: [Application Layer Protocol](https://attack.mitre.org/techniques/T1071)). Instead of hijacking existing DNS servers, adversaries may opt to configure and run their own DNS servers in support of operations. By running their own DNS servers, adversaries can have more control over how they administer server-side DNS C2 traffic ([DNS](https://attack.mitre.org/techniques/T1071/004)). With control over a DNS server, adversaries can configure DNS applications to provide conditional responses to malware and, generally, have more flexibility in the structure of the DNS-based C2 channel.(Citation: Unit42 DNS Mar 2019)
Query: CVE similar to CVE-2015-7291
Matching passage: CVE-2015-7291. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in adv_pwd_cgi in the web management interface on Arris DG860A, TG862A, and TG862G devices with firmware TS0703128_100611 through TS0705125D_031115 allows remote attackers to hijack the authentication of arbitrary users.
Near-miss passage: CVE-2015-8152. CWE: CWE-352. CVSS: 8.0. Cross-site request forgery (CSRF) vulnerability in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6-MP4 allows remote authenticated users to hijack the authentication of administrators for requests that execute arbitrary code by adding lines to a logging script.
Query: patch priority for CVE-2015-7511
Matching passage: CVE-2015-7511. CWE: CWE-200. CVSS: 2.0. Libgcrypt before 1.6.5 does not properly perform elliptic-point curve multiplication during decryption, which makes it easier for physically proximate attackers to extract ECDH keys by measuring electromagnetic emanations.
Near-miss passage: CVE-2015-1314. CWE: CWE-200. CVSS: 2.0999999046325684. The USAA Mobile Banking application before 7.10.1 for Android displays the most recently-used screen before prompting the user for login, which might allow physically proximate users to obtain banking account numbers and balances.
Query: Multiple failed authentications followed by Component Firmware
Matching passage: T1542.002 Component Firmware. Tactics: stealth, persistence. Description: Adversaries may modify component firmware to persist on systems. Some adversaries may employ sophisticated means to compromise computer components and install malicious firmware that will execute adversary code outside of the operating system and main system firmware or BIOS. This technique may be similar to [System Firmware](https://attack.mitre.org/techniques/T1542/001) but conducted upon other system components/devices that may not have the same capability or level of integrity checking. Malicious component firmware could provide both a persistent level of access to systems despite potential typical failures to maintain access and hard disk re-images, as well as a way to evade host software-based defenses and integrity checks.
Near-miss passage: T1542.001 System Firmware. Tactics: stealth, persistence. Description: Adversaries may modify system firmware to persist on systems.The BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) or Extensible Firmware Interface (EFI) are examples of system firmware that operate as the software interface between the operating system and hardware of a computer.(Citation: Wikipedia BIOS)(Citation: Wikipedia UEFI)(Citation: About UEFI) System firmware like BIOS and (U)EFI underly the functionality of a computer and may be modified by an adversary to perform or assist in malicious activity. Capabilities exist to overwrite the system firmware, which may give sophisticated adversaries a means to install malicious firmware updates as a means of persistence on a system that may be difficult to detect.
Query: rule covering Detects potentially suspicious child processes of a ClickOnce deployment application
Matching passage: Sigma rule: Detects potentially suspicious child processes of a ClickOnce deployment application. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Child Process Of ClickOnce Application id: 67bc0e75-c0a9-4cfc-8754-84a505b63c04 status: test description: Detects potentially suspicious child processes of a ClickOnce deployment application references: - https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-12 tags: - attack.execution - attack.stealth logsource: category: process_creation product: windows detection: selection: ParentImage|contains: \AppData\Local\Apps\2.0\ Image|endswith: - \calc.exe - \cmd.exe - \cscript.exe - \explorer.exe - \mshta.exe - \net.exe - \net1.exe - \nltest.exe - \notepad.exe - \powershell.exe - \pwsh.exe - \reg.exe - \regsvr32.exe - \rundll32.exe - \schtasks.exe - \werfault.exe - \wscript.exe condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects usage of the "cipher" built-in utility in order to overwrite deleted data from disk. Adversaries may destroy dat. Logsource: windows / process_creation. Rule: title: Deleted Data Overwritten Via Cipher.EXE id: 4b046706-5789-4673-b111-66f25fe99534 status: test description: 'Detects usage of the "cipher" built-in utility in order to overwrite deleted data from disk. Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md#atomic-test-3---overwrite-deleted-data-on-c-drive author: frack113 date: 2021-12-26 modified: 2023-02-21 tags: - attack.impact - attack.t1485 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: CIPHER.EXE - Image|endswith: \cipher.exe selection_cli: CommandLine|contains: ' /w:' condition: all of selection_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_cipher_overwrite_deleted_data/info.yml simulation: - type: atomic-red-team name: Overwrite deleted data on C drive technique: T1485 atomic_guid: 321fd25e-0007-417f-adec-33232252be19
Query: detection rule: Detects the creation of new DLL assembly files by "aspnet_compiler.exe", which could be a sign of "aspnet_compiler" abus
Matching passage: Sigma rule: Detects the creation of new DLL assembly files by "aspnet_compiler.exe", which could be a sign of "aspnet_compiler" abus. Logsource: windows / file_event. Rule: title: Assembly DLL Creation Via AspNetCompiler id: 4c7f49ee-2638-43bb-b85b-ce676c30b260 related: - id: 9ccba514-7cb6-4c5c-b377-700758f2f120 type: similar - id: 9f50fe98-fe5c-4a2d-86c7-fad7f63ed622 type: similar - id: a01b8329-5953-4f73-ae2d-aa01e1f35f00 type: similar status: test description: 'Detects the creation of new DLL assembly files by "aspnet_compiler.exe", which could be a sign of "aspnet_compiler" abuse to proxy execution through a build provider. ' references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-14 tags: - attack.execution logsource: product: windows category: file_event detection: selection: Image|endswith: \aspnet_compiler.exe TargetFilename|contains|all: - \Temporary ASP.NET Files\ - \assembly\tmp\ - .dll condition: selection falsepositives: - Legitimate assembly compilation using a build provider level: medium
Near-miss passage: Sigma rule: Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest or Invoke-RestMethod cmdlets.. Logsource: windows / process_creation. Rule: title: Potential DLL File Download Via PowerShell Invoke-WebRequest id: 0f0450f3-8b47-441e-a31b-15a91dc243e2 status: test description: Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest or Invoke-RestMethod cmdlets. references: - https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution author: Florian Roth (Nextron Systems), Hieu Tran date: 2023-03-13 modified: 2025-07-18 tags: - attack.command-and-control - attack.execution - attack.t1059.001 - attack.t1105 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - 'Invoke-RestMethod ' - 'Invoke-WebRequest ' - 'IRM ' - 'IWR ' CommandLine|contains|all: - http - OutFile - .dll condition: selection falsepositives: - Unknown level: medium
Query: describe CVE-2015-0324
Matching passage: CVE-2015-0324. CWE: CWE-119. CVSS: 10.0. Buffer overflow in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-5380. CWE: CWE-119. CVSS: 7.5. The Utf8DecoderBase::WriteUtf16Slow function in unicode-decoder.cc in Google V8, as used in Node.js before 0.12.6, io.js before 1.8.3 and 2.x before 2.3.3, and other products, does not verify that there is memory available for a UTF-16 surrogate pair, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted byte sequence.
Query: CVE similar to CVE-2015-5441
Matching passage: CVE-2015-5441. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in HP ArcSight Management Center before 2.1 and ArcSight Logger before 6.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-10075. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability was found in Custom-Content-Width 1.0. It has been declared as problematic. Affected by this vulnerability is the function override_content_width/register_settings of the file custom-content-width.php. The manipulation leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.1 is able to address this issue. The patch is named e05e0104fc42ad13b57e2b2cb2d1857432624d39. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220219. NOTE: This attack is not very likely.
Query: actor TTPs: Service Execution
Matching passage: T1569.002 Service Execution. Tactics: execution. Description: Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (<code>services.exe</code>) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as <code>sc.exe</code> and [Net](https://attack.mitre.org/software/S0039). [PsExec](https://attack.mitre.org/software/S0029) can also be used to execute commands or payloads via a temporary Windows service created through the service control manager API.(Citation: Russinovich Sysinternals) Tools such as [PsExec](https://attack.mitre.org/software/S0029) and <code>sc.exe</code> can accept remote servers as arguments and may be used to conduct remote execution. Adversaries may leverage these mechanisms to execute malicious content. This can be done by either executing a new or modified service. This technique is the execution used in conjunction with [Windows Service](https://attack.mitre.org/techniques/T1543/003) during service persistence or privilege escalation.
Near-miss passage: T1569.003 Systemctl. Tactics: execution. Description: Adversaries may abuse systemctl to execute commands or programs. Systemctl is the primary interface for systemd, the Linux init system and service manager. Typically invoked from a shell, Systemctl can also be integrated into scripts or applications. Adversaries may use systemctl to execute commands or programs as [Systemd Service](https://attack.mitre.org/techniques/T1543/002)s. Common subcommands include: `systemctl start`, `systemctl stop`, `systemctl enable`, `systemctl disable`, and `systemctl status`.(Citation: Red Hat Systemctl 2022)
Query: vulnerability: Cross-site scripting (XSS) vulnerability in IBM Security QRadar SIEM 7.2.x before 7.2.6 allows remote authenticated users to inject arbitrary web script or HTML via an unspecified 
Matching passage: CVE-2015-7409. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in IBM Security QRadar SIEM 7.2.x before 7.2.6 allows remote authenticated users to inject arbitrary web script or HTML via an unspecified field.
Near-miss passage: CVE-2015-0714. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Cisco Finesse Server 10.0(1), 10.5(1), 10.6(1), and 11.0(1) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCut53595.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Ntvdm.exe allows the execution of 16-bit Windows applications on 32-bit Windows operating systems, as well as the execut. Logsource: windows / process_creation. Rule: title: Start of NT Virtual DOS Machine id: 16905e21-66ee-42fe-b256-1318ada2d770 status: test description: Ntvdm.exe allows the execution of 16-bit Windows applications on 32-bit Windows operating systems, as well as the execution of both 16-bit and 32-bit DOS applications references: - https://learn.microsoft.com/en-us/windows/compatibility/ntvdm-and-16-bit-app-support - https://support.microsoft.com/fr-fr/topic/an-ms-dos-based-program-that-uses-the-ms-dos-protected-mode-interface-crashes-on-a-computer-that-is-running-windows-7-5dc739ea-987b-b458-15e4-d28d5cca63c7 - https://app.any.run/tasks/93fe92fa-8b2b-4d92-8c09-a841aed2e793/ - https://app.any.run/tasks/214094a7-0abc-4a7b-a564-1b757faed79d/ author: frack113 date: 2022-07-16 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: Image|endswith: - \ntvdm.exe - \csrstub.exe condition: selection falsepositives: - Legitimate use level: medium
Near-miss passage: Sigma rule: Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode. Restr. Logsource: windows / registry_set. Rule: title: RestrictedAdminMode Registry Value Tampering id: d6ce7ebd-260b-4323-9768-a9631c8d4db2 related: - id: 28ac00d6-22d9-4a3c-927f-bbd770104573 type: similar status: test description: 'Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode. RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop. This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise ' references: - https://github.com/redcanaryco/atomic-red-team/blob/a8e3cf63e97b973a25903d3df9fd55da6252e564/atomics/T1112/T1112.md - https://social.technet.microsoft.com/wiki/contents/articles/32905.remote-desktop-services-enable-restricted-admin-mode.aspx author: frack113 date: 2023-01-13 modified: 2024-08-23 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: registry_set detection: selection: TargetObject|endswith: System\CurrentControlSet\Control\Lsa\DisableRestrictedAdmin condition: selection falsepositives: - Unknown level: high
Query: explain CWE-942
Matching passage: CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains. The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.
Near-miss passage: CWE-122 Heap-based Buffer Overflow. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Query: CVE similar to CVE-2015-0001
Matching passage: CVE-2015-0001. CWE: CWE-264. CVSS: 1.899999976158142. The Windows Error Reporting (WER) component in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to bypass the Protected Process Light protection mechanism and read the contents of arbitrary process-memory locations by leveraging administrative privileges, aka "Windows Error Reporting Security Feature Bypass Vulnerability."
Near-miss passage: CVE-2015-2366. CWE: CWE-264. CVSS: 7.199999809265137. win32k.sys in the kernel-mode drivers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."