alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: CVE similar to CVE-2015-7369
Matching passage: CVE-2015-7369. CWE: CWE-284. CVSS: 7.5. The default Flash cross-domain policy (crossdomain.xml) in Revive Adserver before 3.2.2 does not restrict access cross domain access, which allows remote attackers to conduct cross domain attacks via unspecified vectors.
Near-miss passage: CVE-2015-9064. CWE: CWE-284. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, the UE can send IMEI or IMEISV to the network on a network request before NAS security has been activated.
Query: alert when Detects process injection using the signed Windows tool "Mavinject" via the "INJECTRUNNING" flag
Matching passage: Sigma rule: Detects process injection using the signed Windows tool "Mavinject" via the "INJECTRUNNING" flag. Logsource: windows / process_creation. Rule: title: Mavinject Inject DLL Into Running Process id: 4f73421b-5a0b-4bbf-a892-5a7fb99bea66 related: - id: 17eb8e57-9983-420d-ad8a-2c4976c22eb8 type: obsolete status: test description: Detects process injection using the signed Windows tool "Mavinject" via the "INJECTRUNNING" flag references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.004/T1056.004.md - https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e - https://twitter.com/gN3mes1s/status/941315826107510784 - https://reaqta.com/2017/12/mavinject-microsoft-injector/ - https://twitter.com/Hexacorn/status/776122138063409152 - https://github.com/SigmaHQ/sigma/issues/3742 - https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries/blob/6a228d23eefe963ca81f2d52f94b815f61ef5ee0/Tactics/DefenseEvasion.md#t1055-process-injection author: frack113, Florian Roth date: 2021-07-12 modified: 2022-12-05 tags: - attack.privilege-escalation - attack.stealth - attack.t1055.001 - attack.t1218.013 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: ' /INJECTRUNNING ' filter: ParentImage: C:\Windows\System32\AppVClient.exe condition: selection and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission gr. Logsource: windows / ps_module. Rule: title: AD Groups Or Users Enumeration Using PowerShell - PoshModule id: 815bfc17-7fc6-4908-a55e-2f37b98cedb4 status: test description: 'Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.002/T1069.002.md author: frack113 date: 2021-12-15 modified: 2023-01-20 tags: - attack.discovery - attack.t1069.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_ad_principal: - Payload|contains: get-ADPrincipalGroupMembership - ContextInfo|contains: get-ADPrincipalGroupMembership selection_get_aduser: - Payload|contains|all: - get-aduser - '-f ' - '-pr ' - DoesNotRequirePreAuth - ContextInfo|contains|all: - get-aduser - '-f ' - '-pr ' - DoesNotRequirePreAuth condition: 1 of selection_* falsepositives: - Administrator script level: low
Query: exploit Xen allows guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory by not enabling memory and I/O decoding control bits. NOTE: this vul
Matching passage: CVE-2015-8553. CWE: CWE-200. CVSS: 6.5. Xen allows guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory by not enabling memory and I/O decoding control bits. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0777.
Near-miss passage: CVE-2015-4961. CWE: CWE-200. CVSS: 2.5999999046325684. IBM Tealeaf Customer Experience 8.x before 8.7.1.8847 FP10, 8.8.x before 8.8.0.9049 FP9, 9.0.0 and 9.0.1 before 9.0.1.1117 FP5, 9.0.1A before 9.0.1.5108 FP5, 9.0.2 before 9.0.2.1223 FP3, and 9.0.2A before 9.0.2.5224 FP3 does not encrypt connections between internal servers, which allows remote attackers to obtain sensitive information by sniffing the network for HTTP traffic.
Query: rule covering Identifies when a privilege role can be activated without performing mfa.
Matching passage: Sigma rule: Identifies when a privilege role can be activated without performing mfa.. Logsource: azure / pim. Rule: title: Roles Activation Doesn't Require MFA id: 94a66f46-5b64-46ce-80b2-75dcbe627cc0 status: test description: Identifies when a privilege role can be activated without performing mfa. references: - https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#roles-dont-require-multi-factor-authentication-for-activation author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-14 tags: - attack.initial-access - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation logsource: product: azure service: pim detection: selection: riskEventType: noMfaOnRoleActivationAlertIncident condition: selection falsepositives: - Investigate if user is performing MFA at sign-in. level: high
Near-miss passage: Sigma rule: Detects the use of grep to discover specific files created by the GobRAT malware. Logsource: linux / process_creation. Rule: title: Potential GobRAT File Discovery Via Grep id: e34cfa0c-0a50-4210-9cb3-5632d08eb041 status: test description: Detects the use of grep to discover specific files created by the GobRAT malware references: - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-06-02 tags: - attack.discovery - attack.t1082 logsource: category: process_creation product: linux detection: selection: Image|endswith: /grep CommandLine|contains: - apached - frpc - sshd.sh - zone.arm condition: selection falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-4613
Matching passage: CVE-2015-4613. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the backend module in the Developer Log (devlog) extension before 2.11.4 for TYPO3 allows remote editors to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-9315. CWE: CWE-89. CVSS: 9.800000190734863. The newstatpress plugin before 1.0.1 for WordPress has SQL injection.
Query: explain CWE-535
Matching passage: CWE-535 Exposure of Information Through Shell Error Message. A command shell error message indicates that there exists an unhandled exception in the web application code. In many cases, an attacker can leverage the conditions that cause these errors in order to gain unauthorized access to the system.
Near-miss passage: CWE-83 Improper Neutralization of Script in Attributes in a Web Page. The product does not neutralize or incorrectly neutralizes javascript: or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.
Query: Sigma YAML for windows / image_load
Matching passage: Sigma rule: Detects potential DLL sideloading of a signed dbghelp.dll by the Sysinternals VMMap.. Logsource: windows / image_load. Rule: title: VMMap Signed Dbghelp.DLL Potential Sideloading id: 98ffaed4-aec2-4e04-9b07-31492fe68b3d related: - id: 273a8dd8-3742-4302-bcc7-7df5a80fe425 type: similar status: test description: Detects potential DLL sideloading of a signed dbghelp.dll by the Sysinternals VMMap. references: - https://techcommunity.microsoft.com/t5/sysinternals-blog/zoomit-v7-1-procdump-2-0-for-linux-process-explorer-v17-05/ba-p/3884766 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-09-05 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|contains: C:\Debuggers\dbghelp.dll Image|endswith: - \vmmap.exe - \vmmap64.exe Signed: 'true' condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects usage of the "Get-AdGroup" cmdlet to enumerate Groups within Active Directory. Logsource: windows / ps_script. Rule: title: Active Directory Group Enumeration With Get-AdGroup id: 8c3a6607-b7dc-4f0d-a646-ef38c00b76ee status: test description: Detects usage of the "Get-AdGroup" cmdlet to enumerate Groups within Active Directory references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md author: frack113 date: 2022-03-17 modified: 2022-11-17 tags: - attack.discovery - attack.t1069.002 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - 'Get-AdGroup ' - -Filter condition: selection falsepositives: - Unknown level: low
Query: rule covering Detects the execution of "lodctr.exe" to rebuild the performance counter registry values. This can be abused by attacker
Matching passage: Sigma rule: Detects the execution of "lodctr.exe" to rebuild the performance counter registry values. This can be abused by attacker. Logsource: windows / process_creation. Rule: title: Rebuild Performance Counter Values Via Lodctr.EXE id: cc9d3712-6310-4320-b2df-7cb408274d53 status: test description: Detects the execution of "lodctr.exe" to rebuild the performance counter registry values. This can be abused by attackers by providing a malicious config file to overwrite performance counter configuration to confuse and evade monitoring and security solutions. references: - https://learn.microsoft.com/en-us/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-15 modified: 2024-03-05 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \lodctr.exe OriginalFileName: LODCTR.EXE selection_cli: CommandLine|contains|windash: ' -r' condition: all of selection_* falsepositives: - Legitimate usage by an administrator level: medium
Near-miss passage: Sigma rule: WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on. Logsource: windows / process_creation. Rule: title: HackTool - winPEAS Execution id: 98b53e78-ebaf-46f8-be06-421aafd176d9 status: test description: WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz references: - https://github.com/carlospolop/PEASS-ng - https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation author: Georg Lauenstein (sure[secure]) date: 2022-09-19 modified: 2023-03-23 tags: - attack.privilege-escalation - attack.discovery - attack.t1082 - attack.t1087 - attack.t1046 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: winPEAS.exe - Image|endswith: - \winPEASany_ofs.exe - \winPEASany.exe - \winPEASx64_ofs.exe - \winPEASx64.exe - \winPEASx86_ofs.exe - \winPEASx86.exe selection_cli_option: CommandLine|contains: - ' applicationsinfo' - ' browserinfo' - ' eventsinfo' - ' fileanalysis' - ' filesinfo' - ' processinfo' - ' servicesinfo' - ' windowscreds' selection_cli_dl: CommandLine|contains: https://github.com/carlospolop/PEASS-ng/releases/latest/download/ selection_cli_specific: - ParentCommandLine|endswith: ' -linpeas' - CommandLine|endswith: ' -linpeas' condition: 1 of selection_* falsepositives: - Unlikely level: high
Query: vulnerability: The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted requests.
Matching passage: CVE-2015-7705. CWE: CWE-20. CVSS: 9.800000190734863. The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted requests.
Near-miss passage: CVE-2015-8226. CWE: CWE-20. CVSS: 5.5. The Joint Photographic Experts Group Processing Unit (JPU) driver in Huawei ALE smartphones with software before ALE-UL00C00B220 and ALE-TL00C01B220 and GEM-703L smartphones with software before V100R001C233B111 allows remote attackers to cause a denial of service (crash) via a crafted application with the system or camera permission, a different vulnerability than CVE-2015-8225.
Query: CVE similar to CVE-2015-2803
Matching passage: CVE-2015-2803. CWE: CWE-89. CVSS: 6.0. SQL injection vulnerability in mod1/index.php in the Akronymmanager (sb_akronymmanager) extension before 7.0.0 for TYPO3 allows remote authenticated users with permission to maintain acronyms to execute arbitrary SQL commands via the id parameter.
Near-miss passage: CVE-2015-0894. CWE: CWE-89. CVSS: 6.0. SQL injection vulnerability in the All In One WP Security & Firewall plugin before 3.8.8 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Query: adversary uses Component Object Model Hijacking
Matching passage: T1546.015 Component Object Model Hijacking. Tactics: privilege escalation, persistence. Description: Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects. COM is a system within Windows to enable interaction between software components through the operating system.(Citation: Microsoft Component Object Model) References to various COM objects are stored in the Registry. Adversaries may use the COM system to insert malicious code that can be executed in place of legitimate software through hijacking the COM references and relationships as a means for persistence. Hijacking a COM object requires a change in the Registry to replace a reference to a legitimate system component which may cause that component to not work when executed. When that system component is executed through normal system operation the adversary's code will be executed instead.(Citation: GDATA COM Hijacking) An adversary is likely to hijack objects that are used frequently enough to maintain a consistent level of persistence, but are unlikely to break noticeable functionality within the system as to avoid system instability that could lead to detection. One variation of COM hijacking involves abusing Type Libraries (TypeLibs), which provide metadata about COM objects, such as their interfaces and methods. Adversaries may modify Registry keys associated with TypeLibs to redirect legitimate COM object functionality to malicious scripts or payloads. Unlike traditional COM hijacking, which commonly uses local DLLs, this variation may leverage the "script:" moniker to execute remote scripts hosted on external servers.(Citation: RELIAQUEST) This approach enables stealthy execution of code while maintaining persistence, as the remote payload would be automatically downloaded whenever the hijacked COM object is accessed.
Near-miss passage: T1546.007 Netsh Helper DLL. Tactics: privilege escalation, persistence. Description: Adversaries may establish persistence by executing malicious content triggered by Netsh Helper DLLs. Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system. It contains functionality to add helper DLLs for extending functionality of the utility.(Citation: TechNet Netsh) The paths to registered netsh.exe helper DLLs are entered into the Windows Registry at <code>HKLM\SOFTWARE\Microsoft\Netsh</code>. Adversaries can use netsh.exe helper DLLs to trigger execution of arbitrary code in a persistent manner. This execution would take place anytime netsh.exe is executed, which could happen automatically, with another persistence technique, or if other software (ex: VPN) is present on the system that executes netsh.exe as part of its normal functionality.(Citation: Github Netsh Helper CS Beacon)(Citation: Demaske Netsh Persistence)
Query: risk of The System Snapshot feature in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.1 allows remote authenticated users to obtain sensitive password-hash information
Matching passage: CVE-2015-4314. CWE: CWE-200. CVSS: 4.0. The System Snapshot feature in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.1 allows remote authenticated users to obtain sensitive password-hash information by reading the snapshot file, aka Bug ID CSCuv40422.
Near-miss passage: CVE-2015-3098. CWE: CWE-200. CVSS: 5.0. Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allow remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2015-3099 and CVE-2015-3102.
Query: patch priority for CVE-2015-3684
Matching passage: CVE-2015-3684. CWE: CWE-119. CVSS: 6.800000190734863. The HTTPAuthentication implementation in CFNetwork in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted credentials in a URL.
Near-miss passage: CVE-2015-6079. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6068, CVE-2015-6072, CVE-2015-6073, CVE-2015-6075, CVE-2015-6077, CVE-2015-6080, and CVE-2015-6082.
Query: Sigma rule for Detects process creation with suspicious whitespace padding followed by a '#' character, which may indicate ClickFix or
Matching passage: Sigma rule: Detects process creation with suspicious whitespace padding followed by a '#' character, which may indicate ClickFix or. Logsource: windows / process_creation. Rule: title: Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFix id: 3ae9974a-eb09-4044-8e70-8980a50c12c8 related: - id: 8f2a5c3d-9e4b-4a7c-8d1f-2e5a6b9c3d7e type: similar - id: 7a1b4c5e-8f3d-4b9a-7c2e-1f4a5b8c6d9e type: similar status: experimental description: 'Detects process creation with suspicious whitespace padding followed by a ''#'' character, which may indicate ClickFix or FileFix techniques used to conceal malicious commands from visual inspection. ClickFix and FileFix are social engineering attack techniques where adversaries distribute phishing documents or malicious links that deceive users into opening the Windows Run dialog box or File Explorer search bar. The victims are then instructed to paste commands from their clipboard, which contain extensive whitespace padding using various Unicode space characters to push the actual malicious command far to the right, effectively hiding it from immediate view. ' references: - https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/ - https://mrd0x.com/filefix-clickfix-alternative/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-04 modified: 2025-11-26 tags: - attack.execution - attack.stealth - attack.t1204.004 - attack.t1027.010 logsource: category: process_creation product: windows detection: selection_explorer: ParentImage|endswith: \explorer.exe CommandLine|contains: '#' selection_space_variation: CommandLine|contains: - - - - - - - - - - - - - ' ' condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via use Rundll32 in Scripts. Logsource: windows / ps_module. Rule: title: Invoke-Obfuscation Via Use Rundll32 - PowerShell Module id: 88a22f69-62f9-4b8a-aa00-6b0212f2f05a related: - id: a5a30a6e-75ca-4233-8b8c-42e0f2037d3b type: derived status: test description: Detects Obfuscated Powershell via use Rundll32 in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2019-10-08 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_4103: Payload|contains|all: - '&&' - rundll32 - shell32.dll - shellexec_rundll Payload|contains: - value - invoke - comspec - iex condition: selection_4103 falsepositives: - Unknown level: high
Query: describe CVE-2015-2518
Matching passage: CVE-2015-2518. CWE: CWE-264. CVSS: 6.900000095367432. The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka "Win32k Memory Corruption Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2511, CVE-2015-2517, and CVE-2015-2546.
Near-miss passage: CVE-2015-3246. CWE: CWE-264. CVSS: 7.199999809265137. libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.
Query: vulnerability: The MetaIO SDK before 6.0.2.1 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker
Matching passage: CVE-2015-2001. CWE: CWE-118. CVSS: 9.800000190734863. The MetaIO SDK before 6.0.2.1 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.
Near-miss passage: CVE-2015-2004. CWE: CWE-118. CVSS: 9.800000190734863. The GraceNote GNSDK SDK before SVN Changeset 1.1.7 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.