alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-7614
Matching passage: CVE-2015-7614. CWE: UNKNOWN. CVSS: 6.800000190734863. Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions and execute arbitrary commands via an app.launchURL call, a different vulnerability than CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6712, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7616, CVE-2015-7618, CVE-2015-7619, CVE-2015-7620, and CVE-2015-7623.
Near-miss passage: CVE-2015-0403. CWE: UNKNOWN. CVSS: 6.900000095367432. Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.
Query: risk of Directory traversal vulnerability in the SFTP server in Huawei AR 120, 150, 160, 200, 500, 1200, 2200, 3200, and 3600 routers with software before V200R006SPH003 allows remote auth
Matching passage: CVE-2015-8228. CWE: CWE-22. CVSS: 4.0. Directory traversal vulnerability in the SFTP server in Huawei AR 120, 150, 160, 200, 500, 1200, 2200, 3200, and 3600 routers with software before V200R006SPH003 allows remote authenticated users to access arbitrary directories via unspecified vectors.
Near-miss passage: CVE-2015-5471. CWE: CWE-22. CVSS: 5.300000190734863. Absolute path traversal vulnerability in include/user/download.php in the Swim Team plugin 1.44.10777 for WordPress allows remote attackers to read arbitrary files via a full pathname in the file parameter.
Query: patch priority for CVE-2015-0167
Matching passage: CVE-2015-0167. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in textAngular-sanitize.js in textAngular before 1.3.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to the editor.
Near-miss passage: CVE-2015-4387. CWE: CWE-79. CVSS: 2.5999999046325684. Cross-site scripting (XSS) vulnerability in unspecified administration pages in the Password Policy module 6.x-1.x before 6.x-1.11 and 7.x-1.x before 7.x-1.11 for Drupal, when a site has a policy that uses the username constraint, allows remote attackers to inject arbitrary web script or HTML via a crafted username that is imported from an external source.
Query: describe CVE-2015-7707
Matching passage: CVE-2015-7707. CWE: CWE-264. CVSS: 6.5. Ignite Realtime Openfire 3.10.2 allows remote authenticated users to gain administrator access via the isadmin parameter to user-edit-form.jsp.
Near-miss passage: CVE-2015-0768. CWE: CWE-264. CVSS: 6.5. The Device Work Center (DWC) component in Cisco Prime Network Control System (NCS) 2.1(0.0.85), 2.2(0.0.58), and 2.2(0.0.69) does not properly implement AAA roles, which allows remote authenticated users to bypass intended access restrictions and execute commands via a login session, aka Bug ID CSCur27371.
Query: risk of The web-server component in MNS before 4.5.6 on Belden GarrettCom Magnum 6K and Magnum 10K switches allows remote authenticated users to cause a denial of service (memory corruptio
Matching passage: CVE-2015-3961. CWE: CWE-399. CVSS: 3.5. The web-server component in MNS before 4.5.6 on Belden GarrettCom Magnum 6K and Magnum 10K switches allows remote authenticated users to cause a denial of service (memory corruption and reboot) via a crafted URL.
Near-miss passage: CVE-2015-6332. CWE: CWE-399. CVSS: 5.0. Cisco Prime Infrastructure 2.2 allows remote attackers to cause a denial of service (daemon hang) by sending many SSL renegotiation requests, aka Bug ID CSCuv56830.
Query: Sigma YAML for windows / network_connection
Matching passage: Sigma rule: Detects network connections from the Equation Editor process "eqnedt32.exe".. Logsource: windows / network_connection. Rule: title: Network Connection Initiated By Eqnedt32.EXE id: a66bc059-c370-472c-a0d7-f8fd1bf9d583 status: test description: Detects network connections from the Equation Editor process "eqnedt32.exe". references: - https://twitter.com/forensicitguy/status/1513538712986079238 - https://forensicitguy.github.io/xloader-formbook-velvetsweatshop-spreadsheet/ - https://news.sophos.com/en-us/2019/07/18/a-new-equation-editor-exploit-goes-commercial-as-maldoc-attacks-using-it-spike/ author: Max Altgelt (Nextron Systems) date: 2022-04-14 modified: 2024-05-31 tags: - attack.execution - attack.t1203 logsource: category: network_connection product: windows detection: selection: Image|endswith: \eqnedt32.exe condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the load of EvtMuteHook.dll, a key component of SharpEvtHook, a tool that tampers with the Windows event logs. Logsource: windows / image_load. Rule: title: HackTool - SharpEvtMute DLL Load id: 49329257-089d-46e6-af37-4afce4290685 related: - id: bedfc8ad-d1c7-4e37-a20e-e2b0dbee759c type: similar status: test description: Detects the load of EvtMuteHook.dll, a key component of SharpEvtHook, a tool that tampers with the Windows event logs references: - https://github.com/bats3c/EvtMute author: Florian Roth (Nextron Systems) date: 2022-09-07 modified: 2024-11-23 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: image_load product: windows detection: selection: Hashes|contains: IMPHASH=330768A4F172E10ACB6287B87289D83B condition: selection falsepositives: - Other DLLs with the same Imphash level: high
Query: incident response steps for Persistence mechanism resembling Reversible Encryption
Matching passage: Playbook for T1556.005 Reversible Encryption. 1) Validate alert telemetry against T1556.005. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: defense impairment, persistence, credential access. 5) Eradicate persistence and recover. Reference detection notes: An adversary may abuse Active Directory authentication encryption properties to gain access to credentials on Windows systems. The <code>AllowReversiblePasswordEncryption</code> property specifies whether reversible password encryption for an account is enabled or disabled. By default this property is disabled (instead storing user credentials as the output of one-way hashing functions) and should
Near-miss passage: Playbook for T1556 Modify Authentication Process. Different response path focused on defense impairment, persistence, credential access.
Query: risk of IBM Capacity Management Analytics 2.1.0.0 allows local users to decrypt usernames and passwords by leveraging access to setenv.sh and parameter.txt. IBM X-Force ID: 107861.
Matching passage: CVE-2015-7432. CWE: CWE-200. CVSS: 7.800000190734863. IBM Capacity Management Analytics 2.1.0.0 allows local users to decrypt usernames and passwords by leveraging access to setenv.sh and parameter.txt. IBM X-Force ID: 107861.
Near-miss passage: CVE-2015-6418. CWE: CWE-200. CVSS: 4.300000190734863. The random-number generator on Cisco Small Business RV routers 4.x and SA500 security appliances 2.2.07 does not have sufficient entropy, which makes it easier for remote attackers to determine a TLS key pair via unspecified computations upon handshake key-exchange data, aka Bug ID CSCus15224.
Query: detect Detects access to a protected_storage service over the network. Potential abuse of DPAPI to extract domain backup keys f in logs
Matching passage: Sigma rule: Detects access to a protected_storage service over the network. Potential abuse of DPAPI to extract domain backup keys f. Logsource: windows / security. Rule: title: Protected Storage Service Access id: 45545954-4016-43c6-855e-eae8f1c369dc status: test description: Detects access to a protected_storage service over the network. Potential abuse of DPAPI to extract domain backup keys from Domain Controllers references: - https://threathunterplaybook.com/hunts/windows/190620-DomainDPAPIBackupKeyExtraction/notebook.html author: Roberto Rodriguez @Cyb3rWard0g date: 2019-08-10 modified: 2021-11-27 tags: - attack.lateral-movement - attack.t1021.002 logsource: product: windows service: security detection: selection: EventID: 5145 ShareName|contains: IPC RelativeTargetName: protected_storage condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the usage of schtasks with the delete flag and the asterisk symbol to delete all tasks from the schedule of the. Logsource: windows / process_creation. Rule: title: Delete All Scheduled Tasks id: 220457c1-1c9f-4c2e-afe6-9598926222c1 status: test description: Detects the usage of schtasks with the delete flag and the asterisk symbol to delete all tasks from the schedule of the local computer, including tasks scheduled by other users. references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-delete author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-09 tags: - attack.impact - attack.t1489 logsource: category: process_creation product: windows detection: selection: Image|endswith: \schtasks.exe CommandLine|contains|all: - ' /delete ' - /tn \* - ' /f' condition: selection falsepositives: - Unlikely level: high
Query: write Sigma for Detects RemCom service installation and execution events
Matching passage: Sigma rule: Detects RemCom service installation and execution events. Logsource: windows / system. Rule: title: RemCom Service Installation id: 9e36ed87-4986-482e-8e3b-5c23ffff11bf status: test description: Detects RemCom service installation and execution events references: - https://github.com/kavika13/RemCom/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-07 tags: - attack.execution - attack.t1569.002 logsource: product: windows service: system detection: selection_eid: Provider_Name: Service Control Manager EventID: 7045 selection_service: - ServiceName: RemComSvc - ImagePath|endswith: \RemComSvc.exe condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects additions to the Emond Launch Daemon that adversaries may use to gain persistence and elevate privileges.. Logsource: macos / file_event. Rule: title: MacOS Emond Launch Daemon id: 23c43900-e732-45a4-8354-63e4a6c187ce status: test description: Detects additions to the Emond Launch Daemon that adversaries may use to gain persistence and elevate privileges. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.014/T1546.014.md - https://posts.specterops.io/leveraging-emond-on-macos-for-persistence-a040a2785124 author: Alejandro Ortuno, oscd.community date: 2020-10-23 modified: 2021-11-27 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.014 logsource: category: file_event product: macos detection: selection_1: TargetFilename|contains: /etc/emond.d/rules/ TargetFilename|endswith: .plist selection_2: TargetFilename|contains: /private/var/db/emondClients/ condition: 1 of selection_* falsepositives: - Legitimate administration activities level: medium
Query: alert when Detects service principal name (SPN) enumeration used for Kerberoasting
Matching passage: Sigma rule: Detects service principal name (SPN) enumeration used for Kerberoasting. Logsource: windows / process_creation. Rule: title: Potential SPN Enumeration Via Setspn.EXE id: 1eeed653-dbc8-4187-ad0c-eeebb20e6599 status: test description: Detects service principal name (SPN) enumeration used for Kerberoasting references: - https://web.archive.org/web/20200329173843/https://p16.praetorian.com/blog/how-to-use-kerberoasting-t1208-for-privilege-escalation - https://www.praetorian.com/blog/how-to-use-kerberoasting-t1208-for-privilege-escalation/?edition=2019 author: Markus Neis, keepwatch date: 2018-11-14 modified: 2023-10-23 tags: - attack.credential-access - attack.t1558.003 logsource: category: process_creation product: windows detection: selection_pe: - Image|endswith: \setspn.exe - OriginalFileName: setspn.exe - Description|contains|all: - Query or reset the computer - SPN attribute selection_cli: CommandLine|contains: - ' -q ' - ' /q ' condition: all of selection_* falsepositives: - Administration activity level: medium
Near-miss passage: Sigma rule: Detects the use of the "capsh" utility to invoke a shell.. Logsource: linux / process_creation. Rule: title: Capsh Shell Invocation - Linux id: db1ac3be-f606-4e3a-89e0-9607cbe6b98a status: test description: 'Detects the use of the "capsh" utility to invoke a shell. ' references: - https://gtfobins.github.io/gtfobins/capsh/#shell - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) date: 2024-09-02 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: linux detection: selection: Image|endswith: /capsh CommandLine|endswith: ' --' condition: selection falsepositives: - Unknown level: high
Query: vulnerability: The ADDW macro in stdio-common/vfscanf.c in the GNU C Library (aka glibc or libc6) before 2.21 does not properly consider data-type size during a risk-management decision for use o
Matching passage: CVE-2015-1473. CWE: CWE-119. CVSS: 6.400000095367432. The ADDW macro in stdio-common/vfscanf.c in the GNU C Library (aka glibc or libc6) before 2.21 does not properly consider data-type size during a risk-management decision for use of the alloca function, which might allow context-dependent attackers to cause a denial of service (segmentation violation) or overwrite memory locations beyond the stack boundary via a long line containing wide characters that are improperly handled in a wscanf call.
Near-miss passage: CVE-2015-1872. CWE: CWE-119. CVSS: 6.800000190734863. The ff_mjpeg_decode_sof function in libavcodec/mjpegdec.c in FFmpeg before 2.5.4 does not validate the number of components in a JPEG-LS Start Of Frame segment, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Motion JPEG data.
Query: risk of Cross-site scripting (XSS) vulnerability in spacewalk-java in Spacewalk and Red Hat Satellite 5.7 allows remote authenticated users to inject arbitrary web script or HTML via craft
Matching passage: CVE-2015-0284. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in spacewalk-java in Spacewalk and Red Hat Satellite 5.7 allows remote authenticated users to inject arbitrary web script or HTML via crafted XML data to the XMLRPC API, involving user details. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-7811.
Near-miss passage: CVE-2015-7775. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in Cybozu Garoon 4.0.3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-1197.
Query: exploit The Flvplayer component in TYPO3 6.2.x before 6.2.16 allows remote attackers to embed Flash videos from external domains via unspecified vectors, aka "Cross-Site Flashing."
Matching passage: CVE-2015-8760. CWE: CWE-20. CVSS: 6.099999904632568. The Flvplayer component in TYPO3 6.2.x before 6.2.16 allows remote attackers to embed Flash videos from external domains via unspecified vectors, aka "Cross-Site Flashing."
Near-miss passage: CVE-2015-8000. CWE: CWE-20. CVSS: 5.0. db.c in named in ISC BIND 9.x before 9.9.8-P2 and 9.10.x before 9.10.3-P2 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a malformed class attribute.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the execution of certutil with either the "decode" or "decodehex" flags to decode base64 or hex encoded files. T. Logsource: windows / process_creation. Rule: title: File Decoded From Base64/Hex Via Certutil.EXE id: cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7 status: test description: Detects the execution of certutil with either the "decode" or "decodehex" flags to decode base64 or hex encoded files. This can be abused by attackers to decode an encoded payload before execution references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil - https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/ - https://news.sophos.com/en-us/2021/04/13/compromised-exchange-server-hosting-cryptojacker-targeting-other-exchange-servers/ - https://twitter.com/JohnLaTwC/status/835149808817991680 - https://learn.microsoft.com/en-us/archive/blogs/pki/basic-crl-checking-with-certutil - https://lolbas-project.github.io/lolbas/Binaries/Certutil/ author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community date: 2023-02-15 modified: 2025-06-04 tags: - attack.stealth - attack.t1027 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \certutil.exe - OriginalFileName: CertUtil.exe selection_cli: CommandLine|contains|windash: - '-decode ' - '-decodehex ' condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_decode/info.yml
Near-miss passage: Sigma rule: Detects potential DLL sideloading of "DbgModel.dll". Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Of DbgModel.DLL id: fef394cd-f44d-4040-9b18-95d92fe278c0 status: test description: Detects potential DLL sideloading of "DbgModel.dll" references: - https://hijacklibs.net/entries/microsoft/built-in/dbgmodel.html author: Gary Lobermier date: 2024-07-11 modified: 2024-07-22 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: product: windows category: image_load detection: selection: ImageLoaded|endswith: \dbgmodel.dll filter_main_generic: ImageLoaded|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ filter_optional_windbg: ImageLoaded|startswith: C:\Program Files\WindowsApps\Microsoft.WinDbg_ filter_optional_windows_kits: ImageLoaded|startswith: - C:\Program Files (x86)\Windows Kits\ - C:\Program Files\Windows Kits\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate applications loading their own versions of the DLL mentioned in this rule level: medium
Query: CWE for Trust of System Event Data
Matching passage: CWE-360 Trust of System Event Data. Security based on event locations are insecure and can be spoofed.
Near-miss passage: CWE-1103 Use of Platform-Dependent Third Party Components. The product relies on third-party components that do not provide equivalent functionality across all desirable platforms.
Query: patch priority for CVE-2015-5352
Matching passage: CVE-2015-5352. CWE: CWE-264. CVSS: 4.300000190734863. The x11_open_helper function in channels.c in ssh in OpenSSH before 6.9, when ForwardX11Trusted mode is not used, lacks a check of the refusal deadline for X connections, which makes it easier for remote attackers to bypass intended access restrictions via a connection outside of the permitted time window.
Near-miss passage: CVE-2015-3029. CWE: CWE-264. CVSS: 4.0. The web interface in McAfee Advanced Threat Defense (MATD) before 3.4.4.63 does not properly restrict access, which allows remote authenticated users to obtain sensitive information via unspecified vectors.
Query: patch priority for CVE-2015-9072
Matching passage: CVE-2015-9072. CWE: CWE-476. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, an untrusted pointer dereference can occur in a TrustZone syscall.
Near-miss passage: CVE-2015-8922. CWE: CWE-476. CVSS: 5.5. The read_CodersInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted 7z file, related to the _7z_folder struct.
Query: rule covering Detects the creation of a new PowerShell module ".psm1", ".psd1", ".dll", ".ps1", etc.
Matching passage: Sigma rule: Detects the creation of a new PowerShell module ".psm1", ".psd1", ".dll", ".ps1", etc.. Logsource: windows / file_event. Rule: title: PowerShell Module File Created id: e36941d0-c0f0-443f-bc6f-cb2952eb69ea status: test description: Detects the creation of a new PowerShell module ".psm1", ".psd1", ".dll", ".ps1", etc. references: - Internal Research - https://learn.microsoft.com/en-us/powershell/scripting/developer/module/understanding-a-windows-powershell-module?view=powershell-7.3 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-09 tags: - attack.persistence logsource: category: file_event product: windows detection: selection: Image|endswith: - \powershell.exe - \pwsh.exe TargetFilename|contains: - \WindowsPowerShell\Modules\ - \PowerShell\7\Modules\ condition: selection falsepositives: - Likely level: low
Near-miss passage: Sigma rule: Detects a driver load from a temporary directory. Logsource: windows / driver_load. Rule: title: Driver Load From A Temporary Directory id: 2c4523d5-d481-4ed0-8ec3-7fbf0cb41a75 status: test description: Detects a driver load from a temporary directory references: - Internal Research author: Florian Roth (Nextron Systems) date: 2017-02-12 modified: 2021-11-27 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 logsource: category: driver_load product: windows detection: selection: ImageLoaded|contains: \Temp\ condition: selection falsepositives: - There is a relevant set of false positives depending on applications in the environment level: high
Query: risk of platform/msm_shared/boot_verifier.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5X and 6P devices allows attackers to bypass intended access restrictions via a
Matching passage: CVE-2015-8892. CWE: CWE-264. CVSS: 7.800000190734863. platform/msm_shared/boot_verifier.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5X and 6P devices allows attackers to bypass intended access restrictions via a digest with trailing data, aka Android internal bug 28822807 and Qualcomm internal bug CR902998.
Near-miss passage: CVE-2015-3273. CWE: CWE-264. CVSS: 4.300000190734863. mod/forum/post.php in Moodle 2.9.x before 2.9.1 does not consider the mod/forum:canposttomygroups capability before authorizing "Post a copy to all groups" actions, which allows remote authenticated users to bypass intended access restrictions by leveraging per-group authorization.
Query: describe CVE-2015-1983
Matching passage: CVE-2015-1983. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Projects page in IBM UrbanCode Build 6.1.x before 6.1.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-3368. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the administration user interface in the Classified Ads module before 6.x-3.1 and 7.x-3.x before 7.x-3.1 for Drupal allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via a category name.
Query: patch priority for CVE-2015-1627
Matching passage: CVE-2015-1627. CWE: CWE-264. CVSS: 4.300000190734863. Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-4533. CWE: CWE-264. CVSS: 9.0. EMC Documentum Content Server before 6.7SP1 P32, 6.7SP2 before P25, 7.0 before P19, 7.1 before P16, and 7.2 before P02 does not properly check authorization after creation of an object, which allows remote authenticated users to execute arbitrary code with super-user privileges via a custom script. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2513.