alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: openshift-node in OpenShift Origin 1.1.6 and earlier improperly stores router credentials as envvars in the pod when the --credentials option is used, which allows local users to o
Matching passage: CVE-2015-8945. CWE: CWE-255. CVSS: 5.099999904632568. openshift-node in OpenShift Origin 1.1.6 and earlier improperly stores router credentials as envvars in the pod when the --credentials option is used, which allows local users to obtain sensitive private key information by reading the systemd journal.
Near-miss passage: CVE-2015-5988. CWE: CWE-255. CVSS: 9.800000190734863. The web management interface on Belkin F9K1102 2 devices with firmware 2.10.17 has a blank password, which allows remote attackers to obtain administrative privileges by leveraging a LAN session.
Query: Sigma rule for Adversaries may disable security tools to avoid possible detection of their tools and activities by uninstalling Crowdst
Matching passage: Sigma rule: Adversaries may disable security tools to avoid possible detection of their tools and activities by uninstalling Crowdst. Logsource: windows / process_creation. Rule: title: Uninstall Crowdstrike Falcon Sensor id: f0f7be61-9cf5-43be-9836-99d6ef448a18 status: test description: Adversaries may disable security tools to avoid possible detection of their tools and activities by uninstalling Crowdstrike Falcon references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md author: frack113 date: 2021-07-12 modified: 2023-03-09 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - \WindowsSensor.exe - ' /uninstall' - ' /quiet' condition: selection falsepositives: - Administrator might leverage the same command line for debugging or other purposes. However this action must be always investigated level: high
Near-miss passage: Sigma rule: Detects when an admin share is mounted using net.exe. Logsource: windows / process_creation. Rule: title: Windows Admin Share Mount Via Net.EXE id: 3abd6094-7027-475f-9630-8ab9be7b9725 related: - id: f117933c-980c-4f78-b384-e3d838111165 type: similar status: test description: Detects when an admin share is mounted using net.exe references: - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view author: oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, wagga date: 2020-10-05 modified: 2023-02-21 tags: - attack.lateral-movement - attack.t1021.002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \net.exe - \net1.exe - OriginalFileName: - net.exe - net1.exe selection_cli: CommandLine|contains|all: - ' use ' - ' \\\\*\\*$' condition: all of selection_* falsepositives: - Administrators level: medium
Query: describe CVE-2015-8460
Matching passage: CVE-2015-8460. CWE: CWE-119. CVSS: 8.800000190734863. Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8459, CVE-2015-8636, and CVE-2015-8645.
Near-miss passage: CVE-2015-6146. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 7 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6145.
Query: patch priority for CVE-2015-1159
Matching passage: CVE-2015-1159. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the cgi_puts function in cgi-bin/template.c in the template engine in CUPS before 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the QUERY parameter to help/.
Near-miss passage: CVE-2015-9247. CWE: CWE-79. CVSS: 5.400000095367432. An issue was discovered in Skybox Platform before 7.5.401. Reflected cross-site scripting vulnerabilities exist in /skyboxview/webservice/services/VersionRepositoryWebService via a soapenv:Body element, or in the status parameter to login.html.
Query: describe CVE-2015-6776
Matching passage: CVE-2015-6776. CWE: CWE-119. CVSS: 6.800000190734863. The opj_dwt_decode_1* functions in dwt.c in OpenJPEG, as used in PDFium in Google Chrome before 47.0.2526.73, allow remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG 2000 data that is mishandled during a discrete wavelet transform.
Near-miss passage: CVE-2015-7555. CWE: CWE-119. CVSS: 5.5. Heap-based buffer overflow in giffix.c in giffix in giflib 5.1.1 allows attackers to cause a denial of service (program crash) via crafted image and logical screen width fields in a GIF file.
Query: vulnerability: Multiple cross-site scripting (XSS) vulnerabilities in content/content.systempreferences.php in Symphony CMS before 2.6.4 allow remote attackers to inject arbitrary web script or H
Matching passage: CVE-2015-8766. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in content/content.systempreferences.php in Symphony CMS before 2.6.4 allow remote attackers to inject arbitrary web script or HTML via the (1) email_sendmail[from_name], (2) email_sendmail[from_address], (3) email_smtp[from_name], (4) email_smtp[from_address], (5) email_smtp[host], (6) email_smtp[port], (7) jit_image_manipulation[trusted_external_sites], or (8) maintenance_mode[ip_whitelist] parameters to system/preferences.
Near-miss passage: CVE-2015-7191. CWE: CWE-79. CVSS: 4.300000190734863. Mozilla Firefox before 42.0 on Android improperly restricts URL strings in intents, which allows attackers to conduct cross-site scripting (XSS) attacks via vectors involving an intent: URL and fallback navigation, aka "Universal XSS (UXSS)."
Query: risk of The debugging feature in the kernel in Apple OS X before 10.11 mismanages state, which allows local users to cause a denial of service via unspecified vectors.
Matching passage: CVE-2015-5902. CWE: UNKNOWN. CVSS: 4.900000095367432. The debugging feature in the kernel in Apple OS X before 10.11 mismanages state, which allows local users to cause a denial of service via unspecified vectors.
Near-miss passage: CVE-2015-7904. CWE: UNKNOWN. CVSS: 6.5. Unrestricted file upload vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users to execute arbitrary JSP code via vectors involving an upload of an image file.
Query: describe CVE-2015-0902
Matching passage: CVE-2015-0902. CWE: CWE-200. CVSS: 5.0. The Semper Fi All in One SEO Pack plugin before 2.2.6 for WordPress does not consider the presence of password protection during generation of the Meta Description field, which allows remote attackers to obtain sensitive information by reading HTML source code.
Near-miss passage: CVE-2015-4213. CWE: CWE-200. CVSS: 4.0. Cisco NX-OS 1.1(1g) on Nexus 9000 devices allows remote authenticated users to discover cleartext passwords by leveraging the existence of a decryption mechanism, aka Bug ID CSCuu84391.
Query: CVE similar to CVE-2015-2652
Matching passage: CVE-2015-2652. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in the Oracle Marketing component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.1, 12.1.2, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect integrity via unknown vectors related to Web Management.
Near-miss passage: CVE-2015-7070. CWE: UNKNOWN. CVSS: 9.300000190734863. Mobile Replayer in GPUTools Framework in Apple iOS before 9.2 allows attackers to execute arbitrary code in a privileged context via an app that provides a crafted pathname, a different vulnerability than CVE-2015-7069.
Query: SOC runbook when seeing Outbound C2 pattern associated with Create Process with Token
Matching passage: Playbook for T1134.002 Create Process with Token. 1) Validate alert telemetry against T1134.002. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth, privilege escalation. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may create a new process with an existing token to escalate privileges and bypass access controls. Processes can be created with the token and resulting security context of another user using features such as <code>CreateProcessWithTokenW</code> and <code>runas</code>.(Citation: Microsoft RunAs) Creating processes with a token not associated with the current user may require the creden
Near-miss passage: Playbook for T1134.001 Token Impersonation/Theft. Different response path focused on stealth, privilege escalation.
Query: rule covering Detects attempts to disable Windows Credential Guard by setting registry values to 0. Credential Guard uses virtualizati
Matching passage: Sigma rule: Detects attempts to disable Windows Credential Guard by setting registry values to 0. Credential Guard uses virtualizati. Logsource: windows / registry_set. Rule: title: Windows Credential Guard Disabled - Registry id: 73921b9c-cafd-4446-b0c6-fdb0ace42bc0 related: - id: c17d47b7-dcd6-4109-87eb-d1817bd4cbc9 type: similar status: experimental description: 'Detects attempts to disable Windows Credential Guard by setting registry values to 0. Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Adversaries may disable Credential Guard to gain access to sensitive credentials stored in the system, such as NTLM hashes and Kerberos tickets, which can be used for lateral movement and privilege escalation. ' references: - https://woshub.com/disable-credential-guard-windows/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-12-26 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: - \DeviceGuard\EnableVirtualizationBasedSecurity - \DeviceGuard\LsaCfgFlags - \Lsa\LsaCfgFlags Details: DWORD (0x00000000) condition: selection falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_credential_guard_disabled/info.yml
Near-miss passage: Sigma rule: Detects execution of msdt.exe using the "cab" flag which could indicates suspicious diagcab files with embedded answer f. Logsource: windows / process_creation. Rule: title: Suspicious Cabinet File Execution Via Msdt.EXE id: dc4576d4-7467-424f-9eee-fd2b02855fe0 related: - id: 6545ce61-a1bd-4119-b9be-fcbee42c0cf3 type: obsolete status: test description: Detects execution of msdt.exe using the "cab" flag which could indicates suspicious diagcab files with embedded answer files leveraging CVE-2022-30190 references: - https://twitter.com/nas_bench/status/1537896324837781506 - https://github.com/GossiTheDog/ThreatHunting/blob/e85884abbf05d5b41efc809ea6532b10b45bd05c/AdvancedHuntingQueries/DogWalk-DiagCab - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-9015912909545e72ed42cbac4d1e96295e8964579c406d23fd9c47a8091576a0 - https://irsl.medium.com/the-trouble-with-microsofts-troubleshooters-6e32fc80b8bd author: Nasreddine Bencherchali (Nextron Systems), GossiTheDog, frack113 date: 2022-06-21 modified: 2024-03-13 tags: - attack.stealth - attack.t1202 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \msdt.exe - OriginalFileName: msdt.exe selection_cmd: CommandLine|contains|windash: ' -cab ' condition: all of selection_* falsepositives: - Legitimate usage of ".diagcab" files level: medium
Query: exploit Memory leak in the TCP input module in Cisco IOS 12.2, 12.4, 15.0, 15.2, 15.3, and 15.4 and IOS XE 3.3.xXO, 3.5.xE, 3.6.xE, 3.8.xS through 3.10.xS before 3.10.5S, and 3.11.xS and 3
Matching passage: CVE-2015-0646. CWE: CWE-399. CVSS: 7.800000190734863. Memory leak in the TCP input module in Cisco IOS 12.2, 12.4, 15.0, 15.2, 15.3, and 15.4 and IOS XE 3.3.xXO, 3.5.xE, 3.6.xE, 3.8.xS through 3.10.xS before 3.10.5S, and 3.11.xS and 3.12.xS before 3.12.3S allows remote attackers to cause a denial of service (memory consumption or device reload) by sending crafted TCP packets over (1) IPv4 or (2) IPv6, aka Bug ID CSCum94811.
Near-miss passage: CVE-2015-2337. CWE: CWE-399. CVSS: 5.800000190734863. TPInt.dll in VMware Workstation 10.x before 10.0.6 and 11.x before 11.1.1, VMware Player 6.x before 6.0.6 and 7.x before 7.1.1, and VMware Horizon Client 3.2.x before 3.2.1, 3.3.x, and 5.x local-mode before 5.4.2 on Windows does not properly allocate memory, which allows guest OS users to execute arbitrary code on the host OS via unspecified vectors.
Query: risk of Static code injection vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary PHP code into the language files via a Translati
Matching passage: CVE-2015-4338. CWE: CWE-94. CVSS: 6.5. Static code injection vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary PHP code into the language files via a Translation LM_FRONT_* field for a language, as demonstrated by language/italian.php.
Near-miss passage: CVE-2015-0088. CWE: CWE-94. CVSS: 9.300000190734863. Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted (1) web site or (2) file, aka "Adobe Font Driver Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-0090, CVE-2015-0091, CVE-2015-0092, and CVE-2015-0093.
Query: patch priority for CVE-2015-8380
Matching passage: CVE-2015-8380. CWE: CWE-119. CVSS: 7.5. The pcre_exec function in pcre_exec.c in PCRE before 8.38 mishandles a // pattern with a \01 string, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
Near-miss passage: CVE-2015-7180. CWE: CWE-119. CVSS: 7.5. The ReadbackResultWriterD3D11::Run function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 misinterprets the return value of a function call, which might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors.
Query: describe CVE-2015-3439
Matching passage: CVE-2015-3439. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Ephox (formerly Moxiecode) plupload.flash.swf shim 2.1.2 in Plupload, as used in WordPress 3.9.x, 4.0.x, and 4.1.x before 4.1.2 and other products, allows remote attackers to execute same-origin JavaScript functions via the target parameter, as demonstrated by executing a certain click function, related to _init.as and _fireEvent.as.
Near-miss passage: CVE-2015-4365. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Taxonomy Accordion module for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to taxonomy terms.
Query: CVE similar to CVE-2015-7452
Matching passage: CVE-2015-7452. CWE: CWE-200. CVSS: 4.300000190734863. IBM Maximo Asset Management 7.5 before 7.5.0.9 FP9 and 7.6 before 7.6.0.3 FP3 and Maximo Asset Management 7.5 before 7.5.0.9 FP9, 7.5.1, and 7.6 before 7.6.0.3 FP3 for SmartCloud Control Desk allow remote authenticated users to obtain sensitive information via the REST API.
Near-miss passage: CVE-2015-7488. CWE: CWE-200. CVSS: 5.900000095367432. IBM Spectrum Scale 4.1.1.x before 4.1.1.4 and 4.2.x before 4.2.0.1, in certain LDAP File protocol configurations, allows remote attackers to discover an LDAP password via unspecified vectors.
Query: patch priority for CVE-2015-0552
Matching passage: CVE-2015-0552. CWE: CWE-22. CVSS: 6.400000095367432. Directory traversal vulnerability in the gcab_folder_extract function in libgcab/gcab-folder.c in gcab 0.4 allows remote attackers to write to arbitrary files via crafted path in a CAB file, as demonstrated by "\tmp\moo."
Near-miss passage: CVE-2015-0906. CWE: CWE-22. CVSS: 5.800000190734863. Directory traversal vulnerability in Lhaplus before 1.70 allows remote attackers to write to arbitrary files via a crafted archive.
Query: Sigma rule for Hides the file extension through modification of the registry
Matching passage: Sigma rule: Hides the file extension through modification of the registry. Logsource: windows / registry_set. Rule: title: IE Change Domain Zone id: 45e112d0-7759-4c2a-aa36-9f8fb79d3393 related: - id: d88d0ab2-e696-4d40-a2ed-9790064e66b3 type: derived status: test description: Hides the file extension through modification of the registry references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-4---add-domain-to-trusted-sites-zone - https://learn.microsoft.com/en-us/troubleshoot/developer/browsers/security-privacy/ie-security-zones-registry-entries author: frack113 date: 2022-01-22 modified: 2023-08-17 tags: - attack.persistence - attack.t1137 logsource: category: registry_set product: windows detection: selection_domains: TargetObject|contains: \SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ filter: Details: - DWORD (0x00000000) - DWORD (0x00000001) - (Empty) condition: selection_domains and not filter falsepositives: - Administrative scripts level: medium regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_change_security_zones/info.yml simulation: - type: atomic-red-team name: Add Domain to Trusted Sites Zone technique: T1112 atomic_guid: cf447677-5a4e-4937-a82c-e47d254afd57
Near-miss passage: Sigma rule: Detects the execution of a binary from the Linux shared memory directory /dev/shm. This directory is a tmpfs mount backe. Logsource: linux / process_creation. Rule: title: Process Execution From Shared Memory Directory id: 5cd16c8f-44a6-4654-81e7-a84d6db507d4 status: experimental description: 'Detects the execution of a binary from the Linux shared memory directory /dev/shm. This directory is a tmpfs mount backed entirely by RAM and is abused by attackers for fileless malware staging because files written there never touch physical disk and may evade disk-based detection. ' references: - https://www.sysdig.com/blog/containers-read-only-fileless-malware - https://unfinished.bike/fun-with-the-new-bpfdoor-2023 - https://asiapacificdefencereporter.com/wp-content/uploads/2023/08/Final-CRWD-2023-Threat-Hunting-Report.pdf - https://www.crowdstrike.com/en-us/blog/how-to-hunt-for-decisivearchitect-and-justforfun-implant/ - https://www.linkedin.com/posts/avradeep_malware-apt-infostealer-activity-7373203959697719296-JR-7 - https://www.stormshield.com/news/orbit-analysis-of-a-linux-dedicated-malware/ author: Stan Beukers date: 2026-06-20 tags: - attack.stealth - attack.execution - attack.t1027.011 logsource: category: process_creation product: linux detection: selection: Image|startswith: /dev/shm/ condition: selection falsepositives: - Unlikely in production environments; some container runtimes or IPC frameworks may use /dev/shm for inter-process communication but should not spawn executables. level: high
Query: write Sigma for Detects the use of the Windows Update Client binary (wuauclt.exe) for proxy execution.
Matching passage: Sigma rule: Detects the use of the Windows Update Client binary (wuauclt.exe) for proxy execution.. Logsource: windows / process_creation. Rule: title: Proxy Execution Via Wuauclt.EXE id: af77cf95-c469-471c-b6a0-946c685c4798 related: - id: ba1bb0cb-73da-42de-ad3a-de10c643a5d0 type: obsolete - id: d7825193-b70a-48a4-b992-8b5b3015cc11 type: obsolete status: test description: Detects the use of the Windows Update Client binary (wuauclt.exe) for proxy execution. references: - https://dtm.uk/wuauclt/ - https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/ author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Florian Roth (Nextron Systems), Sreeman, FPT.EagleEye Team date: 2020-10-12 modified: 2023-11-11 tags: - attack.stealth - attack.t1218 - attack.execution logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \wuauclt.exe - OriginalFileName: wuauclt.exe selection_cli: CommandLine|contains|all: - UpdateDeploymentProvider - RunHandlerComServer filter_main_generic: CommandLine|contains: ' /UpdateDeploymentProvider UpdateDeploymentProvider.dll ' filter_main_wuaueng: CommandLine|contains: ' wuaueng.dll ' filter_main_uus: CommandLine|contains: - :\Windows\UUS\Packages\Preview\amd64\updatedeploy.dll /ClassId - :\Windows\UUS\amd64\UpdateDeploy.dll /ClassId filter_main_winsxs: CommandLine|contains|all: - :\Windows\WinSxS\ - '\UpdateDeploy.dll /ClassId ' condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious process run from unusual locations. Logsource: windows / process_creation. Rule: title: Suspicious Process Start Locations id: 15b75071-74cc-47e0-b4c6-b43744a62a2b status: test description: Detects suspicious process run from unusual locations references: - https://car.mitre.org/wiki/CAR-2013-05-002 author: juju4, Jonhnathan Ribeiro, oscd.community date: 2019-01-16 modified: 2022-01-07 tags: - attack.stealth - attack.t1036 - car.2013-05-002 logsource: category: process_creation product: windows detection: selection: - Image|contains: - :\RECYCLER\ - :\SystemVolumeInformation\ - Image|startswith: - C:\Windows\Tasks\ - C:\Windows\debug\ - C:\Windows\fonts\ - C:\Windows\help\ - C:\Windows\drivers\ - C:\Windows\addins\ - C:\Windows\cursors\ - C:\Windows\system32\tasks\ condition: selection falsepositives: - False positives depend on scripts and administrative tools used in the monitored environment level: medium
Query: exploit The wp-all-import plugin before 3.2.5 for WordPress has reflected XSS.
Matching passage: CVE-2015-9329. CWE: CWE-79. CVSS: 6.099999904632568. The wp-all-import plugin before 3.2.5 for WordPress has reflected XSS.
Near-miss passage: CVE-2015-2207. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in NetCracker Resource Management System before 8.2 allow remote authenticated users to inject arbitrary web script or HTML via the (1) ctrl, (2) t90001_0_theform_selection, (3) _scroll, (4) tableName, (5) parent, (6) circuit, (7) return, (8) xname, or (9) mpTransactionId parameter.