alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit Cross-site scripting (XSS) vulnerability in the HTML help system on Cisco Wireless LAN Controller (WLC) devices before 8.0 allows remote attackers to inject arbitrary web script or
Matching passage: CVE-2015-0690. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the HTML help system on Cisco Wireless LAN Controller (WLC) devices before 8.0 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCun95178.
Near-miss passage: CVE-2015-2941. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to inject arbitrary web script or HTML via an invalid parameter in a wddx format request to api.php, which is not properly handled in an error message, related to unsafe calls to wddx_serialize_value.
Query: describe CVE-2015-6325
Matching passage: CVE-2015-6325. CWE: CWE-399. CVSS: 7.099999904632568. Cisco Adaptive Security Appliance (ASA) software 7.2 and 8.2 before 8.2(5.58), 8.3 and 8.4 before 8.4(7.29), 8.5 through 8.7 before 8.7(1.17), 9.0 before 9.0(4.37), 9.1 before 9.1(6.4), 9.2 before 9.2(4), 9.3 before 9.3(3.1), and 9.4 before 9.4(1.1) allows remote attackers to cause a denial of service (device reload) via a crafted DNS response, aka Bug ID CSCut03495.
Near-miss passage: CVE-2015-8087. CWE: CWE-399. CVSS: 5.0. Huawei NE20E-S, NE40E-M, and NE40E-M2 routers with software before V800R007C10SPC100 and NE40E and NE80E routers with software before V800R007C00SPC100 allows remote attackers to send packets to other VPNs and conduct flooding attacks via a crafted MPLS forwarding packet, aka a "VPN routing and forwarding (VRF) hopping vulnerability."
Query: telemetry for T1090
Matching passage: T1090 Proxy. Tactics: command and control. Description: Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic. Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.
Near-miss passage: T1090.003 Multi-hop Proxy. Tactics: command and control. Description: Adversaries may chain together multiple proxies to disguise the source of malicious traffic. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source. For example, adversaries may construct or use onion routing networks – such as the publicly available [Tor](https://attack.mitre.org/software/S0183) network – to transport encrypted C2 traffic through a compromised population, allowing communication with any device within the network.(Citation: Onion Routing) Adversaries may also use operational relay box (ORB) networks composed of virtual private servers (VPS), Internet of Things (IoT) devices, smart devices, and end-of-life routers to obfuscate their operations.(Citation: ORB Mandiant) In the case of network infrastructure, it is possible for an adversary to leverage multiple compromised devices to create a multi-hop proxy chain (i.e., [Network Devices](https://attack.mitre.org/techniques/T1584/008)). By leveraging [Patch System Image](https://attack.mitre.org/techniques/T1601/001) on routers, adversaries can add custom code to the affected network devices that will implement onion routing between those nodes. This method is dependent upon the [Network Boundary Bridging](https://attack.mitre.org/techniques/T1599) method allowing the adversaries to cross the protected network boundary of the Internet perimeter and into the organization’s Wide-Area Network (WAN). Protocols such as ICMP may be used as a transport. Similarly, adversaries may abuse peer-to-peer (P2P) and blockchain-oriented infrastructure to implement routing between a decentralized network of peers.(Citation: NGLite Trojan)
Query: patch priority for CVE-2015-8487
Matching passage: CVE-2015-8487. CWE: CWE-200. CVSS: 4.300000190734863. Cybozu Office 9.0.0 through 10.3 allows remote attackers to discover CSRF tokens via unspecified vectors, a different vulnerability than CVE-2015-8488.
Near-miss passage: CVE-2015-1994. CWE: CWE-200. CVSS: 5.0. IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
Query: common weakness: Missing Reference to Active File Descriptor or Handle
Matching passage: CWE-773 Missing Reference to Active File Descriptor or Handle. The product does not properly maintain references to a file descriptor or handle, which prevents that file descriptor/handle from being reclaimed.
Near-miss passage: CWE-243 Creation of chroot Jail Without Changing Working Directory. The product uses the chroot() system call to create a jail, but does not change the working directory afterward. This does not prevent access to files outside of the jail.
Query: CVE similar to CVE-2015-7817
Matching passage: CVE-2015-7817. CWE: CWE-362. CVSS: 7.099999904632568. Race condition in the administration-panel web service in IBM System Networking Switch Center (SNSC) before 7.3.1.5 and Lenovo Switch Center before 8.1.2.0 allows remote attackers to obtain privileged-account access, and consequently provide FileReader.jsp input containing directory traversal sequences to read arbitrary text files, via a request to port 40080 or 40443.
Near-miss passage: CVE-2015-1200. CWE: CWE-362. CVSS: 2.0999999046325684. Race condition in pxz 4.999.99 Beta 3 uses weak file permissions for the output file when compressing a file before changing the permission to match the original file, which allows local users to bypass the intended access restrictions.
Query: patch priority for CVE-2015-8718
Matching passage: CVE-2015-8718. CWE: CWE-20. CVSS: 5.5. Double free vulnerability in epan/dissectors/packet-nlm.c in the NLM dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1, when the "Match MSG/RES packets for async NLM" option is enabled, allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Near-miss passage: CVE-2015-4992. CWE: CWE-20. CVSS: 3.5. IBM Sterling B2B Integrator 5.2 before 5020500_8 allows remote authenticated users to conduct clickjacking attacks via unspecified vectors.
Query: rule covering Detects wannacry killswitch domain dns queries
Matching passage: Sigma rule: Detects wannacry killswitch domain dns queries. Logsource: dns. Rule: title: Wannacry Killswitch Domain id: 3eaf6218-3bed-4d8a-8707-274096f12a18 status: test description: Detects wannacry killswitch domain dns queries references: - https://www.mandiant.com/resources/blog/wannacry-ransomware-campaign author: Mike Wade date: 2020-09-16 modified: 2022-03-24 tags: - attack.command-and-control - attack.t1071.001 logsource: category: dns detection: selection: query: - ifferfsodp9ifjaposdfjhgosurijfaewrwergwea.testing - ifferfsodp9ifjaposdfjhgosurijfaewrwergwea.test - ifferfsodp9ifjaposdfjhgosurijfaewrwergwea.com - ayylmaotjhsstasdfasdfasdfasdfasdfasdfasdf.com - iuqssfsodp9ifjaposdfjhgosurijfaewrwergwea.com condition: selection falsepositives: - Analyst testing level: high
Near-miss passage: Sigma rule: Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe". This is often used by attack. Logsource: windows / process_creation. Rule: title: Loaded Module Enumeration Via Tasklist.EXE id: 34275eb8-fa19-436b-b959-3d9ecd53fa1f status: test description: 'Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe". This is often used by attackers in order to find the specific process identifier (PID) that is using the DLL in question. In order to dump the process memory or perform other nefarious actions. ' references: - https://www.n00py.io/2021/05/dumping-plaintext-rdp-credentials-from-svchost-exe/ - https://pentestlab.blog/tag/svchost/ author: Swachchhanda Shrawan Poudel date: 2024-02-12 modified: 2024-03-13 tags: - attack.t1003 - attack.credential-access logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \tasklist.exe - OriginalFileName: tasklist.exe selection_flags: CommandLine|contains|windash: -m selection_module: CommandLine|contains: rdpcorets.dll condition: all of selection_* falsepositives: - Unknown level: medium
Query: CWE for Source Code File with Excessive Number of Lines of Code
Matching passage: CWE-1080 Source Code File with Excessive Number of Lines of Code. A source code file has too many lines of code.
Near-miss passage: CWE-91 XML Injection (aka Blind XPath Injection). The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
Query: write Sigma for Detects Obfuscated Powershell via VAR++ LAUNCHER
Matching passage: Sigma rule: Detects Obfuscated Powershell via VAR++ LAUNCHER. Logsource: windows / security. Rule: title: Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - Security id: 4c54ba8f-73d2-4d40-8890-d9cf1dca3d30 related: - id: 14bcba49-a428-42d9-b943-e2ce0f0f7ae6 type: derived status: test description: Detects Obfuscated Powershell via VAR++ LAUNCHER references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Timur Zinniatullin, oscd.community date: 2020-10-13 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows service: security definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697 detection: selection: EventID: 4697 ServiceFileName|contains|all: - '&&set' - cmd - /c - -f ServiceFileName|contains: - '{0}' - '{1}' - '{2}' - '{3}' - '{4}' - '{5}' condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects usage of "xterm" as a potential reverse shell tunnel. Logsource: linux / process_creation. Rule: title: Potential Xterm Reverse Shell id: 4e25af4b-246d-44ea-8563-e42aacab006b status: test description: Detects usage of "xterm" as a potential reverse shell tunnel references: - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet - https://www.revshells.com/ author: '@d4ns4n_' date: 2023-04-24 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: linux detection: selection: Image|contains: xterm CommandLine|contains: -display CommandLine|endswith: :1 condition: selection falsepositives: - Unknown level: medium
Query: Sigma YAML for linux / process_creation
Matching passage: Sigma rule: Detects usage of system utilities (only grep and egrep for now) to discover security software discovery. Logsource: linux / process_creation. Rule: title: Security Software Discovery - Linux id: c9d8b7fd-78e4-44fe-88f6-599135d46d60 status: test description: Detects usage of system utilities (only grep and egrep for now) to discover security software discovery references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518.001/T1518.001.md author: Daniil Yugoslavskiy, oscd.community date: 2020-10-19 modified: 2022-11-27 tags: - attack.discovery - attack.t1518.001 logsource: category: process_creation product: linux detection: selection: Image|endswith: - /grep - /egrep CommandLine|contains: - nessusd - td-agent - packetbeat - filebeat - auditbeat - osqueryd - cbagentd - falcond condition: selection falsepositives: - Legitimate activities level: low
Near-miss passage: Sigma rule: Detects execution of renamed version of PAExec. Often used by attackers. Logsource: windows / process_creation. Rule: title: Renamed PAExec Execution id: c4e49831-1496-40cf-8ce1-b53f942b02f9 related: - id: 7b0666ad-3e38-4e3d-9bab-78b06de85f7b type: obsolete status: test description: Detects execution of renamed version of PAExec. Often used by attackers references: - https://www.poweradmin.com/paexec/ - https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s05-att&cking-fin7.pdf author: Florian Roth (Nextron Systems), Jason Lynch date: 2021-05-22 modified: 2024-11-23 tags: - attack.stealth - attack.t1202 logsource: category: process_creation product: windows detection: selection: - Description: PAExec Application - OriginalFileName: PAExec.exe - Product|contains: PAExec - Hashes|contains: - IMPHASH=11D40A7B7876288F919AB819CC2D9802 - IMPHASH=6444f8a34e99b8f7d9647de66aabe516 - IMPHASH=dfd6aa3f7b2b1035b76b718f1ddc689f - IMPHASH=1a6cca4d5460b1710a12dea39e4a592c filter_main_known_location: - Image|endswith: \paexec.exe - Image|startswith: C:\Windows\PAExec- condition: selection and not 1 of filter_main_* falsepositives: - Weird admins that rename their tools - Software companies that bundle PAExec with their software and rename it, so that it is less embarrassing - When executed with the "-s" flag. PAExec will copy itself to the "C:\Windows\" directory with a different name. Usually like this "PAExec-[XXXXX]-[ComputerName]" level: high
Query: CVE similar to CVE-2015-6108
Matching passage: CVE-2015-6108. CWE: CWE-119. CVSS: 9.300000190734863. The Windows font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT Gold and 8.1; Office 2007 SP3; Office 2010 SP2; Word Viewer; .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6; Skype for Business 2016; Lync 2010; Lync 2013 SP1; Live Meeting 2007 Console; and Silverlight 5 allows remote attackers to execute arbitrary code via a crafted embedded font, aka "Graphics Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-0973. CWE: CWE-119. CVSS: 8.800000190734863. Buffer overflow in the png_read_IDAT_data function in pngrutil.c in libpng before 1.5.21 and 1.6.x before 1.6.16 allows context-dependent attackers to execute arbitrary code via IDAT data with a large width, a different vulnerability than CVE-2014-9495.
Query: CVE similar to CVE-2015-6402
Matching passage: CVE-2015-6402. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the management interface on Cisco EPC3928 devices with EDVA 5.5.10, 5.5.11, and 5.7.1 allows remote attackers to inject arbitrary web script or HTML via an unspecified value, aka Bug ID CSCux24935.
Near-miss passage: CVE-2015-1373. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to inject arbitrary web script or HTML via the (1) action parameter in a search request, (2) username in a login request, which is not properly handled when logging the event, or (3) page title in an insert action.
Query: risk of Cross-site request forgery (CSRF) vulnerability in auth/shibboleth/logout.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote 
Matching passage: CVE-2015-0218. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in auth/shibboleth/logout.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger a logout.
Near-miss passage: CVE-2015-4242. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Cisco FireSIGHT System Software 5.4.1.2 and 6.0.0 in FireSIGHT Management Center allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu94721.
Query: weakness Improper Resource Locking
Matching passage: CWE-413 Improper Resource Locking. The product does not lock or does not correctly lock a resource when the product must have exclusive access to the resource.
Near-miss passage: CWE-472 External Control of Assumed-Immutable Web Parameter. The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.
Query: risk of The NVIDIA graphics driver in Apple OS X before 10.10.3 allows local users to gain privileges or cause a denial of service (NULL pointer dereference) via an unspecified IOService u
Matching passage: CVE-2015-1137. CWE: UNKNOWN. CVSS: 7.199999809265137. The NVIDIA graphics driver in Apple OS X before 10.10.3 allows local users to gain privileges or cause a denial of service (NULL pointer dereference) via an unspecified IOService userclient type.
Near-miss passage: CVE-2015-8069. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: alert when Detects DNS resolution of an .onion address related to Tor routing networks
Matching passage: Sigma rule: Detects DNS resolution of an .onion address related to Tor routing networks. Logsource: windows / dns-client. Rule: title: Query Tor Onion Address - DNS Client id: 8384bd26-bde6-4da9-8e5d-4174a7a47ca2 related: - id: b55ca2a3-7cff-4dda-8bdd-c7bfa63bf544 type: similar - id: a8322756-015c-42e7-afb1-436e85ed3ff5 type: similar status: test description: Detects DNS resolution of an .onion address related to Tor routing networks references: - https://www.logpoint.com/en/blog/detecting-tor-use-with-logpoint/ - https://github.com/Azure/Azure-Sentinel/blob/f99542b94afe0ad2f19a82cc08262e7ac8e1428e/Detections/ASimDNS/imDNS_TorProxies.yaml author: Nasreddine Bencherchali (Nextron Systems) date: 2022-02-20 modified: 2025-09-12 tags: - attack.command-and-control - attack.t1090.003 logsource: product: windows service: dns-client definition: 'Requirements: Microsoft-Windows-DNS Client Events/Operational Event Log must be enabled/collected in order to receive the events.' detection: selection: EventID: 3008 QueryName|endswith: - .hiddenservice.net - .onion.ca - .onion.cab - .onion.casa - .onion.city - .onion.direct - .onion.dog - .onion.glass - .onion.gq - .onion.guide - .onion.in.net - .onion.ink - .onion.it - .onion.link - .onion.lt - .onion.lu - .onion.ly - .onion.mn - .onion.network - .onion.nu - .onion.pet - .onion.plus - .onion.pt - .onion.pw - .onion.rip - .onion.sh - .onion.si - .onion.to - .onion.top - .onion.ws - .onion - .s1.tor-gateways.de - .s2.tor-gateways.de - .s3.tor-gateways.de - .s4.tor-gateways.de - .s5.tor-gateways.de - .t2w.pw - .tor2web.ae.org - .tor2web.blutmagie.de - .tor2web.com - .tor2web.fi - .tor2web.io - .tor2web.org - .tor2web.xyz - .torlink.co condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the creation of a file with the ".pdf" extension by the "RegEdit.exe" process. This indicates that a user is try. Logsource: windows / file_event. Rule: title: PDF File Created By RegEdit.EXE id: 145095eb-e273-443b-83d0-f9b519b7867b status: test description: 'Detects the creation of a file with the ".pdf" extension by the "RegEdit.exe" process. This indicates that a user is trying to print/save a registry key as a PDF in order to potentially extract sensitive information and bypass defenses. ' references: - https://sensepost.com/blog/2024/dumping-lsa-secrets-a-story-about-task-decorrelation/ author: Nasreddine Bencherchali (Nextron Systems) date: 2024-07-08 tags: - attack.stealth logsource: category: file_event product: windows detection: selection: Image|endswith: \regedit.exe TargetFilename|endswith: .pdf condition: selection falsepositives: - Unlikely level: high
Query: Sigma rule for Detects tools such as UACMe used to bypass UAC with computerdefaults.exe (UACMe 59)
Matching passage: Sigma rule: Detects tools such as UACMe used to bypass UAC with computerdefaults.exe (UACMe 59). Logsource: windows / process_creation. Rule: title: UAC Bypass Tools Using ComputerDefaults id: 3c05e90d-7eba-4324-9972-5d7f711a60a8 status: test description: Detects tools such as UACMe used to bypass UAC with computerdefaults.exe (UACMe 59) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-31 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: IntegrityLevel: - High - System - S-1-16-16384 - S-1-16-12288 Image: C:\Windows\System32\ComputerDefaults.exe filter: ParentImage|contains: - :\Windows\System32 - :\Program Files condition: selection and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects well-known credential dumping tools execution via service execution events. Logsource: windows / system. Rule: title: Credential Dumping Tools Service Execution - System id: 4976aa50-8f41-45c6-8b15-ab3fc10e79ed status: test description: Detects well-known credential dumping tools execution via service execution events references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment author: Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community date: 2017-03-05 modified: 2022-11-29 tags: - attack.credential-access - attack.execution - attack.t1003.001 - attack.t1003.002 - attack.t1003.004 - attack.t1003.005 - attack.t1003.006 - attack.t1569.002 - attack.s0005 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ImagePath|contains: - cachedump - dumpsvc - fgexec - gsecdump - mimidrv - pwdump - servpw condition: selection falsepositives: - Legitimate Administrator using credential dumping tool for password recovery level: high