alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, A
Matching passage: CVE-2015-7655. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via crafted actionExtends arguments, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.
Near-miss passage: CVE-2015-1272. CWE: UNKNOWN. CVSS: 7.5. Use-after-free vulnerability in the GPU process implementation in Google Chrome before 44.0.2403.89 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging the continued availability of a GPUChannelHost data structure during Blink shutdown, related to content/browser/gpu/browser_gpu_channel_host_factory.cc and content/renderer/render_thread_impl.cc.
Query: ATT&CK technique for Remote Data Staging
Matching passage: T1074.002 Remote Data Staging. Tactics: collection. Description: Adversaries may stage data collected from multiple systems in a central location or directory on one system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location. In cloud environments, adversaries may stage data within a particular instance or virtual machine before exfiltration. An adversary may [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002) and stage data in that instance.(Citation: Mandiant M-Trends 2020) By staging data on one system prior to Exfiltration, adversaries can minimize the number of connections made to their C2 server and better evade detection.
Near-miss passage: T1074.001 Local Data Staging. Tactics: collection. Description: Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location. Adversaries may also stage collected data in various available formats/locations of a system, including local storage databases/repositories or the Windows Registry.(Citation: Prevailion DarkWatchman 2021)
Query: risk of Buffer overflow in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (application crash) via a crafted SUN file.
Matching passage: CVE-2015-8957. CWE: CWE-119. CVSS: 6.5. Buffer overflow in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (application crash) via a crafted SUN file.
Near-miss passage: CVE-2015-7012. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-1, APPLE-SA-2015-10-21-3, and APPLE-SA-2015-10-21-5.
Query: patch priority for CVE-2015-6461
Matching passage: CVE-2015-6461. CWE: CWE-98. CVSS: 5.400000095367432. Remote file inclusion allows an attacker to craft a specific URL referencing the Schneider Electric Modicon BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, or BMXP342030H PLC web server, which, when launched, will result in the browser redirecting to a remote file via a Java script loaded with the web page.
Near-miss passage: CVE-2015-7036. CWE: CWE-20. CVSS: 7.5. The fts3_tokenizer function in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a SQL command that triggers an API call with a crafted pointer value in the second argument.
Query: write Sigma for Detects disabling Windows Defender Tamper Protection
Matching passage: Sigma rule: Detects disabling Windows Defender Tamper Protection. Logsource: windows / registry_set. Rule: title: Disable Tamper Protection on Windows Defender id: 93d298a1-d28f-47f1-a468-d971e7796679 status: test description: Detects disabling Windows Defender Tamper Protection references: - https://www.tenforums.com/tutorials/123792-turn-off-tamper-protection-microsoft-defender-antivirus.html author: Austin Songer @austinsonger date: 2021-08-04 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Microsoft\Windows Defender\Features\TamperProtection Details: DWORD (0x00000000) filter_msmpeng_client: Image|startswith: C:\ProgramData\Microsoft\Windows Defender\Platform\ Image|endswith: \MsMpEng.exe filter_msmpeng_domain_controller: Image: C:\Program Files\Windows Defender\MsMpEng.exe condition: selection and not 1 of filter_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects uses of the SysInternals ProcDump utility in which ProcDump or its output get renamed, or a dump file is moved o. Logsource: windows / process_creation. Rule: title: Potential SysInternals ProcDump Evasion id: 79b06761-465f-4f88-9ef2-150e24d3d737 status: test description: Detects uses of the SysInternals ProcDump utility in which ProcDump or its output get renamed, or a dump file is moved or copied to a different name references: - https://twitter.com/mrd0x/status/1480785527901204481 author: Florian Roth (Nextron Systems) date: 2022-01-11 modified: 2023-05-09 tags: - attack.stealth - attack.t1036 - attack.t1003.001 - attack.credential-access logsource: category: process_creation product: windows detection: selection_1: CommandLine|contains: - copy procdump - move procdump selection_2: CommandLine|contains|all: - 'copy ' - '.dmp ' CommandLine|contains: - 2.dmp - lsass - out.dmp selection_3: CommandLine|contains: - copy lsass.exe_ - move lsass.exe_ condition: 1 of selection_* falsepositives: - False positives are expected in cases in which ProcDump just gets copied to a different directory without any renaming level: high
Query: patch priority for CVE-2015-0072
Matching passage: CVE-2015-0072. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy and inject arbitrary web script or HTML via vectors involving an IFRAME element that triggers a redirect, a second IFRAME element that does not trigger a redirect, and an eval of a WindowProxy object, aka "Universal XSS (UXSS)."
Near-miss passage: CVE-2015-2665. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: exploit Path Disclosure Vulnerability in wordpress plugin MP3-jPlayer v2.3.2
Matching passage: CVE-2015-1000008. CWE: CWE-200. CVSS: 5.300000190734863. Path Disclosure Vulnerability in wordpress plugin MP3-jPlayer v2.3.2
Near-miss passage: CVE-2015-8336. CWE: CWE-200. CVSS: 4.300000190734863. Huawei FusionCompute with software before V100R005C10SPC700 allows remote authenticated users to obtain sensitive "role and permission" information via unspecified vectors.
Query: CVE similar to CVE-2015-1395
Matching passage: CVE-2015-1395. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in GNU patch versions which support Git-style patching before 2.7.3 allows remote attackers to write to arbitrary files with the permissions of the target user via a .. (dot dot) in a diff file name.
Near-miss passage: CVE-2015-2304. CWE: CWE-22. CVSS: 6.400000095367432. Absolute path traversal vulnerability in bsdcpio in libarchive 3.1.2 and earlier allows remote attackers to write to arbitrary files via a full pathname in an archive.
Query: describe CVE-2015-3694
Matching passage: CVE-2015-3694. CWE: CWE-119. CVSS: 6.800000190734863. FontParser in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-3719.
Near-miss passage: CVE-2015-6156. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6148.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in Polycom RealPresence CloudAXIS Suite before 1.7.0 allows remote authenticated users to inject arbitrary web script or HTML via unspecifi
Matching passage: CVE-2015-1516. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in Polycom RealPresence CloudAXIS Suite before 1.7.0 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-1204. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Save Filters functionality in the WP Slimstat plugin before 3.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the fs[resource] parameter in the wp-slim-view-2 page to wp-admin/admin.php.
Query: playbook for alert: EDR alert: possible Cached Domain Credentials (T1003.005)
Matching passage: Playbook for T1003.005 Cached Domain Credentials. 1) Validate alert telemetry against T1003.005. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: credential access. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.(Citation: Microsoft - Cached Creds) On Windows Vista and newer, the hash format is DCC2 (Domain Cached Credentials version 2) hash, also known as MS-Cache v2 hash.(Citation: PassLib mscache) The number of default cached credentials varies and can be alt
Near-miss passage: Playbook for T1003.001 LSASS Memory. Different response path focused on credential access.
Query: describe CVE-2015-2649
Matching passage: CVE-2015-2649. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1, 8.22, and 15.0 allows remote authenticated users to affect confidentiality via vectors related to UIF Open UI.
Near-miss passage: CVE-2015-8059. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: detection rule: Detects process connections to a Monero crypto mining pool
Matching passage: Sigma rule: Detects process connections to a Monero crypto mining pool. Logsource: linux / network_connection. Rule: title: Linux Crypto Mining Pool Connections id: a46c93b7-55ed-4d27-a41b-c259456c4746 status: stable description: Detects process connections to a Monero crypto mining pool references: - https://www.poolwatch.io/coin/monero author: Florian Roth (Nextron Systems) date: 2021-10-26 tags: - attack.impact - attack.t1496 logsource: product: linux category: network_connection detection: selection: DestinationHostname: - pool.minexmr.com - fr.minexmr.com - de.minexmr.com - sg.minexmr.com - ca.minexmr.com - us-west.minexmr.com - pool.supportxmr.com - mine.c3pool.com - xmr-eu1.nanopool.org - xmr-eu2.nanopool.org - xmr-us-east1.nanopool.org - xmr-us-west1.nanopool.org - xmr-asia1.nanopool.org - xmr-jp1.nanopool.org - xmr-au1.nanopool.org - xmr.2miners.com - xmr.hashcity.org - xmr.f2pool.com - xmrpool.eu - pool.hashvault.pro - moneroocean.stream - monerocean.stream condition: selection falsepositives: - Legitimate use of crypto miners level: high
Near-miss passage: Sigma rule: Detects the use of curl with NTLM authentication and empty credentials (-u :), which can be abused to leak the currently. Logsource: windows / process_creation. Rule: title: NTLM Hash Leak Via Curl NTLM Authentication id: 916eb839-895e-47f8-99ee-3008bf377a3e status: test description: 'Detects the use of curl with NTLM authentication and empty credentials (-u :), which can be abused to leak the currently logged-in user''s NTLMv2 challenge-response to an attacker-controlled server, enabling offline cracking or relay attacks. When no credentials are provided, the Microsoft-shipped curl passes a NULL identity to Windows SSPI, which automatically falls back to the current user''s logon session credentials stored in LSASS — without requiring a plaintext password. This behavior is exclusive to the curl binary shipped by Microsoft (available since Windows 10 / Windows Server 2019), which is built with SSPI support. ' references: - https://github.com/curl/curl/blob/master/lib/vauth/ntlm_sspi.c#L128-L140 - https://learn.microsoft.com/en-us/windows/win32/secauthn/acquirecredentialshandle--ntlm - https://curl.se/docs/manpage.html#--ntlm author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-06-04 tags: - attack.credential-access - attack.t1187 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \curl.exe - OriginalFileName: curl.exe selection_ntlm_flag: CommandLine|contains: --ntlm selection_empty_creds: CommandLine|re: '(?i)\s(-u|--user)\s*:' condition: all of selection_* falsepositives: - Should be very rare as it's not widely known or used, but could occur in legitimate use cases where curl is used with NTLM authentication and empty credentials, such as in certain scripts or automation tasks. level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_ntlm_hash_leak_attempt/info.yml
Query: Sigma rule for Indicates that a password spray attack has been successfully performed.
Matching passage: Sigma rule: Indicates that a password spray attack has been successfully performed.. Logsource: azure / riskdetection. Rule: title: Password Spray Activity id: 28ecba0a-c743-4690-ad29-9a8f6f25a6f9 status: test description: Indicates that a password spray attack has been successfully performed. references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#password-spray - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-03 tags: - attack.t1110 - attack.credential-access logsource: product: azure service: riskdetection detection: selection: riskEventType: passwordSpray condition: selection falsepositives: - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user. level: high
Near-miss passage: Sigma rule: Indicates suspicious rules such as an inbox rule that forwards a copy of all emails to an external address. Logsource: azure / riskdetection. Rule: title: Suspicious Inbox Forwarding Identity Protection id: 27e4f1d6-ae72-4ea0-8a67-77a73a289c3d status: test description: Indicates suspicious rules such as an inbox rule that forwards a copy of all emails to an external address references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#suspicious-inbox-forwarding - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-03 tags: - attack.t1114.003 - attack.collection logsource: product: azure service: riskdetection detection: selection: riskEventType: suspiciousInboxForwarding condition: selection falsepositives: - A legitimate forwarding rule. level: high
Query: Sigma YAML for windows / file_event
Matching passage: Sigma rule: Detects creation of a file named "ErrorHandler.cmd" in the "C:\WINDOWS\Setup\Scripts\" directory which could be used as. Logsource: windows / file_event. Rule: title: Potential Persistence Attempt Via ErrorHandler.Cmd id: 15904280-565c-4b73-9303-3291f964e7f9 status: test description: 'Detects creation of a file named "ErrorHandler.cmd" in the "C:\WINDOWS\Setup\Scripts\" directory which could be used as a method of persistence The content of C:\WINDOWS\Setup\Scripts\ErrorHandler.cmd is read whenever some tools under C:\WINDOWS\System32\oobe\ (e.g. Setup.exe) fail to run for any reason. ' references: - https://www.hexacorn.com/blog/2022/01/16/beyond-good-ol-run-key-part-135/ - https://github.com/last-byte/PersistenceSniper author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-09 modified: 2022-12-19 tags: - attack.persistence logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: \WINDOWS\Setup\Scripts\ErrorHandler.cmd condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects anyone attempting a backup for the DPAPI Master Key. This events gets generated at the source and not the Domain. Logsource: windows / security. Rule: title: DPAPI Domain Master Key Backup Attempt id: 39a94fd1-8c9a-4ff6-bf22-c058762f8014 status: test description: Detects anyone attempting a backup for the DPAPI Master Key. This events gets generated at the source and not the Domain Controller. references: - https://threathunterplaybook.com/hunts/windows/190620-DomainDPAPIBackupKeyExtraction/notebook.html author: Roberto Rodriguez @Cyb3rWard0g date: 2019-08-10 modified: 2023-03-15 tags: - attack.credential-access - attack.t1003.004 logsource: product: windows service: security detection: selection: EventID: 4692 condition: selection falsepositives: - If a computer is a member of a domain, DPAPI has a backup mechanism to allow unprotection of the data. Which will trigger this event. level: medium
Query: rule covering Detects execution from an Alternate Data Stream (ADS). Adversaries may use NTFS file attributes to hide their malicious
Matching passage: Sigma rule: Detects execution from an Alternate Data Stream (ADS). Adversaries may use NTFS file attributes to hide their malicious. Logsource: windows / process_creation. Rule: title: Execute From Alternate Data Streams id: 7f43c430-5001-4f8b-aaa9-c3b88f18fa5c status: test description: Detects execution from an Alternate Data Stream (ADS). Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.004/T1564.004.md author: frack113 date: 2021-09-01 modified: 2022-10-09 tags: - attack.stealth - attack.t1564.004 logsource: category: process_creation product: windows detection: selection_stream: CommandLine|contains: 'txt:' selection_tools_type: CommandLine|contains|all: - 'type ' - ' > ' selection_tools_makecab: CommandLine|contains|all: - 'makecab ' - .cab selection_tools_reg: CommandLine|contains|all: - 'reg ' - ' export ' selection_tools_regedit: CommandLine|contains|all: - 'regedit ' - ' /E ' selection_tools_esentutl: CommandLine|contains|all: - 'esentutl ' - ' /y ' - ' /d ' - ' /o ' condition: selection_stream and (1 of selection_tools_*) falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Potential threat actor tampering with Sysmon manifest and eventually disabling it. Logsource: windows / security. Rule: title: Sysmon Channel Reference Deletion id: 18beca67-ab3e-4ee3-ba7a-a46ca8d7d0cc status: test description: Potential threat actor tampering with Sysmon manifest and eventually disabling it references: - https://twitter.com/Flangvik/status/1283054508084473861 - https://twitter.com/SecurityJosh/status/1283027365770276866 - https://securityjosh.github.io/2020/04/23/Mute-Sysmon.html - https://gist.github.com/Cyb3rWard0g/cf08c38c61f7e46e8404b38201ca01c8 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-07-14 modified: 2025-10-22 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows service: security detection: selection1: EventID: 4657 ObjectName|contains: - WINEVT\Publishers\{5770385f-c22a-43e0-bf4c-06f5698ffbd9} - WINEVT\Channels\Microsoft-Windows-Sysmon/Operational ObjectValueName: Enabled NewValue: 0 selection2: EventID: 4663 ObjectName|contains: - WINEVT\Publishers\{5770385f-c22a-43e0-bf4c-06f5698ffbd9} - WINEVT\Channels\Microsoft-Windows-Sysmon/Operational AccessMask: '0x10000' condition: 1 of selection* falsepositives: - Unknown level: high
Query: risk of The compress_bidder_init function in archive_read_support_filter_compress.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted ta
Matching passage: CVE-2015-8932. CWE: CWE-20. CVSS: 5.5. The compress_bidder_init function in archive_read_support_filter_compress.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted tar file, which triggers an invalid left shift.
Near-miss passage: CVE-2015-2463. CWE: CWE-20. CVSS: 9.300000190734863. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Office 2007 SP3 and 2010 SP2, Live Meeting 2007 Console, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, Lync Basic 2013 SP1, Silverlight before 5.1.40728, and .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 allow remote attackers to execute arbitrary code via a crafted TrueType font, aka "TrueType Font Parsing Vulnerability," a different vulnerability than CVE-2015-2464.