alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: patch priority for CVE-2015-4548
Matching passage: CVE-2015-4548. CWE: CWE-264. CVSS: 7.199999809265137. EMC RSA Web Threat Detection before 5.1 SP1 allows local users to obtain root privileges by leveraging access to a service account and writing commands to a service configuration file.
Near-miss passage: CVE-2015-5301. CWE: CWE-264. CVSS: 5.5. providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.2 and 1.1.x before 1.1.1 does not properly check permissions, which allows remote authenticated users to cause a denial of service by deleting a SAML2 Service Provider (SP).
Query: CVE similar to CVE-2015-2575
Matching passage: CVE-2015-2575. CWE: UNKNOWN. CVSS: 4.900000095367432. Unspecified vulnerability in the MySQL Connectors component in Oracle MySQL 5.1.34 and earlier allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Connector/J.
Near-miss passage: CVE-2015-0492. CWE: UNKNOWN. CVSS: 9.300000190734863. Unspecified vulnerability in Oracle Java SE 7u76 and 8u40, and JavaFX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-0484.
Query: risk of Multiple cross-site scripting (XSS) vulnerabilities in pfSense before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) srctrack, (2) use_mfs_tmp_size
Matching passage: CVE-2015-6510. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in pfSense before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) srctrack, (2) use_mfs_tmp_size, or (3) use_mfs_var_size parameter to system_advanced_misc.php; the (4) port, (5) snaplen, or (6) count parameter to diag_packet_capture.php; the (7) pppoe_resethour, (8) pppoe_resetminute, (9) wpa_group_rekey, or (10) wpa_gmk_rekey parameter to interfaces.php; the (11) pppoe_resethour or (12) pppoe_resetminute parameter to interfaces_ppps_edit.php; the (13) member[] parameter to interfaces_qinq_edit.php; the (14) port or (15) retry parameter to load_balancer_pool_edit.php; the (16) pkgrepourl parameter to pkg_mgr_settings.php; the (17) zone parameter to services_captiveportal.php; the port parameter to (18) services_dnsmasq.php or (19) services_unbound.php; the (20) cache_max_ttl or (21) cache_min_ttl parameter to services_unbound_advanced.php; the (22) sshport parameter to system_advanced_admin.php; the (23) id, (24) tunable, (25) descr, or (26) value parameter to system_advanced_sysctl.php; the (27) firmwareurl, (28) repositoryurl, or (29) branch parameter to system_firmware_settings.php; the (30) pfsyncpeerip, (31) synchronizetoip, (32) username, or (33) passwordfld parameter to system_hasync.php; the (34) maxmss parameter to vpn_ipsec_settings.php; the (35) ntp_server1, (36) ntp_server2, (37) wins_server1, or (38) wins_server2 parameter to vpn_openvpn_csc.php; or unspecified parameters to (39) load_balancer_relay_action.php, (40) load_balancer_relay_action_edit.php, (41) load_balancer_relay_protocol.php, or (42) load_balancer_relay_protocol_edit.php.
Near-miss passage: CVE-2015-2807. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in js/window.php in the Navis DocumentCloud plugin before 0.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter.
Query: Encoded PowerShell / command-line abuse matching Fast Flux DNS
Matching passage: T1568.001 Fast Flux DNS. Tactics: command and control. Description: Adversaries may use Fast Flux DNS to hide a command and control channel behind an array of rapidly changing IP addresses linked to a single domain resolution. This technique uses a fully qualified domain name, with multiple IP addresses assigned to it which are swapped with high frequency, using a combination of round robin IP addressing and short Time-To-Live (TTL) for a DNS resource record.(Citation: MehtaFastFluxPt1)(Citation: MehtaFastFluxPt2)(Citation: Fast Flux - Welivesecurity) The simplest, "single-flux" method, involves registering and de-registering an addresses as part of the DNS A (address) record list for a single DNS name. These registrations have a five-minute average lifespan, resulting in a constant shuffle of IP address resolution.(Citation: Fast Flux - Welivesecurity) In contrast, the "double-flux" method registers and de-registers an address as part of the DNS Name Server record list for the DNS zone, providing additional resilience for the connection. With double-flux additional hosts can act as a proxy to the C2 host, further insulating the true source of the C2 channel.
Near-miss passage: T1568 Dynamic Resolution. Tactics: command and control. Description: Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control. Adversaries may use dynamic resolution for the purpose of [Fallback Channels](https://attack.mitre.org/techniques/T1008). When contact is lost with the primary command and control server malware may employ dynamic resolution as a means to reestablishing command and control.(Citation: Talos CCleanup 2017)(Citation: FireEye POSHSPY April 2017)(Citation: ESET Sednit 2017 Activity)
Query: patch priority for CVE-2015-9202
Matching passage: CVE-2015-9202. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, while processing the content headers in the Playready module, a buffer overread may occur if the header count exceeds the expected value.
Near-miss passage: CVE-2015-1872. CWE: CWE-119. CVSS: 6.800000190734863. The ff_mjpeg_decode_sof function in libavcodec/mjpegdec.c in FFmpeg before 2.5.4 does not validate the number of components in a JPEG-LS Start Of Frame segment, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Motion JPEG data.
Query: rule covering Detects instances where an RDP service on an OpenCanary node has had a connection attempt.
Matching passage: Sigma rule: Detects instances where an RDP service on an OpenCanary node has had a connection attempt.. Logsource: opencanary / application. Rule: title: OpenCanary - RDP New Connection Attempt id: 598290cf-5932-45cd-9123-be1e05ab4f2e status: experimental description: Detects instances where an RDP service on an OpenCanary node has had a connection attempt. references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Marco Pedrinazzi (@pedrinazziM) date: 2026-01-06 tags: - attack.initial-access - attack.lateral-movement - attack.persistence - attack.t1133 - attack.t1021.001 logsource: category: application product: opencanary detection: selection: logtype: 14001 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the creation of a file with a suspicious extension in the public folder, which could indicate potential maliciou. Logsource: windows / file_event. Rule: title: Suspicious Binaries and Scripts in Public Folder id: b447f7de-1e53-4cbf-bfb4-f1f6d0b04e4e status: experimental description: Detects the creation of a file with a suspicious extension in the public folder, which could indicate potential malicious activity. references: - https://intel.thedfirreport.com/events/view/30032 - https://intel.thedfirreport.com/eventReports/view/70 - https://thedfirreport.com/2025/01/27/cobalt-strike-and-a-pair-of-socks-lead-to-lockbit-ransomware/ author: The DFIR Report date: 2025-01-23 tags: - attack.execution - attack.t1204 logsource: category: file_event product: windows detection: selection: TargetFilename|contains: :\Users\Public\ TargetFilename|endswith: - .bat - .dll - .exe - .hta - .js - .ps1 - .vbe - .vbs condition: selection falsepositives: - Administrators deploying legitimate binaries to public folders. level: high regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_public_folder_extension/info.yml
Query: CVE similar to CVE-2015-4766
Matching passage: CVE-2015-4766. CWE: UNKNOWN. CVSS: 1.899999976158142. Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows local users to affect availability via unknown vectors related to Server : Security : Firewall.
Near-miss passage: CVE-2015-1853. CWE: UNKNOWN. CVSS: 6.5. chrony before 1.31.1 does not properly protect state variables in authenticated symmetric NTP associations, which allows remote attackers with knowledge of NTP peering to cause a denial of service (inability to synchronize) via random timestamps in crafted NTP data packets.
Query: vulnerability: dyld in Dev Tools in Apple iOS before 9 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Matching passage: CVE-2015-5876. CWE: CWE-119. CVSS: 9.300000190734863. dyld in Dev Tools in Apple iOS before 9 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Near-miss passage: CVE-2015-5917. CWE: CWE-119. CVSS: 5.0. The glob implementation in tnftpd (formerly lukemftpd), as used in Apple OS X before 10.11, allows remote attackers to cause a denial of service (memory consumption and daemon outage) via a STAT command containing a crafted pattern, as demonstrated by multiple instances of the {..,..,..}/* substring.
Query: risk of The multicons plugin before 3.0 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=multicons%2Fmulticons.php global_url or admin_url parameter.
Matching passage: CVE-2015-9424. CWE: CWE-352. CVSS: 6.5. The multicons plugin before 3.0 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=multicons%2Fmulticons.php global_url or admin_url parameter.
Near-miss passage: CVE-2015-9434. CWE: CWE-352. CVSS: 6.5. The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=kwlogos&page=kwlogos_settings tab or tab_flags_order parameter.
Query: describe CVE-2015-6079
Matching passage: CVE-2015-6079. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6068, CVE-2015-6072, CVE-2015-6073, CVE-2015-6075, CVE-2015-6077, CVE-2015-6080, and CVE-2015-6082.
Near-miss passage: CVE-2015-2427. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Query: rule covering Detects remote task creation via at.exe or API interacting with ATSVC namedpipe
Matching passage: Sigma rule: Detects remote task creation via at.exe or API interacting with ATSVC namedpipe. Logsource: zeek / smb_files. Rule: title: Remote Task Creation via ATSVC Named Pipe - Zeek id: dde85b37-40cd-4a94-b00c-0b8794f956b5 related: - id: f6de6525-4509-495a-8a82-1f8b0ed73a00 type: derived status: test description: Detects remote task creation via at.exe or API interacting with ATSVC namedpipe references: - https://web.archive.org/web/20230409194125/https://blog.menasec.net/2019/03/threat-hunting-25-scheduled-tasks-for.html author: Samir Bousseaden, @neu5rn date: 2020-04-03 modified: 2022-12-27 tags: - attack.privilege-escalation - attack.execution - attack.lateral-movement - attack.persistence - car.2013-05-004 - car.2015-04-001 - attack.t1053.002 logsource: product: zeek service: smb_files detection: selection: path: \\\*\IPC$ name: atsvc condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of "Tpmvscmgr.exe" to create a new virtual smart card.. Logsource: windows / process_creation. Rule: title: New Virtual Smart Card Created Via TpmVscMgr.EXE id: c633622e-cab9-4eaa-bb13-66a1d68b3e47 status: test description: Detects execution of "Tpmvscmgr.exe" to create a new virtual smart card. references: - https://learn.microsoft.com/en-us/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-15 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \tpmvscmgr.exe OriginalFileName: TpmVscMgr.exe selection_cli: CommandLine|contains: create condition: all of selection_* falsepositives: - Legitimate usage by an administrator level: medium
Query: adversary uses Credentials in Registry
Matching passage: T1552.002 Credentials in Registry. Tactics: credential access. Description: Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons. Example commands to find Registry keys related to password information: (Citation: Pentestlab Stored Credentials) * Local Machine Hive: <code>reg query HKLM /f password /t REG_SZ /s</code> * Current User Hive: <code>reg query HKCU /f password /t REG_SZ /s</code>
Near-miss passage: T1552.001 Credentials In Files. Tactics: credential access. Description: Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords. It is possible to extract passwords from backups or saved virtual machines through [OS Credential Dumping](https://attack.mitre.org/techniques/T1003).(Citation: CG 2014) Passwords may also be obtained from Group Policy Preferences stored on the Windows Domain Controller.(Citation: SRD GPP) In cloud and/or containerized environments, authenticated user and service account credentials are often stored in local configuration and credential files.(Citation: Unit 42 Hildegard Malware) They may also be found as parameters to deployment commands in container logs.(Citation: Unit 42 Unsecured Docker Daemons) In some cases, these files can be copied and reused on another machine or the contents can be read and then used to authenticate without needing to copy any files.(Citation: Specter Ops - Cloud Credential Storage)
Query: risk of The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=kwlogos&page=kwlogos_settings tab or tab_flags_order parame
Matching passage: CVE-2015-9434. CWE: CWE-352. CVSS: 6.5. The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=kwlogos&page=kwlogos_settings tab or tab_flags_order parameter.
Near-miss passage: CVE-2015-5999. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the D-Link DIR-816L Wireless Router with firmware before 2.06.B09_BETA allow remote attackers to hijack the authentication of administrators for requests that (1) change the admin password, (2) change the network policy, or (3) possibly have other unspecified impact via crafted requests to hedwig.cgi and pigwidgeon.cgi.
Query: detection rule: Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the c
Matching passage: Sigma rule: Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the c. Logsource: windows / security. Rule: title: Invoke-Obfuscation Obfuscated IEX Invocation - Security id: fd0f5778-d3cb-4c9a-9695-66759d04702a related: - id: 51aa9387-1c53-4153-91cc-d73c59ae1ca9 type: derived status: test description: Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block linked in the references references: - https://github.com/danielbohannon/Invoke-Obfuscation/blob/f20e7f843edd0a3a7716736e9eddfa423395dd26/Out-ObfuscatedStringCommand.ps1#L873-L888 author: Daniel Bohannon (@Mandiant/@FireEye), oscd.community date: 2019-11-08 modified: 2022-11-27 tags: - attack.stealth - attack.t1027 logsource: product: windows service: security definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697 detection: selection_eid: EventID: 4697 selection_servicefilename: - ServiceFileName|re: \$PSHome\[\s*\d{1,3}\s*\]\s*\+\s*\$PSHome\[ - ServiceFileName|re: \$ShellId\[\s*\d{1,3}\s*\]\s*\+\s*\$ShellId\[ - ServiceFileName|re: \$env:Public\[\s*\d{1,3}\s*\]\s*\+\s*\$env:Public\[ - ServiceFileName|re: \$env:ComSpec\[(\s*\d{1,3}\s*,){2} - ServiceFileName|re: \\*mdr\*\W\s*\)\.Name - ServiceFileName|re: \$VerbosePreference\.ToString\( - ServiceFileName|re: \String\]\s*\$VerbosePreference condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects keywords that could indicate clearing PowerShell history. Logsource: windows / ps_script. Rule: title: Clear PowerShell History - PowerShell id: 26b692dc-1722-49b2-b496-a8258aa6371d related: - id: dfba4ce1-e0ea-495f-986e-97140f31af2d type: derived status: test description: Detects keywords that could indicate clearing PowerShell history references: - https://gist.github.com/hook-s3c/7363a856c3cdbadeb71085147f042c1a author: Ilyas Ochkov, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community date: 2022-01-25 modified: 2022-12-02 tags: - attack.stealth - attack.t1070.003 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection1a: ScriptBlockText|contains: - del - Remove-Item - rm selection1b: ScriptBlockText|contains: (Get-PSReadlineOption).HistorySavePath selection_2: ScriptBlockText|contains|all: - Set-PSReadlineOption - –HistorySaveStyle - SaveNothing selection_3: ScriptBlockText|contains|all: - Set-PSReadlineOption - -HistorySaveStyle - SaveNothing condition: 1 of selection_* or all of selection1* falsepositives: - Legitimate PowerShell scripts level: medium
Query: CVE similar to CVE-2015-7001
Matching passage: CVE-2015-7001. CWE: CWE-264. CVSS: 6.800000190734863. AppSandbox in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 mishandles hard links, which allows attackers to bypass Contacts access revocation via a crafted app.
Near-miss passage: CVE-2015-6640. CWE: CWE-264. CVSS: 7.800000190734863. The prctl_set_vma_anon_name function in kernel/sys.c in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 does not ensure that only one vma is accessed in a certain update action, which allows attackers to gain privileges or cause a denial of service (vma list corruption) via a crafted application, aka internal bug 20017123.
Query: alert when Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class
Matching passage: Sigma rule: Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class. Logsource: windows / image_load. Rule: title: Potential DCOM InternetExplorer.Application DLL Hijack - Image Load id: f354eba5-623b-450f-b073-0b5b2773b6aa related: - id: e554f142-5cf3-4e55-ace9-a1b59e0def65 type: obsolete - id: 2f7979ae-f82b-45af-ac1d-2b10e93b0baa type: similar status: test description: Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class references: - https://threathunterplaybook.com/hunts/windows/201009-RemoteDCOMIErtUtilDLLHijack/notebook.html author: Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR), wagga date: 2020-10-12 modified: 2022-12-18 tags: - attack.lateral-movement - attack.t1021.002 - attack.t1021.003 logsource: product: windows category: image_load detection: selection: Image|endswith: \Internet Explorer\iexplore.exe ImageLoaded|endswith: \Internet Explorer\iertutil.dll condition: selection falsepositives: - Unknown level: critical
Near-miss passage: Sigma rule: Find information about network devices that is not stored in config files. Logsource: cisco / aaa. Rule: title: Cisco Discovery id: 9705a6a1-6db6-4a16-a987-15b7151e299b status: test description: Find information about network devices that is not stored in config files references: - https://www.cisco.com/c/en/us/td/docs/server_nw_virtual/2-5_release/command_reference/show.html author: Austin Clark date: 2019-08-12 modified: 2023-01-04 tags: - attack.discovery - attack.t1083 - attack.t1201 - attack.t1057 - attack.t1018 - attack.t1082 - attack.t1016 - attack.t1049 - attack.t1033 - attack.t1124 logsource: product: cisco service: aaa detection: keywords: - dir - show arp - show cdp - show clock - show ip interface - show ip route - show ip sockets - show processes - show ssh - show users - show version condition: keywords falsepositives: - Commonly used by administrators for troubleshooting level: low