alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users to write to arbitrary files via a symlink attack
Matching passage: CVE-2015-5273. CWE: CWE-59. CVSS: 3.5999999046325684. The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users to write to arbitrary files via a symlink attack on unpacked.cpio in a pre-created directory with a predictable name in /var/tmp.
Near-miss passage: CVE-2015-4156. CWE: CWE-59. CVSS: 3.5999999046325684. GNU Parallel before 20150522 (Nepal), when using (1) --cat or (2) --fifo with --sshlogin, allows local users to write to arbitrary files via a symlink attack on a temporary file.
Query: vulnerability: A vulnerability classified as problematic was found in Google Analytics Top Content Widget Plugin up to 1.5.6 on WordPress. Affected by this vulnerability is an unknown functionali
Matching passage: CVE-2015-10101. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability classified as problematic was found in Google Analytics Top Content Widget Plugin up to 1.5.6 on WordPress. Affected by this vulnerability is an unknown functionality of the file class-tgm-plugin-activation.php. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.5.7 is able to address this issue. The identifier of the patch is 25bb1dea113716200a6f0f3135801d84a7a65540. It is recommended to upgrade the affected component. The identifier VDB-226117 was assigned to this vulnerability.
Near-miss passage: CVE-2015-8936. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in squidGuard.cgi in squidGuard before 1.5 allows remote attackers to inject arbitrary web script or HTML via a blocked site link.
Query: vulnerability: Mobile Replayer in GPUTools Framework in Apple iOS before 9.2 allows attackers to execute arbitrary code in a privileged context via an app that provides a crafted pathname, a diff
Matching passage: CVE-2015-7069. CWE: UNKNOWN. CVSS: 9.300000190734863. Mobile Replayer in GPUTools Framework in Apple iOS before 9.2 allows attackers to execute arbitrary code in a privileged context via an app that provides a crafted pathname, a different vulnerability than CVE-2015-7070.
Near-miss passage: CVE-2015-8597. CWE: UNKNOWN. CVSS: 7.400000095367432. Open redirect vulnerability in Blue Coat ProxySG 6.5 before 6.5.8.8 and 6.6 and Advanced Secure Gateway (ASG) 6.6 might allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a base64-encoded URL in conjunction with a "clear text" one in a coaching page, as demonstrated by "http://www.%humbug-URL%.local/bluecoat-splash-API?%BASE64-URL%."
Query: explain CWE-1301
Matching passage: CWE-1301 Insufficient or Incomplete Data Removal within Hardware Component. The product's data removal process does not completely delete all data and potentially sensitive information within hardware components.
Near-miss passage: CWE-491 Public cloneable() Method Without Final ('Object Hijack'). A class has a cloneable() method that is not declared final, which allows an object to be created without calling the constructor. This can cause the object to be in an unexpected state.
Query: patch priority for CVE-2015-7609
Matching passage: CVE-2015-7609. CWE: CWE-79. CVSS: 6.099999904632568. Synacor Zimbra Mail Client 8.6 before 8.6.0 Patch 5 has XSS via the error/warning dialog and email body content in Zimbra.
Near-miss passage: CVE-2015-7782. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Let's PHP! Frame high-speed chat before 2015-09-22 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: rule covering Detect use of scrobj.dll as this DLL looks for the ScriptletURL key to get the location of the script to execute
Matching passage: Sigma rule: Detect use of scrobj.dll as this DLL looks for the ScriptletURL key to get the location of the script to execute. Logsource: windows / registry_set. Rule: title: Potential Persistence Via Scrobj.dll COM Hijacking id: fe20dda1-6f37-4379-bbe0-a98d400cae90 status: test description: Detect use of scrobj.dll as this DLL looks for the ScriptletURL key to get the location of the script to execute references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1546.015/T1546.015.md author: frack113 date: 2022-08-20 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.015 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: InprocServer32\(Default) Details: C:\WINDOWS\system32\scrobj.dll condition: selection falsepositives: - Legitimate use of the dll. level: medium
Near-miss passage: Sigma rule: Detects enabling or disabling of Remote Desktop Protocol (RDP) using alternate methods such as WMIC or PowerShell. In Po. Logsource: windows / process_creation. Rule: title: RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class id: 4b8f6d3a-9c5e-4f2a-a7d8-6b9c3e5f2a8d related: - id: a2863fbc-d5cb-48d5-83fb-d976d4b1743b type: similar status: experimental description: 'Detects enabling or disabling of Remote Desktop Protocol (RDP) using alternate methods such as WMIC or PowerShell. In PowerShell one-liner commands, the "SetAllowTSConnections" method of the "Win32_TerminalServiceSetting" class may be used to enable or disable RDP. In WMIC, the "rdtoggle" alias or "Win32_TerminalServiceSetting" class may be used for the same purpose. ' references: - https://www.trendmicro.com/en_gb/research/22/e/uncovering-a-kingminer-botnet-attack-using-trend-micro-managed-x.html - https://github.com/HackTricks-wiki/hacktricks/blob/72f20a3fa26775b932bd819f1824c6377802a768/src/windows-hardening/basic-cmd-for-pentesters.md#firewall - https://github.com/Lifailon/RSA/blob/rsa/Sources/RSA-1.4.1.ps1#L1468 author: Daniel Koifman (KoifSec), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-15 tags: - attack.lateral-movement - attack.t1021.001 - attack.execution - attack.t1047 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \wmic.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - wmic.exe - PowerShell.EXE - pwsh.dll selection_cli_method: CommandLine|contains: - rdtoggle - Win32_TerminalServiceSetting selection_cli_property: CommandLine|contains: SetAllowTSConnections condition: all of selection_* falsepositives: - Legitimate system administrators enabling RDP for remote support - System configuration scripts during deployment level: medium
Query: describe CVE-2015-7334
Matching passage: CVE-2015-7334. CWE: CWE-269. CVSS: 7.800000190734863. MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was reported (fixed and publicly disclosed in 2015) in Lenovo System Update version 5.07.0008 and prior where the SUService.exe /type COMMAND type could allow a user to execute arbitrary code with elevated privileges.
Near-miss passage: CVE-2015-3613. CWE: CWE-269. CVSS: 9.800000190734863. A vulnerability exists in in FortiManager 5.2.1 and earlier and 5.0.10 and earlier in the WebUI FTP backup page
Query: CVE similar to CVE-2015-7609
Matching passage: CVE-2015-7609. CWE: CWE-79. CVSS: 6.099999904632568. Synacor Zimbra Mail Client 8.6 before 8.6.0 Patch 5 has XSS via the error/warning dialog and email body content in Zimbra.
Near-miss passage: CVE-2015-7782. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Let's PHP! Frame high-speed chat before 2015-09-22 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: write Sigma for Identifies when an organization doesn't have the proper license for PIM and is out of compliance.
Matching passage: Sigma rule: Identifies when an organization doesn't have the proper license for PIM and is out of compliance.. Logsource: azure / pim. Rule: title: Invalid PIM License id: 58af08eb-f9e1-43c8-9805-3ad9b0482bd8 status: test description: Identifies when an organization doesn't have the proper license for PIM and is out of compliance. references: - https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#the-organization-doesnt-have-microsoft-entra-premium-p2-or-microsoft-entra-id-governance author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-14 tags: - attack.initial-access - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation logsource: product: azure service: pim detection: selection: riskEventType: invalidLicenseAlertIncident condition: selection falsepositives: - Investigate if licenses have expired. level: high
Near-miss passage: Sigma rule: Detects potential access attempts to the PowerShell console history directly via history file (ConsoleHost_history.txt).. Logsource: windows / process_creation. Rule: title: Potential PowerShell Console History Access Attempt via History File id: f4ff7323-b5fc-4323-8b52-6b9408e15788 status: experimental description: 'Detects potential access attempts to the PowerShell console history directly via history file (ConsoleHost_history.txt). This can give access to plaintext passwords used in PowerShell commands or used for general reconnaissance. ' references: - https://0xdf.gitlab.io/2018/11/08/powershell-history-file.html author: Luc Génaux date: 2025-04-03 tags: - attack.credential-access - attack.t1552.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - ConsoleHost_history.txt - (Get-PSReadLineOption).HistorySavePath condition: selection falsepositives: - Legitimate access of the console history file is possible level: medium
Query: write Sigma for Detects the use of KrbRelay, a Kerberos relaying tool
Matching passage: Sigma rule: Detects the use of KrbRelay, a Kerberos relaying tool. Logsource: windows / process_creation. Rule: title: HackTool - KrbRelay Execution id: e96253b8-6b3b-4f90-9e59-3b24b99cf9b4 status: test description: Detects the use of KrbRelay, a Kerberos relaying tool references: - https://github.com/cube0x0/KrbRelay author: Florian Roth (Nextron Systems) date: 2022-04-27 modified: 2023-02-04 tags: - attack.credential-access - attack.t1558.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \KrbRelay.exe - OriginalFileName: KrbRelay.exe selection_cli_1: CommandLine|contains|all: - ' -spn ' - ' -clsid ' - ' -rbcd ' selection_cli_2: CommandLine|contains|all: - shadowcred - clsid - spn selection_cli_3: CommandLine|contains|all: - 'spn ' - 'session ' - 'clsid ' condition: 1 of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects WmiPrvSE spawning a process. Logsource: windows / process_creation. Rule: title: WmiPrvSE Spawned A Process id: d21374ff-f574-44a7-9998-4a8c8bf33d7d related: - id: 8a582fe2-0882-4b89-a82a-da6b2dc32937 type: similar - id: 692f0bec-83ba-4d04-af7e-e884a96059b6 type: similar status: stable description: Detects WmiPrvSE spawning a process references: - https://threathunterplaybook.com/hunts/windows/190815-RemoteServiceInstallation/notebook.html author: Roberto Rodriguez @Cyb3rWard0g date: 2019-08-15 modified: 2023-03-23 tags: - attack.execution - attack.t1047 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \WmiPrvSe.exe filter_logonid: LogonId: - '0x3e7' - 'null' filter_system_user: User|contains: - AUTHORI - AUTORI filter_wmiprvse: Image|endswith: \WmiPrvSE.exe filter_werfault: Image|endswith: \WerFault.exe filter_null: LogonId: null condition: selection and not 1 of filter_* falsepositives: - False positives are expected (e.g. in environments where WinRM is used legitimately) level: medium
Query: threat report mentioning Cloud Groups
Matching passage: T1069.003 Cloud Groups. Tactics: discovery. Description: Adversaries may attempt to find cloud groups and permission settings. The knowledge of cloud permission groups can help adversaries determine the particular roles of users and groups within an environment, as well as which users are associated with a particular group. With authenticated access there are several tools that can be used to find permissions groups. The <code>Get-MsolRole</code> PowerShell cmdlet can be used to obtain roles and permissions groups for Exchange and Office 365 accounts (Citation: Microsoft Msolrole)(Citation: GitHub Raindance). Azure CLI (AZ CLI) and the Google Cloud Identity Provider API also provide interfaces to obtain permissions groups. The command <code>az ad user get-member-groups</code> will list groups associated to a user account for Azure while the API endpoint <code>GET https://cloudidentity.googleapis.com/v1/groups</code> lists group resources available to a user for Google.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018)(Citation: Google Cloud Identity API Documentation) In AWS, the commands `ListRolePolicies` and `ListAttachedRolePolicies` allow users to enumerate the policies attached to a role.(Citation: Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022) Adversaries may attempt to list ACLs for objects to determine the owner and other accounts with access to the object, for example, via the AWS <code>GetBucketAcl</code> API (Citation: AWS Get Bucket ACL). Using this information an adversary can target accounts with permissions to a given object or leverage accounts they have already compromised to access the object.
Near-miss passage: T1069 Permission Groups Discovery. Tactics: discovery. Description: Adversaries may attempt to discover group and permission settings. This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions. Adversaries may attempt to discover group permission settings in many different ways. This data may provide the adversary with information about the compromised environment that can be used in follow-on activity and targeting.(Citation: CrowdStrike BloodHound April 2018)
Query: risk of Microsoft Internet Explorer 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Internet Explorer Information Disclosure Vul
Matching passage: CVE-2015-6157. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability."
Near-miss passage: CVE-2015-1957. CWE: CWE-200. CVSS: 5.300000190734863. IBM WebSphere MQ 7.5.x before 7.5.0.6 and 8.0.x before 8.0.0.3 allows remote authenticated users to obtain sensitive information via a man-in-the-middle attack, related to duplication of message data in cleartext outside the protected payload. IBM X-Force ID: 103482.
Query: patch priority for CVE-2015-5093
Matching passage: CVE-2015-5093. CWE: CWE-120. CVSS: 10.0. Buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-6458. CWE: CWE-120. CVSS: 8.800000190734863. Moxa SoftCMS 1.3 and prior is susceptible to a buffer overflow condition that may crash or allow remote code execution. Moxa released SoftCMS version 1.4 on June 1, 2015, to address the vulnerability.
Query: CVE similar to CVE-2015-1097
Matching passage: CVE-2015-1097. CWE: CWE-200. CVSS: 1.899999976158142. IOMobileFramebuffer in Apple iOS before 8.3 and Apple TV before 7.2 allows attackers to obtain sensitive information about kernel memory via a crafted app.
Near-miss passage: CVE-2015-3319. CWE: CWE-200. CVSS: 5.0. Hotspot Express hotEx Billing Manager 73 does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
Query: patch priority for CVE-2015-9252
Matching passage: CVE-2015-9252. CWE: CWE-399. CVSS: 5.5. An issue was discovered in QPDF before 7.0.0. Endless recursion causes stack exhaustion in QPDFTokenizer::resolveLiteral() in QPDFTokenizer.cc, related to the QPDF::resolve function in QPDF.cc.
Near-miss passage: CVE-2015-6289. CWE: CWE-399. CVSS: 7.5. Cisco IOS 15.5(3)M on Integrated Services Router (ISR) 800, 819, and 829 devices allows remote attackers to cause a denial of service (memory consumption) via crafted TCP packets on the SSH port, aka Bug ID CSCuu13476.
Query: rule covering Detects Microsoft Visual Studio vsls-agent.exe lolbin execution with a suspicious library load using the --agentExtensio
Matching passage: Sigma rule: Detects Microsoft Visual Studio vsls-agent.exe lolbin execution with a suspicious library load using the --agentExtensio. Logsource: windows / process_creation. Rule: title: Suspicious Vsls-Agent Command With AgentExtensionPath Load id: 43103702-5886-11ed-9b6a-0242ac120002 status: test description: Detects Microsoft Visual Studio vsls-agent.exe lolbin execution with a suspicious library load using the --agentExtensionPath parameter references: - https://twitter.com/bohops/status/1583916360404729857 author: bohops date: 2022-10-30 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: Image|endswith: \vsls-agent.exe CommandLine|contains: --agentExtensionPath filter: CommandLine|contains: Microsoft.VisualStudio.LiveShare.Agent. condition: selection and not filter falsepositives: - False positives depend on custom use of vsls-agent.exe level: medium
Near-miss passage: Sigma rule: Detects execution of the perl binary with the "-e" flag and common strings related to potential reverse shell activity. Logsource: linux / process_creation. Rule: title: Potential Perl Reverse Shell Execution id: 259df6bc-003f-4306-9f54-4ff1a08fa38e status: test description: Detects execution of the perl binary with the "-e" flag and common strings related to potential reverse shell activity references: - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet - https://www.revshells.com/ author: '@d4ns4n_, Nasreddine Bencherchali (Nextron Systems)' date: 2023-04-07 tags: - attack.execution logsource: category: process_creation product: linux detection: selection_img: Image|endswith: /perl CommandLine|contains: ' -e ' selection_content: - CommandLine|contains|all: - fdopen( - ::Socket::INET - CommandLine|contains|all: - Socket - connect - open - exec condition: all of selection_* falsepositives: - Unlikely level: high
Query: common weakness: Hardware Logic with Insecure De-Synchronization between Control and Data Channels
Matching passage: CWE-1264 Hardware Logic with Insecure De-Synchronization between Control and Data Channels. The hardware logic for error handling and security checks can incorrectly forward data before the security check is complete.
Near-miss passage: CWE-238 Improper Handling of Incomplete Structural Elements. The product does not handle or incorrectly handles when a particular structural element is not completely specified.
Query: detection rule: Detects Obfuscated Powershell via use Rundll32 in Scripts
Matching passage: Sigma rule: Detects Obfuscated Powershell via use Rundll32 in Scripts. Logsource: windows / security. Rule: title: Invoke-Obfuscation Via Use Rundll32 - Security id: cd0f7229-d16f-42de-8fe3-fba365fbcb3a related: - id: 641a4bfb-c017-44f7-800c-2aee0184ce9b type: derived status: test description: Detects Obfuscated Powershell via use Rundll32 in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2020-10-09 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows service: security definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697 detection: selection: EventID: 4697 ServiceFileName|contains|all: - '&&' - rundll32 - shell32.dll - shellexec_rundll ServiceFileName|contains: - value - invoke - comspec - iex condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects unknown program using commandline flags usually used by tools such as PsExec and PAExec to start programs with S. Logsource: windows / process_creation. Rule: title: Potential Privilege Escalation To LOCAL SYSTEM id: 207b0396-3689-42d9-8399-4222658efc99 related: - id: 8834e2f7-6b4b-4f09-8906-d2276470ee23 type: similar status: test description: Detects unknown program using commandline flags usually used by tools such as PsExec and PAExec to start programs with SYSTEM Privileges references: - https://learn.microsoft.com/en-us/sysinternals/downloads/psexec - https://www.poweradmin.com/paexec/ - https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2021-05-22 modified: 2024-03-05 tags: - attack.resource-development - attack.t1587.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|windash: - ' -s cmd' - ' -s -i cmd' - ' -i -s cmd' - ' -s pwsh' - ' -s -i pwsh' - ' -i -s pwsh' - ' -s powershell' - ' -s -i powershell' - ' -i -s powershell' filter_main_exclude_coverage: CommandLine|contains: - paexec - PsExec - accepteula condition: selection and not 1 of filter_main_* falsepositives: - Weird admins that rename their tools - Software companies that bundle PsExec/PAExec with their software and rename it, so that it is less embarrassing level: high
Query: vulnerability: Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified
Matching passage: CVE-2015-3074. CWE: CWE-284. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified vectors, a different vulnerability than CVE-2015-3060, CVE-2015-3061, CVE-2015-3062, CVE-2015-3063, CVE-2015-3064, CVE-2015-3065, CVE-2015-3066, CVE-2015-3067, CVE-2015-3068, CVE-2015-3069, CVE-2015-3071, CVE-2015-3072, and CVE-2015-3073.
Near-miss passage: CVE-2015-3066. CWE: CWE-284. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified vectors, a different vulnerability than CVE-2015-3060, CVE-2015-3061, CVE-2015-3062, CVE-2015-3063, CVE-2015-3064, CVE-2015-3065, CVE-2015-3067, CVE-2015-3068, CVE-2015-3069, CVE-2015-3071, CVE-2015-3072, CVE-2015-3073, and CVE-2015-3074.
Query: explain CWE-920
Matching passage: CWE-920 Improper Restriction of Power Consumption. The product operates in an environment in which power is a limited resource that cannot be automatically replenished, but the product does not properly restrict the amount of power that its operation consumes.
Near-miss passage: CWE-650 Trusting HTTP Permission Methods on the Server Side. The server contains a protection mechanism that assumes that any URI that is accessed using HTTP GET will not cause a state change to the associated resource. This might allow attackers to bypass intended access restrictions and conduct resource modification and deletion attacks, since some applications allow GET to modify state.