alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: The presentation transmission permission management mechanism in Huawei TE30, TE40, TE50, and TE60 multimedia video conferencing endpoints with software before V100R001C10SPC100 al
Matching passage: CVE-2015-8672. CWE: CWE-19. CVSS: 5.300000190734863. The presentation transmission permission management mechanism in Huawei TE30, TE40, TE50, and TE60 multimedia video conferencing endpoints with software before V100R001C10SPC100 allows remote attackers to cause a denial of service (wired presentation outage) via unspecified vectors involving a wireless presentation.
Near-miss passage: CVE-2015-9166. CWE: CWE-19. CVSS: 7.5. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, DRM provisioning mechanisms used in QSEE applications have a feature to prevent further provisioning. This is done by creating an SFS file called 'finalize_prov_flag.data' at the end of provisioning. When this feature is enabled, provisioning calls check for the existence of the file in order to decide whether to do provisioning or not. Current implementation allows provisioning without sufficient checks.
Query: describe CVE-2015-2878
Matching passage: CVE-2015-2878. CWE: CWE-352. CVSS: 8.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in Hexis HawkEye G 3.0.1.4912 allow remote attackers to hijack the authentication of administrators for requests that (1) add arbitrary accounts via the name parameter to interface/rest/accounts/json; turn off the (2) Url matching, (3) DNS Inject, or (4) IP Redirect Sensor in a request to interface/rest/dpi/setEnabled/1; or (5) perform whitelisting of malware MD5 hash IDs via the id parameter to interface/rest/md5-threats/whitelist.
Near-miss passage: CVE-2015-0970. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in SearchBlox before 8.2 allows remote attackers to hijack the authentication of arbitrary users.
Query: detect Detects process handle on LSASS process with certain access mask and object type SAM_DOMAIN in logs
Matching passage: Sigma rule: Detects process handle on LSASS process with certain access mask and object type SAM_DOMAIN. Logsource: windows / security. Rule: title: Password Dumper Activity on LSASS id: aa1697b7-d611-4f9a-9cb2-5125b4ccfd5c status: test description: Detects process handle on LSASS process with certain access mask and object type SAM_DOMAIN references: - https://twitter.com/jackcr/status/807385668833968128 author: sigma date: 2017-02-12 modified: 2022-10-09 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows service: security detection: selection: EventID: 4656 ProcessName|endswith: \lsass.exe AccessMask: '0x705' ObjectType: SAM_DOMAIN condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects Certify a tool for Active Directory certificate abuse based on PE metadata characteristics and common command li. Logsource: windows / process_creation. Rule: title: HackTool - Certify Execution id: 762f2482-ff21-4970-8939-0aa317a886bb status: test description: Detects Certify a tool for Active Directory certificate abuse based on PE metadata characteristics and common command line arguments. references: - https://github.com/GhostPack/Certify author: pH-T (Nextron Systems) date: 2023-04-17 modified: 2023-04-25 tags: - attack.discovery - attack.credential-access - attack.t1649 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \Certify.exe - OriginalFileName: Certify.exe - Description|contains: Certify selection_cli_commands: CommandLine|contains: - '.exe cas ' - '.exe find ' - '.exe pkiobjects ' - '.exe request ' - '.exe download ' selection_cli_options: CommandLine|contains: - ' /vulnerable' - ' /template:' - ' /altname:' - ' /domain:' - ' /path:' - ' /ca:' condition: selection_img or all of selection_cli_* falsepositives: - Unknown level: high
Query: weakness Use of Potentially Dangerous Function
Matching passage: CWE-676 Use of Potentially Dangerous Function. The product invokes a potentially dangerous function that could introduce a vulnerability if it is used incorrectly, but the function can also be used safely.
Near-miss passage: CWE-648 Incorrect Use of Privileged APIs. The product does not conform to the API requirements for a function call that requires extra privileges. This could allow attackers to gain privileges by causing the function to be called incorrectly.
Query: vulnerability: IBM WebSphere MQ Light 1.x before 1.0.2 mishandles abbreviated TLS handshakes, which allows remote attackers to cause a denial of service (MQXR service crash) via unspecified vecto
Matching passage: CVE-2015-4941. CWE: CWE-17. CVSS: 5.300000190734863. IBM WebSphere MQ Light 1.x before 1.0.2 mishandles abbreviated TLS handshakes, which allows remote attackers to cause a denial of service (MQXR service crash) via unspecified vectors.
Near-miss passage: CVE-2015-0805. CWE: CWE-17. CVSS: 7.5. The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before 37.0 makes an incorrect memset call during interaction with the mozilla::layers::BufferTextureClient::AllocateForSurface function, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors that trigger rendering of 2D graphics content.
Query: risk of The Flvplayer component in TYPO3 6.2.x before 6.2.16 allows remote attackers to embed Flash videos from external domains via unspecified vectors, aka "Cross-Site Flashing."
Matching passage: CVE-2015-8760. CWE: CWE-20. CVSS: 6.099999904632568. The Flvplayer component in TYPO3 6.2.x before 6.2.16 allows remote attackers to embed Flash videos from external domains via unspecified vectors, aka "Cross-Site Flashing."
Near-miss passage: CVE-2015-8000. CWE: CWE-20. CVSS: 5.0. db.c in named in ISC BIND 9.x before 9.9.8-P2 and 9.10.x before 9.10.3-P2 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a malformed class attribute.
Query: vulnerability: EMC Secure Remote Services Virtual Edition (ESRS VE) 3.x before 3.06 does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof
Matching passage: CVE-2015-0543. CWE: CWE-20. CVSS: 5.800000190734863. EMC Secure Remote Services Virtual Edition (ESRS VE) 3.x before 3.06 does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Near-miss passage: CVE-2015-9051. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in LTE where an assertion can be reached due to an improper bound on a length in a System Information message.
Query: rule covering Detects commands that temporarily turn off Volume Snapshots
Matching passage: Sigma rule: Detects commands that temporarily turn off Volume Snapshots. Logsource: windows / process_creation. Rule: title: Disabled Volume Snapshots id: dee4af55-1f22-4e1d-a9d2-4bdc7ecb472a status: test description: Detects commands that temporarily turn off Volume Snapshots references: - https://twitter.com/0gtweet/status/1354766164166115331 author: Florian Roth (Nextron Systems) date: 2021-01-28 modified: 2023-12-15 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - \Services\VSS\Diag - /d Disabled condition: selection falsepositives: - Legitimate administration level: high
Near-miss passage: Sigma rule: Detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identif. Logsource: aws / cloudtrail. Rule: title: AWS ConsoleLogin Failed Authentication id: 6393e346-1977-46ef-8987-ad414a145fad status: experimental description: 'Detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identifying potential brute-force attacks or unauthorized access attempts to AWS accounts. ' references: - https://naikordian.github.io/blog/posts/brute-force-aws-console/ - https://help.fortinet.com/fsiem/Public_Resource_Access/7_2_1/rules/PH_RULE_AWS_Management_Console_Brute_Force_of_Root_User_Identity.htm - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/aws_login_failure/aws_cloudtrail_events.json author: Ivan Saakov, Nasreddine Bencherchali date: 2025-10-19 tags: - attack.credential-access - attack.t1110 logsource: product: aws service: cloudtrail detection: selection: eventName: ConsoleLogin errorMessage: Failed authentication condition: selection falsepositives: - Legitimate failed login attempts by authorized users. Investigate the source of repeated failed login attempts. level: medium
Query: explain CWE-274
Matching passage: CWE-274 Improper Handling of Insufficient Privileges. The product does not handle or incorrectly handles when it has insufficient privileges to perform an operation, leading to resultant weaknesses.
Near-miss passage: CWE-174 Double Decoding of the Same Data. The product decodes the same input twice, which can limit the effectiveness of any protection mechanism that occurs in between the decoding operations.
Query: write Sigma for Detects when a GitHub Pages site of a repository is made public. This usually is part of a publishing process but could
Matching passage: Sigma rule: Detects when a GitHub Pages site of a repository is made public. This usually is part of a publishing process but could. Logsource: github / audit. Rule: title: GitHub Repository Pages Site Changed to Public id: 0c46d4f4-a2bf-4104-9597-8d653fc2bb55 status: experimental description: 'Detects when a GitHub Pages site of a repository is made public. This usually is part of a publishing process but could indicate or lead to potential unauthorized exposure of sensitive information or code. ' references: - https://docs.github.com/en/pages/getting-started-with-github-pages/creating-a-github-pages-site - https://www.sentinelone.com/blog/exploiting-repos-6-ways-threat-actors-abuse-github-other-devops-platforms - https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events author: Ivan Saakov date: 2025-10-18 tags: - attack.collection - attack.exfiltration - attack.t1567.001 logsource: product: github service: audit detection: selection: action: repo.pages_public condition: selection falsepositives: - Legitimate publishing of repository pages by authorized users level: low
Near-miss passage: Sigma rule: Detects when a all the rules have been deleted from the Windows Defender Firewall configuration. Logsource: windows / firewall-as. Rule: title: All Rules Have Been Deleted From The Windows Firewall Configuration id: 79609c82-a488-426e-abcf-9f341a39365d status: test description: Detects when a all the rules have been deleted from the Windows Defender Firewall configuration references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10) author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-01-17 modified: 2024-01-22 tags: - attack.defense-impairment - attack.t1686.003 logsource: product: windows service: firewall-as detection: selection: EventID: - 2033 - 2059 filter_main_svchost: ModifyingApplication|endswith: :\Windows\System32\svchost.exe filter_optional_msmpeng: ModifyingApplication|contains|all: - :\ProgramData\Microsoft\Windows Defender\Platform\ - \MsMpEng.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* level: high
Query: campaign using SID-History Injection
Matching passage: T1134.005 SID-History Injection. Tactics: stealth, privilege escalation. Description: Adversaries may use SID-History Injection to escalate privileges and bypass access controls. The Windows security identifier (SID) is a unique value that identifies a user or group account. SIDs are used by Windows security in both security descriptors and access tokens. (Citation: Microsoft SID) An account can hold additional SIDs in the SID-History Active Directory attribute (Citation: Microsoft SID-History Attribute), allowing inter-operable account migration between domains (e.g., all values in SID-History are included in access tokens). With Domain Administrator (or equivalent) rights, harvested or well-known SID values (Citation: Microsoft Well Known SIDs Jun 2017) may be inserted into SID-History to enable impersonation of arbitrary users/groups such as Enterprise Administrators. This manipulation may result in elevated access to local resources and/or access to otherwise inaccessible domains via lateral movement techniques such as [Remote Services](https://attack.mitre.org/techniques/T1021), [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002), or [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006).
Near-miss passage: T1134.001 Token Impersonation/Theft. Tactics: stealth, privilege escalation. Description: Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. For example, an adversary can duplicate an existing token using `DuplicateToken` or `DuplicateTokenEx`.(Citation: DuplicateToken function) The token can then be used with `ImpersonateLoggedOnUser` to allow the calling thread to impersonate a logged on user's security context, or with `SetThreadToken` to assign the impersonated token to a thread. An adversary may perform [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) when they have a specific, existing process they want to assign the duplicated token to. For example, this may be useful for when the target user has a non-network logon session on the system. When an adversary would instead use a duplicated token to create a new process rather than attaching to an existing process, they can additionally [Create Process with Token](https://attack.mitre.org/techniques/T1134/002) using `CreateProcessWithTokenW` or `CreateProcessAsUserW`. [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) is also distinct from [Make and Impersonate Token](https://attack.mitre.org/techniques/T1134/003) in that it refers to duplicating an existing token, rather than creating a new one.
Query: patch priority for CVE-2015-0838
Matching passage: CVE-2015-0838. CWE: CWE-119. CVSS: 7.5. Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file.
Near-miss passage: CVE-2015-9156. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 615/16/SD 415, SD 617, SD 800, SD 808, and SD 810, when making a high speed Dual Carrier Downlink Data call in a multicell environment, a buffer overflow may occur.
Query: describe CVE-2015-4971
Matching passage: CVE-2015-4971. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Emptoris Strategic Supply Management Platform and Emptoris Program Management 10.x before 10.0.1.4_iFix3, 10.0.2.x before 10.0.2.7_iFix1, 10.0.3.x before 10.0.3.2, and 10.0.4.x before 10.0.4.0_iFix1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-9370. CWE: CWE-79. CVSS: 6.099999904632568. Invoices Add-on for iThemes Exchange before 1.4.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Query: patch priority for CVE-2015-0053
Matching passage: CVE-2015-0053. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0045.
Near-miss passage: CVE-2015-1753. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1732, CVE-2015-1742, CVE-2015-1747, and CVE-2015-1750.
Query: alert when Detects execution of the "mofcomp" utility as a child of a suspicious shell or script running utility or by having a sus
Matching passage: Sigma rule: Detects execution of the "mofcomp" utility as a child of a suspicious shell or script running utility or by having a sus. Logsource: windows / process_creation. Rule: title: Potential Suspicious Mofcomp Execution id: 1dd05363-104e-4b4a-b963-196a534b03a1 status: test description: 'Detects execution of the "mofcomp" utility as a child of a suspicious shell or script running utility or by having a suspicious path in the commandline. The "mofcomp" utility parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. Attackers abuse this utility to install malicious MOF scripts ' references: - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/ - https://github.com/The-DFIR-Report/Sigma-Rules/blob/75260568a7ffe61b2458ca05f6f25914efb44337/win_mofcomp_execution.yml - https://learn.microsoft.com/en-us/windows/win32/wmisdk/mofcomp author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-12 modified: 2023-04-11 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \mofcomp.exe - OriginalFileName: mofcomp.exe selection_case: - ParentImage|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe - \wsl.exe - \wscript.exe - \cscript.exe - CommandLine|contains: - \AppData\Local\Temp - \Users\Public\ - \WINDOWS\Temp\ - '%temp%' - '%tmp%' - '%appdata%' filter_main_wmiprvse: ParentImage: C:\Windows\System32\wbem\WmiPrvSE.exe CommandLine|contains: C:\Windows\TEMP\ CommandLine|endswith: .mof filter_optional_null_parent: CommandLine|contains: C:\Windows\TEMP\ CommandLine|endswith: .mof condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detect possible persistence using Fax DLL load when service restart. Logsource: windows / registry_set. Rule: title: Change the Fax Dll id: 9e3357ba-09d4-4fbd-a7c5-ad6386314513 status: test description: Detect possible persistence using Fax DLL load when service restart references: - https://twitter.com/dottor_morte/status/1544652325570191361 - https://raw.githubusercontent.com/RiccardoAncarani/talks/master/F-Secure/unorthodox-lateral-movement.pdf author: frack113 date: 2022-07-17 modified: 2022-12-30 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: registry_set detection: selection: TargetObject|contains|all: - \Software\Microsoft\Fax\Device Providers\ - \ImageName filter: Details: '%systemroot%\system32\fxst30.dll' condition: selection and not filter falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-5750
Matching passage: CVE-2015-5750. CWE: CWE-119. CVSS: 7.5. Data Detectors Engine in Apple OS X before 10.10.5 allows attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted series of Unicode characters.
Near-miss passage: CVE-2015-6676. CWE: CWE-119. CVSS: 10.0. Buffer overflow in Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-6678.
Query: Sigma rule for Detect file time attribute change to hide new or changes to existing files
Matching passage: Sigma rule: Detect file time attribute change to hide new or changes to existing files. Logsource: macos / process_creation. Rule: title: File Time Attribute Change id: 88c0f9d8-30a8-4120-bb6b-ebb54abcf2a0 status: test description: Detect file time attribute change to hide new or changes to existing files references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.006/T1070.006.md author: Igor Fits, Mikhail Larin, oscd.community date: 2020-10-19 modified: 2022-01-12 tags: - attack.stealth - attack.t1070.006 logsource: product: macos category: process_creation detection: selection: Image|endswith: /touch CommandLine|contains: - -t - -acmr - -d - -r condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the creation of tasks from processes executed from suspicious locations. Logsource: windows / file_event. Rule: title: Suspicious Scheduled Task Write to System32 Tasks id: 80e1f67a-4596-4351-98f5-a9c3efabac95 status: test description: Detects the creation of tasks from processes executed from suspicious locations references: - Internal Research author: Florian Roth (Nextron Systems) date: 2021-11-16 modified: 2022-01-12 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1053 logsource: product: windows category: file_event detection: selection: TargetFilename|contains: \Windows\System32\Tasks Image|contains: - \AppData\ - C:\PerfLogs - \Windows\System32\config\systemprofile condition: selection falsepositives: - Unknown level: high