alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit The Fieldable Panels Panes module 7.x-1.x before 7.x-1.7 for Drupal does not properly check permissions to edit Fieldable Panels Panes entities, which allows remote authenticated u
Matching passage: CVE-2015-7227. CWE: CWE-264. CVSS: 3.5. The Fieldable Panels Panes module 7.x-1.x before 7.x-1.7 for Drupal does not properly check permissions to edit Fieldable Panels Panes entities, which allows remote authenticated users to edit panes by leveraging permissions to edit panels.
Near-miss passage: CVE-2015-1702. CWE: CWE-264. CVSS: 6.900000095367432. The Service Control Manager (SCM) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly constrain impersonation levels, which allows local users to gain privileges via a crafted application, aka "Service Control Manager Elevation of Privilege Vulnerability."
Query: patch priority for CVE-2015-2149
Matching passage: CVE-2015-2149. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in the administrative backend in MyBB (aka MyBulletinBoard) before 1.8.4 allow remote authenticated users to inject arbitrary web script or HTML via the (1) MIME-type field in an add action in the config-attachment_types module to admin/index.php; (2) title or (3) short description field in an add action in the (a) config-mycode or (b) user-groups module to admin/index.php; (4) title field in an add action in the (c) forum-management or (d) tool-tasks module to admin/index.php; (5) name field in an add_set action in the style-templates module to admin/index.php; (6) title field in an add_template_group action in the style-templates module to admin/index.php; (7) name field in an add action in the config-post_icons module to admin/index.php; (8) "title to assign" field in an add action in the user-titles module to admin/index.php; or (9) username field in the config-banning module to admin/index.php.
Near-miss passage: CVE-2015-2043. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Visualware MyConnection Server 8.2b allow remote attackers to inject arbitrary web script or HTML via the (1) bt, (2) variable, or (3) et parameter to myspeed/db/historyitem.
Query: rule covering Detects a Chromium based browser process with the 'load-extension' flag to start a instance with a custom extension
Matching passage: Sigma rule: Detects a Chromium based browser process with the 'load-extension' flag to start a instance with a custom extension. Logsource: windows / process_creation. Rule: title: Chromium Browser Instance Executed With Custom Extension id: 88d6e60c-759d-4ac1-a447-c0f1466c2d21 related: - id: 27ba3207-dd30-4812-abbf-5d20c57d474e type: similar status: test description: Detects a Chromium based browser process with the 'load-extension' flag to start a instance with a custom extension references: - https://redcanary.com/blog/chromeloader/ - https://emkc.org/s/RJjuLa - https://www.mandiant.com/resources/blog/lnk-between-browsers author: Aedan Russell, frack113, X__Junior (Nextron Systems) date: 2022-06-19 modified: 2023-11-28 tags: - attack.persistence - attack.t1176.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \brave.exe - \chrome.exe - \msedge.exe - \opera.exe - \vivaldi.exe CommandLine|contains: --load-extension= condition: selection falsepositives: - Usage of Chrome Extensions in testing tools such as BurpSuite will trigger this alert level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_chromium_load_extension/info.yml
Near-miss passage: Sigma rule: Detects code execution via Pester.bat (Pester - Powershell Modulte for testing). Logsource: windows / process_creation. Rule: title: Execute Code with Pester.bat id: 59e938ff-0d6d-4dc3-b13f-36cc28734d4e status: test description: Detects code execution via Pester.bat (Pester - Powershell Modulte for testing) references: - https://twitter.com/Oddvarmoe/status/993383596244258816 - https://github.com/api0cradle/LOLBAS/blob/d148d278f5f205ce67cfaf49afdfb68071c7252a/OSScripts/pester.md author: Julia Fomina, oscd.community date: 2020-10-08 modified: 2023-11-09 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1216 logsource: category: process_creation product: windows detection: powershell_module: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains|all: - Pester - Get-Help cmd_execution: Image|endswith: \cmd.exe CommandLine|contains|all: - pester - ; get_help: CommandLine|contains: - help - \? condition: powershell_module or (cmd_execution and get_help) falsepositives: - Legitimate use of Pester for writing tests for Powershell scripts and modules level: medium
Query: vulnerability: Moxa SoftCMS 1.3 and prior is susceptible to a buffer overflow condition that may crash or allow remote code execution. Moxa released SoftCMS version 1.4 on June 1, 2015, to addres
Matching passage: CVE-2015-6458. CWE: CWE-120. CVSS: 8.800000190734863. Moxa SoftCMS 1.3 and prior is susceptible to a buffer overflow condition that may crash or allow remote code execution. Moxa released SoftCMS version 1.4 on June 1, 2015, to address the vulnerability.
Near-miss passage: CVE-2015-5524. CWE: CWE-120. CVSS: 9.800000190734863. An issue was discovered on Samsung mobile devices with KK(4.4) and later software through 2015-05-13. There is a buffer overflow in datablock_write because the amount of received data is not validated. The Samsung ID is SVE-2015-4018 (December 2015).
Query: patch priority for CVE-2015-1708
Matching passage: CVE-2015-1708. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-2491. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2485 and CVE-2015-2541.
Query: CVE similar to CVE-2015-1147
Matching passage: CVE-2015-1147. CWE: CWE-200. CVSS: 5.0. Open Directory Client in Apple OS X before 10.10.3 sends unencrypted password-change requests in certain circumstances involving missing certificates, which allows remote attackers to obtain sensitive information by sniffing the network.
Near-miss passage: CVE-2015-6626. CWE: CWE-200. CVSS: 5.0. libstagefright in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 24310423.
Query: vulnerability: Apple iOS before 9.2, OS X before 10.11.2, and tvOS before 9.1 improperly validate keychain item ACLs, which allows attackers to obtain access to keychain items via a crafted app.
Matching passage: CVE-2015-7058. CWE: CWE-200. CVSS: 4.300000190734863. Apple iOS before 9.2, OS X before 10.11.2, and tvOS before 9.1 improperly validate keychain item ACLs, which allows attackers to obtain access to keychain items via a crafted app.
Near-miss passage: CVE-2015-5267. CWE: CWE-200. CVSS: 7.5. lib/moodlelib.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 relies on the PHP mt_rand function to implement the random_string and complex_random_string functions, which makes it easier for remote attackers to predict password-recovery tokens via a brute-force approach.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the execution of "csvde.exe" in order to export organizational Active Directory structure.. Logsource: windows / process_creation. Rule: title: Active Directory Structure Export Via Csvde.EXE id: e5d36acd-acb4-4c6f-a13f-9eb203d50099 status: test description: Detects the execution of "csvde.exe" in order to export organizational Active Directory structure. references: - https://www.cybereason.com/blog/research/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms - https://web.archive.org/web/20180725233601/https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf - https://businessinsights.bitdefender.com/deep-dive-into-a-backdoordiplomacy-attack-a-study-of-an-attackers-toolkit - https://redcanary.com/blog/msix-installers/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-03-14 tags: - attack.exfiltration - attack.discovery - attack.t1087.002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \csvde.exe - OriginalFileName: csvde.exe selection_remote: CommandLine|contains: ' -f' filter_import: CommandLine|contains: ' -i' condition: all of selection_* and not 1 of filter_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: A General detection for WebDav user-agent being used to PUT files on a WebDav network share. This could be an indicator. Logsource: zeek / http. Rule: title: WebDav Put Request id: 705072a5-bb6f-4ced-95b6-ecfa6602090b status: test description: A General detection for WebDav user-agent being used to PUT files on a WebDav network share. This could be an indicator of exfiltration. references: - https://github.com/OTRF/detection-hackathon-apt29/issues/17 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-05-02 modified: 2024-03-13 tags: - attack.exfiltration - attack.t1048.003 logsource: product: zeek service: http detection: selection: user_agent|contains: WebDAV method: PUT filter: id.resp_h|cidr: - 10.0.0.0/8 - 127.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 condition: selection and not filter falsepositives: - Unknown level: low
Query: patch priority for CVE-2015-4543
Matching passage: CVE-2015-4543. CWE: CWE-200. CVSS: 4.0. EMC RSA Archer GRC 5.x before 5.5.3 uses cleartext for stored passwords in unspecified circumstances, which allows remote authenticated users to obtain sensitive information by reading database fields.
Near-miss passage: CVE-2015-6059. CWE: CWE-200. CVSS: 4.300000190734863. The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Scripting Engine Information Disclosure Vulnerability."
Query: CVE similar to CVE-2015-8224
Matching passage: CVE-2015-8224. CWE: CWE-200. CVSS: 3.700000047683716. Huawei P8 before GRA-CL00C92B210, before GRA-L09C432B200, before GRA-TL00C01B210, and before GRA-UL00C00B210 allows remote attackers to obtain user equipment (aka UE) measurements of signal strengths.
Near-miss passage: CVE-2015-7946. CWE: CWE-200. CVSS: 4.599999904632568. Information Exposure vulnerability in Unity8 as used on the Ubuntu phone and possibly also in Unity8 shipped elsewhere. This allows an attacker to enable the MTP service by opening the emergency dialer. Fixed in 8.11+16.04.20160111.1-0ubuntu1 and 8.11+15.04.20160122-0ubuntu1.
Query: risk of Unspecified vulnerability in the Oracle Sourcing component in Oracle E-Business Suite 12.1.1, 12.1.2, 12.1.3, 12.2.3, and 12.2.4 allows remote authenticated users to affect confide
Matching passage: CVE-2015-4728. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Oracle Sourcing component in Oracle E-Business Suite 12.1.1, 12.1.2, 12.1.3, 12.2.3, and 12.2.4 allows remote authenticated users to affect confidentiality via unknown vectors related to Bid/Quote creation.
Near-miss passage: CVE-2015-2767. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in Websense TRITON AP-EMAIL before 8.0.0 has unknown impact and attack vectors, related to "Autocomplete Enabled."
Query: exploit SQL injection vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX004, and 7.6.0 before 7.6.0.1 IFIX002; Maximo Asset Management 7.5.x befor
Matching passage: CVE-2015-4967. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX004, and 7.6.0 before 7.6.0.1 IFIX002; Maximo Asset Management 7.5.x before 7.5.0.8 IFIX004 and 7.6.0 before 7.6.0.1 IFIX002 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-9098. CWE: CWE-89. CVSS: 9.800000190734863. In Redgate SQL Monitor before 3.10 and 4.x before 4.2, a remote attacker can gain unauthenticated access to the Base Monitor, resulting in the ability to execute arbitrary SQL commands on any monitored Microsoft SQL Server machines. If the Base Monitor is connecting to these machines using an account with SQL admin privileges, then code execution on the operating system can result in full system compromise (if Microsoft SQL Server is running with local administrator privileges).
Query: CVE similar to CVE-2015-5243
Matching passage: CVE-2015-5243. CWE: CWE-94. CVSS: 9.800000190734863. phpWhois allows remote attackers to execute arbitrary code via a crafted whois record.
Near-miss passage: CVE-2015-1696. CWE: CWE-94. CVSS: 9.300000190734863. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted Journal file, aka "Windows Journal Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-1675, CVE-2015-1695, CVE-2015-1697, CVE-2015-1698, and CVE-2015-1699.
Query: vulnerability: Multiple SQL injection vulnerabilities in u5CMS before 3.9.4 allow remote attackers to execute arbitrary SQL commands via the name parameter to (1) copy2.php, (2) localize.php, (3)
Matching passage: CVE-2015-1576. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in u5CMS before 3.9.4 allow remote attackers to execute arbitrary SQL commands via the name parameter to (1) copy2.php, (2) localize.php, (3) metai.php, (4) nc.php, (5) new2.php, or (6) rename2.php in u5admin/; (7) c parameter to u5admin/editor.php; (8) typ parameter to u5admin/meta2.php; or (9) newname parameter to u5admin/rename2.php.
Near-miss passage: CVE-2015-1000011. CWE: CWE-89. CVSS: 9.800000190734863. Blind SQL Injection in wordpress plugin dukapress v2.5.9
Query: Sigma rule for Detects the creation of a ISO file in the Outlook temp folder or in the Appdata temp folder. Typical of Qakbot TTP from
Matching passage: Sigma rule: Detects the creation of a ISO file in the Outlook temp folder or in the Appdata temp folder. Typical of Qakbot TTP from. Logsource: windows / file_event. Rule: title: ISO File Created Within Temp Folders id: 2f9356ae-bf43-41b8-b858-4496d83b2acb status: test description: Detects the creation of a ISO file in the Outlook temp folder or in the Appdata temp folder. Typical of Qakbot TTP from end-July 2022. references: - https://twitter.com/Sam0x90/status/1552011547974696960 - https://securityaffairs.co/wordpress/133680/malware/dll-sideloading-spread-qakbot.html - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image author: '@sam0x90' date: 2022-07-30 tags: - attack.initial-access - attack.t1566.001 logsource: category: file_event product: windows detection: selection_1: TargetFilename|contains|all: - \AppData\Local\Temp\ - .zip\ TargetFilename|endswith: .iso selection_2: TargetFilename|contains: \AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\ TargetFilename|endswith: .iso condition: 1 of selection* falsepositives: - Potential FP by sysadmin opening a zip file containing a legitimate ISO file level: high
Near-miss passage: Sigma rule: Detects execution of rundll32 where the DLL being called is stored in an Alternate Data Stream (ADS).. Logsource: windows / process_creation. Rule: title: Potential Rundll32 Execution With DLL Stored In ADS id: 9248c7e1-2bf3-4661-a22c-600a8040b446 status: test description: Detects execution of rundll32 where the DLL being called is stored in an Alternate Data Stream (ADS). references: - https://lolbas-project.github.io/lolbas/Binaries/Rundll32 author: Harjot Singh, '@cyb3rjy0t' date: 2023-01-21 modified: 2026-03-16 tags: - attack.stealth - attack.t1564.004 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE selection_cli: CommandLine|re: '[Rr][Uu][Nn][Dd][Ll][Ll]32(?:\.[Ee][Xx][Ee])? \S+?\w:\S+?:' condition: all of selection_* falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-4837
Matching passage: CVE-2015-4837. CWE: UNKNOWN. CVSS: 6.599999904632568. Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Utility/Security.
Near-miss passage: CVE-2015-2629. CWE: UNKNOWN. CVSS: 9.0. Unspecified vulnerability in the Java VM component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-0457.
Query: patch priority for CVE-2015-6582
Matching passage: CVE-2015-6582. CWE: CWE-254. CVSS: 6.800000190734863. The decompose function in platform/transforms/TransformationMatrix.cpp in Blink, as used in Google Chrome before 45.0.2454.85, does not verify that a matrix inversion succeeded, which allows remote attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted web site.
Near-miss passage: CVE-2015-0009. CWE: CWE-254. CVSS: 3.299999952316284. The Group Policy Security Configuration policy implementation in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows man-in-the-middle attackers to disable a signing requirement and trigger a revert-to-default action by spoofing domain-controller responses, aka "Group Policy Security Feature Bypass Vulnerability."
Query: patch priority for CVE-2015-6107
Matching passage: CVE-2015-6107. CWE: CWE-119. CVSS: 9.300000190734863. The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10 Gold and 1511, Office 2007 SP3, Office 2010 SP2, Word Viewer, Skype for Business 2016, Lync 2010, Lync 2013 SP1, and Live Meeting 2007 Console allows remote attackers to execute arbitrary code via a crafted embedded font, aka "Graphics Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-5877. CWE: CWE-119. CVSS: 7.199999809265137. The Intel Graphics Driver component in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5830.
Query: rule covering Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspici
Matching passage: Sigma rule: Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspici. Logsource: linux / process_creation. Rule: title: Suspicious Git Clone - Linux id: cfec9d29-64ec-4a0f-9ffe-0fdb856d5446 status: test description: Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspicious references: - https://gist.githubusercontent.com/MichaelKoczwara/12faba9c061c12b5814b711166de8c2f/raw/e2068486692897b620c25fde1ea258c8218fe3d3/history.txt author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-03 modified: 2023-01-05 tags: - attack.reconnaissance - attack.t1593.003 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: /git CommandLine|contains: ' clone ' selection_keyword: CommandLine|contains: - exploit - Vulns - vulnerability - RCE - RemoteCodeExecution - Invoke- - CVE- - poc- - ProofOfConcept - proxyshell - log4shell - eternalblue - eternal-blue - MS17- condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects LOLBINs executing from an abnormal or uncommon drive such as a mounted ISO.. Logsource: windows / process_creation. Rule: title: LOLBIN Execution From Abnormal Drive id: d4ca7c59-e9e4-42d8-bf57-91a776efcb87 related: - id: 5b80cf53-3a46-4adc-960b-05ec19348d74 type: similar status: test description: Detects LOLBINs executing from an abnormal or uncommon drive such as a mounted ISO. references: - https://thedfirreport.com/2021/12/13/diavol-ransomware/ - https://www.scythe.io/library/threat-emulation-qakbot - https://sec-consult.com/blog/detail/bumblebee-hunting-with-a-velociraptor/ author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Angelo Violetti - SEC Consult '@angelo_violetti', Aaron Herman date: 2022-01-25 modified: 2023-08-29 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: - Image|endswith: - \calc.exe - \certutil.exe - \cmstp.exe - \cscript.exe - \installutil.exe - \mshta.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe - OriginalFileName: - CALC.EXE - CertUtil.exe - CMSTP.EXE - cscript.exe - installutil.exe - MSHTA.EXE - REGSVR32.EXE - RUNDLL32.EXE - wscript.exe filter_main_currentdirectory: CurrentDirectory|contains: C:\ filter_main_empty: CurrentDirectory: '' filter_main_null: CurrentDirectory: null condition: selection and not 1 of filter_main_* falsepositives: - Rare false positives could occur on servers with multiple drives. level: medium