alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-5833
Matching passage: CVE-2015-5833. CWE: CWE-254. CVSS: 7.199999809265137. The Login Window component in Apple OS X before 10.11 does not ensure that the screen is locked at the intended time, which allows physically proximate attackers to obtain access by visiting an unattended workstation.
Near-miss passage: CVE-2015-0832. CWE: CWE-254. CVSS: 5.0. Mozilla Firefox before 36.0 does not properly recognize the equivalence of domain names with and without a trailing . (dot) character, which allows man-in-the-middle attackers to bypass the HPKP and HSTS protection mechanisms by constructing a URL with this character and leveraging access to an X.509 certificate for a domain with this character.
Query: Sigma rule for Detects the use of Kali Linux through Windows Subsystem for Linux
Matching passage: Sigma rule: Detects the use of Kali Linux through Windows Subsystem for Linux. Logsource: windows / process_creation. Rule: title: WSL Kali-Linux Usage id: 6f1a11aa-4b8a-4b7f-9e13-4d3e4ff0e0d4 status: experimental description: Detects the use of Kali Linux through Windows Subsystem for Linux references: - https://medium.com/@redfanatic7/running-kali-linux-on-windows-51ad95166e6e - https://learn.microsoft.com/en-us/windows/wsl/install author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-10-10 tags: - attack.stealth - attack.t1202 logsource: category: process_creation product: windows detection: selection_img_appdata: - Image|contains|all: - :\Users\ - \AppData\Local\packages\KaliLinux - Image|contains|all: - :\Users\ - \AppData\Local\Microsoft\WindowsApps\kali.exe selection_img_windowsapps: Image|contains: :\Program Files\WindowsApps\KaliLinux. Image|endswith: \kali.exe selection_kali_wsl_parent: ParentImage|endswith: - \wsl.exe - \wslhost.exe selection_kali_wsl_child: - Image|contains: - \kali.exe - \KaliLinux - CommandLine|contains: - Kali.exe - Kali-linux - kalilinux filter_main_install_uninstall: CommandLine|contains: - ' -i ' - ' --install ' - ' --unregister ' condition: 1 of selection_img_* or all of selection_kali_* and not 1 of filter_main_* falsepositives: - Legitimate installation or usage of Kali Linux WSL by administrators or security teams level: high
Near-miss passage: Sigma rule: Detects the stopping of a Windows service via the "sc.exe" utility. Logsource: windows / process_creation. Rule: title: Stop Windows Service Via Sc.EXE id: 81bcb81b-5b1f-474b-b373-52c871aaa7b1 related: - id: eb87818d-db5d-49cc-a987-d5da331fbd90 type: obsolete status: test description: Detects the stopping of a Windows service via the "sc.exe" utility references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc742107(v=ws.11) author: Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2023-03-05 modified: 2024-01-18 tags: - attack.impact - attack.t1489 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: sc.exe - Image|endswith: \sc.exe selection_cli: CommandLine|contains: ' stop ' condition: all of selection_* falsepositives: - There are many legitimate reasons to stop a service. This rule isn't looking for any suspicious behavior in particular. Filter legitimate activity accordingly level: low regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_sc_stop_service/info.yml
Query: exploit OpenGL in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory 
Matching passage: CVE-2015-7066. CWE: CWE-119. CVSS: 6.800000190734863. OpenGL in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2015-7064.
Near-miss passage: CVE-2015-1171. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in GSM SIM Utility (aka SIM Card Editor) 6.6 allows remote attackers to execute arbitrary code via a long entry in a .sms file.
Query: exploit Stack-based buffer overflow in the Initialize function in an ActiveX control in IBM SPSS Statistics 19 and 20 before 20.0.0.2-IF0008, 21 before 21.0.0.2-IF0010, 22 before 22.0.0.2-
Matching passage: CVE-2015-8530. CWE: CWE-119. CVSS: 6.5. Stack-based buffer overflow in the Initialize function in an ActiveX control in IBM SPSS Statistics 19 and 20 before 20.0.0.2-IF0008, 21 before 21.0.0.2-IF0010, 22 before 22.0.0.2-IF0011, 23 before 23.0.0.3-IF0001, and 24 before 24.0.0.0-IF0003 allows remote authenticated users to execute arbitrary code via a long argument.
Near-miss passage: CVE-2015-8319. CWE: CWE-119. CVSS: 7.800000190734863. Heap-based buffer overflow in the HIFI driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230, and Mate S smartphones with software CRR-TL00 before CRR-TL00C01B160SP01, CRR-UL00 before CRR-UL00C00B160, and CRR-CL00 before CRR-CL00C92B161 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application, a different vulnerability than CVE-2015-8318.
Query: Sigma rule for Detects the creation of user-specific or system-wide environment variables via the registry. Which contains suspicious c
Matching passage: Sigma rule: Detects the creation of user-specific or system-wide environment variables via the registry. Which contains suspicious c. Logsource: windows / registry_set. Rule: title: Suspicious Environment Variable Has Been Registered id: 966315ef-c5e1-4767-ba25-fce9c8de3660 status: test description: Detects the creation of user-specific or system-wide environment variables via the registry. Which contains suspicious commands and strings references: - https://infosec.exchange/@sbousseaden/109542254124022664 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-20 modified: 2023-08-17 tags: - attack.persistence - attack.stealth logsource: product: windows category: registry_set detection: selection_main: TargetObject|contains: \Environment\ selection_details: - Details: - powershell - pwsh - Details|contains: - \AppData\Local\Temp\ - C:\Users\Public\ - TVqQAAMAAAAEAAAA - TVpQAAIAAAAEAA8A - TVqAAAEAAAAEABAA - TVoAAAAAAAAAAAAA - TVpTAQEAAAAEAAAA - SW52b2tlL - ludm9rZS - JbnZva2Ut - SQBuAHYAbwBrAGUALQ - kAbgB2AG8AawBlAC0A - JAG4AdgBvAGsAZQAtA - Details|startswith: - SUVY - SQBFAF - SQBuAH - cwBhA - aWV4 - aQBlA - R2V0 - dmFy - dgBhA - dXNpbm - H4sIA - Y21k - cABhAH - Qzpc - Yzpc condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects commandline operations on shell history files. Logsource: macos / process_creation. Rule: title: Suspicious History File Operations id: 508a9374-ad52-4789-b568-fc358def2c65 status: test description: Detects commandline operations on shell history files references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md author: Mikhail Larin, oscd.community date: 2020-10-17 modified: 2021-11-27 tags: - attack.credential-access - attack.t1552.003 logsource: product: macos category: process_creation detection: selection: CommandLine|contains: - .bash_history - .zsh_history - .zhistory - .history - .sh_history - fish_history condition: selection falsepositives: - Legitimate administrative activity - Legitimate software, cleaning hist file level: medium
Query: exploit systemstatsd in the System Stats subsystem in Apple OS X before 10.10.4 does not properly interpret data types encountered in interprocess communication, which allows attackers to 
Matching passage: CVE-2015-3718. CWE: UNKNOWN. CVSS: 6.800000190734863. systemstatsd in the System Stats subsystem in Apple OS X before 10.10.4 does not properly interpret data types encountered in interprocess communication, which allows attackers to execute arbitrary code with systemstatsd privileges via a crafted app, related to a "type confusion" issue.
Near-miss passage: CVE-2015-3121. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-3119, CVE-2015-3120, CVE-2015-3122, and CVE-2015-4433.
Query: secure coding against Creation of Temporary File With Insecure Permissions
Matching passage: CWE-378 Creation of Temporary File With Insecure Permissions. Opening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack.
Near-miss passage: CWE-1084 Invokable Control Element with Excessive File or Data Access Operations. A function or method contains too many operations that utilize a data manager or file resource.
Query: risk of Multiple cross-site scripting (XSS) vulnerabilities in ClipBucket 2.7.0.5 allow remote authenticated users to inject arbitrary web script or HTML via (1) the collection_description
Matching passage: CVE-2015-4673. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in ClipBucket 2.7.0.5 allow remote authenticated users to inject arbitrary web script or HTML via (1) the collection_description parameter to upload/manage_collections.php in an add_new action or the (2) photo_description, (3) photo_tags, or (4) photo_title parameter to upload/actions/photo_uploader.php.
Near-miss passage: CVE-2015-2933. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Html class in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via a LanguageConverter substitution string when using a language variant.
Query: explain CWE-1328
Matching passage: CWE-1328 Security Version Number Mutable to Older Versions. Security-version number in hardware is mutable, resulting in the ability to downgrade (roll-back) the boot firmware to vulnerable code versions.
Near-miss passage: CWE-781 Improper Address Validation in IOCTL with METHOD_NEITHER I/O Control Code. The product defines an IOCTL that uses METHOD_NEITHER for I/O, but it does not validate or incorrectly validates the addresses that are provided.
Query: Sigma rule for Detects BitLocker Access Agent Update Utility (baaupdate.exe) loading DLLs from suspicious locations that are publicly w
Matching passage: Sigma rule: Detects BitLocker Access Agent Update Utility (baaupdate.exe) loading DLLs from suspicious locations that are publicly w. Logsource: windows / image_load. Rule: title: BaaUpdate.exe Suspicious DLL Load id: 6e8fe0a8-ba0b-4a93-8f9e-82657e7a5984 related: - id: 9f38c1db-e2ae-40bf-81d0-5b68f73fb512 type: similar status: experimental description: 'Detects BitLocker Access Agent Update Utility (baaupdate.exe) loading DLLs from suspicious locations that are publicly writable which could indicate an attempt to lateral movement via BitLocker DCOM & COM Hijacking. This technique abuses COM Classes configured as INTERACTIVE USER to spawn processes in the context of the logged-on user''s session. Specifically, it targets the BDEUILauncher Class (CLSID ab93b6f1-be76-4185-a488-a9001b105b94) which can launch BaaUpdate.exe, which is vulnerable to COM Hijacking when started with input parameters. This allows attackers to execute code in the user''s context without needing to steal credentials or use additional techniques to compromise the account. ' references: - https://github.com/rtecCyberSec/BitlockMove author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-10-18 tags: - attack.stealth - attack.t1218 - attack.lateral-movement - attack.t1021.003 logsource: category: image_load product: windows detection: selection: Image|endswith: \BaaUpdate.exe ImageLoaded|endswith: .dll ImageLoaded|contains: - :\Perflogs\ - :\Users\Default\ - :\Users\Public\ - :\Windows\Temp\ - \AppData\Local\Temp\ - \AppData\Roaming\ - \Contacts\ - \Favorites\ - \Favourites\ - \Links\ - \Music\ - \Pictures\ - \ProgramData\ - \Temporary Internet - \Videos\ condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious sysprep process start with AppData folder as target (as used by Trojan Syndicasec in Thrip report by. Logsource: windows / process_creation. Rule: title: Sysprep on AppData Folder id: d5b9ae7a-e6fc-405e-80ff-2ff9dcc64e7e status: test description: Detects suspicious sysprep process start with AppData folder as target (as used by Trojan Syndicasec in Thrip report by Symantec) references: - https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets - https://app.any.run/tasks/61a296bb-81ad-4fee-955f-3b399f4aaf4b author: Florian Roth (Nextron Systems) date: 2018-06-22 modified: 2021-11-27 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection: Image|endswith: \sysprep.exe CommandLine|contains: \AppData\ condition: selection falsepositives: - False positives depend on scripts and administrative tools used in the monitored environment level: medium
Query: describe CVE-2015-6459
Matching passage: CVE-2015-6459. CWE: CWE-22. CVSS: 10.0. Absolute path traversal vulnerability in the download feature in FileDownloadServlet in GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise before 3.1.5 allows remote attackers to read or delete arbitrary files via a full pathname.
Near-miss passage: CVE-2015-5467. CWE: CWE-22. CVSS: 9.800000190734863. web\ViewAction in Yii (aka Yii2) 2.x before 2.0.5 allows attackers to execute any local .php file via a relative path in the view parameeter.
Query: rule covering Detects when a request to the Kubernetes API is rejected due to lack of authorization or due to an expired authenticatio
Matching passage: Sigma rule: Detects when a request to the Kubernetes API is rejected due to lack of authorization or due to an expired authenticatio. Logsource: kubernetes / audit. Rule: title: Kubernetes Unauthorized or Unauthenticated Access id: 0d933542-1f1f-420d-97d4-21b2c3c492d9 status: test description: 'Detects when a request to the Kubernetes API is rejected due to lack of authorization or due to an expired authentication token being used. This may indicate an attacker attempting to leverage credentials they have obtained. ' references: - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/ - https://www.datadoghq.com/blog/monitor-kubernetes-audit-logs/#monitor-api-authentication-issues author: kelnage date: 2024-04-12 tags: - attack.privilege-escalation logsource: product: kubernetes service: audit detection: selection: responseStatus.code: - 401 - 403 condition: selection falsepositives: - A misconfigured RBAC policy, a mistake by a valid user, or a wider issue with authentication tokens can also generate these errors. level: low
Near-miss passage: Sigma rule: Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent rem. Logsource: macos / process_creation. Rule: title: Creation Of A Local User Account id: 51719bf5-e4fd-4e44-8ba8-b830e7ac0731 status: test description: Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1136.001/T1136.001.md - https://ss64.com/osx/sysadminctl.html author: Alejandro Ortuno, oscd.community date: 2020-10-06 modified: 2023-02-18 tags: - attack.t1136.001 - attack.persistence logsource: category: process_creation product: macos detection: selection_dscl: Image|endswith: /dscl CommandLine|contains: create selection_sysadminctl: Image|endswith: /sysadminctl CommandLine|contains: addUser condition: 1 of selection_* falsepositives: - Legitimate administration activities level: low
Query: detection engineering for Email Account
Matching passage: T1087.003 Email Account. Tactics: discovery. Description: Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).(Citation: Microsoft Exchange Address Lists) In on-premises Exchange and Exchange Online, the <code>Get-GlobalAddressList</code> PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.(Citation: Microsoft getglobaladdresslist)(Citation: Black Hills Attacking Exchange MailSniper, 2016) In Google Workspace, the GAL is shared with Microsoft Outlook users through the Google Workspace Sync for Microsoft Outlook (GWSMO) service. Additionally, the Google Workspace Directory allows for users to get a listing of other users within the organization.(Citation: Google Workspace Global Access List)
Near-miss passage: T1087 Account Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., [Valid Accounts](https://attack.mitre.org/techniques/T1078)). Adversaries may use several methods to enumerate accounts, including abuse of existing tools, built-in commands, and potential misconfigurations that leak account names and roles or permissions in the targeted environment. For examples, cloud environments typically provide easily accessible interfaces to obtain user lists.(Citation: AWS List Users)(Citation: Google Cloud - IAM Servie Accounts List API) On hosts, adversaries can use default [PowerShell](https://attack.mitre.org/techniques/T1059/001) and other command line functionality to identify accounts. Information about email addresses and accounts may also be extracted by searching an infected system’s files.
Query: exploit The System V IPC implementation in the kernel in Android before 6.0 2016-01-01 allows attackers to cause a denial of service (global kernel resource consumption) by leveraging impr
Matching passage: CVE-2015-6646. CWE: CWE-399. CVSS: 6.199999809265137. The System V IPC implementation in the kernel in Android before 6.0 2016-01-01 allows attackers to cause a denial of service (global kernel resource consumption) by leveraging improper interaction between IPC resource allocation and the memory manager, aka internal bug 22300191, a different vulnerability than CVE-2015-7613.
Near-miss passage: CVE-2015-4223. CWE: CWE-399. CVSS: 5.0. Cisco IOS XR 5.1.3 allows remote attackers to cause a denial of service (process reload) via crafted MPLS Label Distribution Protocol (LDP) packets, aka Bug ID CSCuu77478.
Query: detection rule: Detects the use of IOX - a tool for port forwarding and intranet proxy purposes
Matching passage: Sigma rule: Detects the use of IOX - a tool for port forwarding and intranet proxy purposes. Logsource: windows / process_creation. Rule: title: PUA- IOX Tunneling Tool Execution id: d7654f02-e04b-4934-9838-65c46f187ebc status: test description: Detects the use of IOX - a tool for port forwarding and intranet proxy purposes references: - https://github.com/EddieIvan01/iox author: Florian Roth (Nextron Systems) date: 2022-10-08 modified: 2024-11-23 tags: - attack.command-and-control - attack.t1090 logsource: category: process_creation product: windows detection: selection: Image|endswith: \iox.exe selection_commandline: CommandLine|contains: - '.exe fwd -l ' - '.exe fwd -r ' - '.exe proxy -l ' - '.exe proxy -r ' selection_hashes: Hashes|contains: - MD5=9DB2D314DD3F704A02051EF5EA210993 - SHA1=039130337E28A6623ECF9A0A3DA7D92C5964D8DD - SHA256=C6CF82919B809967D9D90EA73772A8AA1C1EB3BC59252D977500F64F1A0D6731 condition: 1 of selection* falsepositives: - Legitimate use level: high
Near-miss passage: Sigma rule: Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22). Logsource: windows / file_event. Rule: title: UAC Bypass Using Consent and Comctl32 - File id: 62ed5b55-f991-406a-85d9-e8e8fdf18789 status: test description: Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-23 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: file_event product: windows detection: selection: TargetFilename|startswith: C:\Windows\System32\consent.exe.@ TargetFilename|endswith: \comctl32.dll condition: selection falsepositives: - Unknown level: high
Query: detection rule: Turn off logging locally or remote
Matching passage: Sigma rule: Turn off logging locally or remote. Logsource: cisco / aaa. Rule: title: Cisco Disabling Logging id: 9e8f6035-88bf-4a63-96b6-b17c0508257e status: test description: Turn off logging locally or remote references: - https://www.cisco.com/en/US/docs/ios/security/command/reference/sec_a2.pdf author: Austin Clark date: 2019-08-11 modified: 2023-01-04 tags: - attack.defense-impairment - attack.t1685 logsource: product: cisco service: aaa detection: keywords: - no logging - no aaa new-model condition: keywords falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the addition of a new LogonScript to the registry value "UserInitMprLogonScript" for potential persistence. Logsource: windows / process_creation. Rule: title: Potential Persistence Via Logon Scripts - CommandLine id: 21d856f9-9281-4ded-9377-51a1a6e2a432 related: - id: 0a98a10c-685d-4ab0-bddc-b6bdd1d48458 type: derived status: test description: Detects the addition of a new LogonScript to the registry value "UserInitMprLogonScript" for potential persistence references: - https://cocomelonc.github.io/persistence/2022/12/09/malware-pers-20.html author: Tom Ueltschi (@c_APT_ure) date: 2019-01-12 modified: 2023-06-09 tags: - attack.privilege-escalation - attack.persistence - attack.t1037.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: UserInitMprLogonScript condition: selection falsepositives: - Legitimate addition of Logon Scripts via the command line by administrators or third party tools level: high