alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit apl_42.c in ISC BIND 9.x before 9.9.8-P3, 9.9.x, and 9.10.x before 9.10.3-P3 allows remote authenticated users to cause a denial of service (INSIST assertion failure and daemon exi
Matching passage: CVE-2015-8704. CWE: CWE-20. CVSS: 6.5. apl_42.c in ISC BIND 9.x before 9.9.8-P3, 9.9.x, and 9.10.x before 9.10.3-P3 allows remote authenticated users to cause a denial of service (INSIST assertion failure and daemon exit) via a malformed Address Prefix List (APL) record.
Near-miss passage: CVE-2015-4951. CWE: CWE-20. CVSS: 5.300000190734863. Client Acceptor Daemon (CAD) in the client in IBM Spectrum Protect (formerly Tivoli Storage Manager) 5.5 and 6.x before 6.3.2.5, 6.4 before 6.4.3.1, and 7.1 before 7.1.3 allows remote attackers to cause a denial of service (daemon crash) via a crafted Web client URL.
Query: exploit SAP Content Server allows remote attackers to cause a denial of service (service termination) via unspecified vectors, aka SAP Security Note 2127995.
Matching passage: CVE-2015-4157. CWE: UNKNOWN. CVSS: 5.0. SAP Content Server allows remote attackers to cause a denial of service (service termination) via unspecified vectors, aka SAP Security Note 2127995.
Near-miss passage: CVE-2015-4769. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Firewall, a different vulnerability than CVE-2015-4767.
Query: risk of The Gateway General Packet Radio Service Support Node (GGSN) component on Cisco ASR 5000 devices with software 17.2.0.59184 and 18.0.L0.59219 allows remote attackers to cause a den
Matching passage: CVE-2015-4201. CWE: CWE-20. CVSS: 5.0. The Gateway General Packet Radio Service Support Node (GGSN) component on Cisco ASR 5000 devices with software 17.2.0.59184 and 18.0.L0.59219 allows remote attackers to cause a denial of service (Session Manager restart) via an invalid TCP/IP header, aka Bug ID CSCut68058.
Near-miss passage: CVE-2015-5568. CWE: CWE-20. CVSS: 10.0. Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to cause a denial of service (vector-length corruption) or possibly have unspecified other impact via unknown vectors.
Query: alert when Detects user authentication failure events. Please note that this rule can be noisy and it is recommended to use with co
Matching passage: Sigma rule: Detects user authentication failure events. Please note that this rule can be noisy and it is recommended to use with co. Logsource: bitbucket / audit. Rule: title: Bitbucket User Login Failure id: 70ed1d26-0050-4b38-a599-92c53d57d45a status: test description: 'Detects user authentication failure events. Please note that this rule can be noisy and it is recommended to use with correlation based on "author.name" field. ' references: - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html author: Muhammad Faisal (@faisalusuf) date: 2024-02-25 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.credential-access - attack.stealth - attack.t1078.004 - attack.t1110 logsource: product: bitbucket service: audit definition: 'Requirements: "Advance" log level is required to receive these audit events.' detection: selection: auditType.category: Authentication auditType.action: User login failed condition: selection falsepositives: - Legitimate user wrong password attempts. level: medium
Near-miss passage: Sigma rule: Detects SILENTTRINITY stager use via PE metadata. Logsource: windows / process_creation. Rule: title: HackTool - SILENTTRINITY Stager Execution id: 03552375-cc2c-4883-bbe4-7958d5a980be related: - id: 75c505b1-711d-4f68-a357-8c3fe37dbf2d type: derived status: test description: Detects SILENTTRINITY stager use via PE metadata references: - https://github.com/byt3bl33d3r/SILENTTRINITY author: Aleksey Potapov, oscd.community date: 2019-10-22 modified: 2023-02-13 tags: - attack.command-and-control - attack.t1071 logsource: category: process_creation product: windows detection: selection: Description|contains: st2stager condition: selection falsepositives: - Unlikely level: high
Query: detection rule: Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket.
Matching passage: Sigma rule: Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket.. Logsource: windows / openssh. Rule: title: OpenSSH Server Listening On Socket id: 3ce8e9a4-bc61-4c9b-8e69-d7e2492a8781 status: test description: Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket. references: - https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0008-Lateral%20Movement/T1021.004-Remote%20Service%20SSH - https://winaero.com/enable-openssh-server-windows-10/ - https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse - https://virtualizationreview.com/articles/2020/05/21/ssh-server-on-windows-10.aspx - https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16 author: mdecrevoisier date: 2022-10-25 tags: - attack.lateral-movement - attack.t1021.004 logsource: product: windows service: openssh detection: selection: EventID: 4 process: sshd payload|startswith: 'Server listening on ' condition: selection falsepositives: - Legitimate administrator activity level: medium
Near-miss passage: Sigma rule: Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. This activit. Logsource: aws / cloudtrail. Rule: title: AWS KMS Imported Key Material Usage id: 1279262f-1464-422f-ac0d-5b545320c526 status: experimental description: 'Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. This activity is uncommon and provides a high certainty signal. ' references: - https://www.chrisfarris.com/post/effective-aws-ransomware/ - https://docs.aws.amazon.com/kms/latest/developerguide/ct-importkeymaterial.html - https://docs.aws.amazon.com/kms/latest/developerguide/ct-deleteimportedkeymaterial.html author: toopricey date: 2025-10-18 tags: - attack.impact - attack.t1486 - attack.resource-development - attack.t1608.003 logsource: product: aws service: cloudtrail detection: selection: eventSource: kms.amazonaws.com eventName: - ImportKeyMaterial - DeleteImportedKeyMaterial condition: selection falsepositives: - Legitimate use cases for imported key material are rare, but may include, Organizations with hybrid cloud architectures that import external key material for compliance requirements. - Development or testing environments that simulate external key management scenarios. Even in these cases, such activity is typically infrequent and should not add significant noise. level: high
Query: exploit A vulnerability, which was classified as problematic, has been found in foxoverflow MySimplifiedSQL. This issue affects some unknown processing of the file MySimplifiedSQL_Examples
Matching passage: CVE-2015-10019. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability, which was classified as problematic, has been found in foxoverflow MySimplifiedSQL. This issue affects some unknown processing of the file MySimplifiedSQL_Examples.php. The manipulation of the argument FirstName/LastName leads to cross site scripting. The attack may be initiated remotely. The patch is named 3b7481c72786f88041b7c2d83bb4f219f77f1293. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217595.
Near-miss passage: CVE-2015-6809. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in BEdita before 3.6.0 allow remote attackers to inject arbitrary web script or HTML via the (1) cfg[projectName] parameter to index.php/admin/saveConfig, the (2) data[stats_provider_url] parameter to index.php/areas/saveArea, or the (3) data[description] parameter to index.php/areas/saveSection.
Query: vulnerability: The debugging interfaces in the kernel in Apple OS X before 10.11 allow local users to obtain sensitive memory-layout information via unspecified vectors.
Matching passage: CVE-2015-5870. CWE: CWE-200. CVSS: 2.0999999046325684. The debugging interfaces in the kernel in Apple OS X before 10.11 allow local users to obtain sensitive memory-layout information via unspecified vectors.
Near-miss passage: CVE-2015-1907. CWE: CWE-200. CVSS: 4.0. The Administration and Reporting Tool in IBM Rational License Key Server (RLKS) 8.1.4 before 8.1.4.7 allows remote authenticated users to read cookies via unspecified vectors.
Query: exploit The convenience initializer in the Multipeer Connectivity component in Apple iOS before 9 does not require an encrypted session, which allows local users to obtain cleartext multip
Matching passage: CVE-2015-5851. CWE: CWE-200. CVSS: 2.0999999046325684. The convenience initializer in the Multipeer Connectivity component in Apple iOS before 9 does not require an encrypted session, which allows local users to obtain cleartext multipeer data via an encrypted-to-unencrypted downgrade attack.
Near-miss passage: CVE-2015-4543. CWE: CWE-200. CVSS: 4.0. EMC RSA Archer GRC 5.x before 5.5.3 uses cleartext for stored passwords in unspecified circumstances, which allows remote authenticated users to obtain sensitive information by reading database fields.
Query: describe CVE-2015-7875
Matching passage: CVE-2015-7875. CWE: CWE-264. CVSS: 7.5. ctools 6.x-1.x before 6.x-1.14 and 7.x-1.x before 7.x-1.8 in Drupal does not verify the "edit" permission for the "content type" plugins that are used on Panels and similar systems to place content and functionality on a page.
Near-miss passage: CVE-2015-5633. CWE: CWE-264. CVSS: 6.800000190734863. The Newphoria Auction Camera application for iOS and before 1.2 for Android allows attackers to bypass a URL whitelist protection mechanism and obtain API access via unspecified vectors.
Query: alert when Detects a powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records.
Matching passage: Sigma rule: Detects a powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records.. Logsource: windows / ps_classic_start. Rule: title: Nslookup PowerShell Download Cradle id: 999bff6d-dc15-44c9-9f5c-e1051bfc86e1 related: - id: 1b3b01c7-84e9-4072-86e5-fc285a41ff23 type: similar status: test description: Detects a powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records. references: - https://twitter.com/Alh4zr3d/status/1566489367232651264 author: Sai Prashanth Pulisetti @pulisettis, Aishwarya Singam date: 2022-12-10 modified: 2025-02-25 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_classic_start detection: selection: Data|contains|all: - powershell - nslookup - '[1]' Data|contains: - -q=txt http - -querytype=txt http - -type=txt http condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class over the network. Logsource: windows / file_event. Rule: title: Potential DCOM InternetExplorer.Application DLL Hijack id: 2f7979ae-f82b-45af-ac1d-2b10e93b0baa related: - id: e554f142-5cf3-4e55-ace9-a1b59e0def65 type: obsolete - id: f354eba5-623b-450f-b073-0b5b2773b6aa type: similar status: test description: Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class over the network references: - https://threathunterplaybook.com/hunts/windows/201009-RemoteDCOMIErtUtilDLLHijack/notebook.html author: Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR), wagga date: 2020-10-12 modified: 2022-12-18 tags: - attack.lateral-movement - attack.t1021.002 - attack.t1021.003 logsource: product: windows category: file_event detection: selection: Image: System TargetFilename|endswith: \Internet Explorer\iertutil.dll condition: selection falsepositives: - Unknown level: critical
Query: Persistence mechanism resembling Regsvcs/Regasm
Matching passage: T1218.009 Regsvcs/Regasm. Tactics: stealth. Description: Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) assemblies. Both are binaries that may be digitally signed by Microsoft. (Citation: MSDN Regsvcs) (Citation: MSDN Regasm) Both utilities may be used to bypass application control through use of attributes within the binary to specify code that should be run before registration or unregistration: <code>[ComRegisterFunction]</code> or <code>[ComUnregisterFunction]</code> respectively. The code with the registration and unregistration attributes will be executed even if the process is run under insufficient privileges and fails to execute. (Citation: LOLBAS Regsvcs)(Citation: LOLBAS Regasm)
Near-miss passage: T1218.004 InstallUtil. Tactics: stealth. Description: Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. (Citation: MSDN InstallUtil) The InstallUtil binary may also be digitally signed by Microsoft and located in the .NET directories on a Windows system: <code>C:\Windows\Microsoft.NET\Framework\v<version>\InstallUtil.exe</code> and <code>C:\Windows\Microsoft.NET\Framework64\v<version>\InstallUtil.exe</code>. InstallUtil may also be used to bypass application control through use of attributes within the binary that execute the class decorated with the attribute <code>[System.ComponentModel.RunInstaller(true)]</code>. (Citation: LOLBAS Installutil)
Query: CWE for Doubled Character XSS Manipulations
Matching passage: CWE-85 Doubled Character XSS Manipulations. The web application does not filter user-controlled input for executable script disguised using doubling of the involved characters.
Near-miss passage: CWE-603 Use of Client-Side Authentication. A client/server product performs authentication within client code but not in server code, allowing server-side authentication to be bypassed via a modified client that omits the authentication check.
Query: telemetry for T1686.002
Matching passage: T1686.002 Network Device Firewall. Tactics: defense impairment. Description: Adversaries may disable network device-based firewall mechanisms entirely or add, delete, or modify particular rules in order to bypass controls limiting network usage. Adversaries may obtain access to devices such as routers, switches, or other perimeter/network devices and change access control lists (ACLs), security zones, or policy rules to permit otherwise blocked traffic. For example, adversaries may add new network firewall rules to allow access to all internal network subnets without restrictions. Allowing access to internal network subsets may enable unrestricted inbound/outbound connectivity or open paths for command and control and lateral movement. Adversaries may obtain access to network device management interfaces via [Valid Accounts](https://attack.mitre.org/techniques/T1078) or by exploiting vulnerabilities. In some cases, threat actors may target firewalls and other network infrastructure that are exposed to the internet by leveraging weaknesses in public-facing applications ([Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)).(Citation: CVE-2024-55591 Detail) Adversaries may also modify host networking configurations that indirectly manipulate system firewalls, such as adjusting interface bandwidth or network connection request thresholds.
Near-miss passage: T1686.001 Cloud Firewall. Tactics: defense impairment. Description: Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources. Cloud environments typically utilize restrictive security groups and firewall rules that only allow network activity from trusted IP addresses via expected ports and protocols. An adversary with appropriate permissions may introduce new firewall rules or policies to allow access into a victim cloud environment and/or move laterally from the cloud control plane to the data plane. For example, an adversary may use a script or utility that creates new ingress rules in existing security groups (or creates new security groups entirely) to allow any TCP/IP connectivity to a cloud-hosted instance. They may also remove networking limitations to support traffic associated with malicious activity (such as cryptomining).(Citation: Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022)(Citation: Expel AWS)
Query: detect Detects suspicious use of 'calc.exe' with command line parameters or in a suspicious directory, which is likely caused b in logs
Matching passage: Sigma rule: Detects suspicious use of 'calc.exe' with command line parameters or in a suspicious directory, which is likely caused b. Logsource: windows / process_creation. Rule: title: Suspicious Calculator Usage id: 737e618a-a410-49b5-bec3-9e55ff7fbc15 status: test description: 'Detects suspicious use of ''calc.exe'' with command line parameters or in a suspicious directory, which is likely caused by some PoC or detection evasion. ' references: - https://twitter.com/ItsReallyNick/status/1094080242686312448 author: Florian Roth (Nextron Systems) date: 2019-02-09 modified: 2023-11-09 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection_1: CommandLine|contains: '\calc.exe ' selection_2: Image|endswith: \calc.exe filter_main_known_locations: Image|contains: - :\Windows\System32\ - :\Windows\SysWOW64\ - :\Windows\WinSxS\ condition: selection_1 or ( selection_2 and not filter_main_known_locations ) falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects outlvba (Microsoft VBA for Outlook Addin) DLL being loaded by the outlook process. Logsource: windows / image_load. Rule: title: Microsoft VBA For Outlook Addin Loaded Via Outlook id: 9a0b8719-cd3c-4f0a-90de-765a4cb3f5ed status: test description: Detects outlvba (Microsoft VBA for Outlook Addin) DLL being loaded by the outlook process references: - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=58 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-08 modified: 2024-03-12 tags: - attack.execution - attack.t1204.002 logsource: category: image_load product: windows detection: selection: Image|endswith: \outlook.exe ImageLoaded|endswith: \outlvba.dll condition: selection falsepositives: - Legitimate macro usage. Add the appropriate filter according to your environment level: medium
Query: patch priority for CVE-2015-5641
Matching passage: CVE-2015-5641. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in baserCMS before 3.0.8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-7857. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the getListQuery function in administrator/components/com_contenthistory/models/history.php in Joomla! 3.2 before 3.4.5 allows remote attackers to execute arbitrary SQL commands via the list[select] parameter to index.php.
Query: vulnerability: The document.cookie API implementation in the CFNetwork Cookies subsystem in WebKit in Apple iOS before 9 allows remote attackers to bypass an intended single-cookie restriction vi
Matching passage: CVE-2015-3801. CWE: CWE-264. CVSS: 5.0. The document.cookie API implementation in the CFNetwork Cookies subsystem in WebKit in Apple iOS before 9 allows remote attackers to bypass an intended single-cookie restriction via unspecified vectors.
Near-miss passage: CVE-2015-6607. CWE: CWE-264. CVSS: 6.800000190734863. SQLite before 3.8.9, as used in Android before 5.1.1 LMY48T, allows attackers to gain privileges via a crafted application, aka internal bug 20099586.
Query: CVE similar to CVE-2015-1995
Matching passage: CVE-2015-1995. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 allow remote attackers to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-9397. CWE: CWE-79. CVSS: 5.400000095367432. The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php deletegc XSS.
Query: risk of Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or caus
Matching passage: CVE-2015-3043. CWE: CWE-787. CVSS: 9.800000190734863. Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, as exploited in the wild in April 2015, a different vulnerability than CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, and CVE-2015-3042.
Near-miss passage: CVE-2015-2425. CWE: CWE-787. CVSS: 8.800000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2383 and CVE-2015-2384.
Query: hunt for Application Layer Protocol activity
Matching passage: T1071 Application Layer Protocol. Tactics: command and control. Description: Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.(Citation: Mandiant APT29 Eye Spy Email Nov 22)
Near-miss passage: T1071.004 DNS. Tactics: command and control. Description: Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. The DNS protocol serves an administrative function in computer networking and thus may be very common in environments. DNS traffic may also be allowed even before network authentication is completed. DNS packets contain many fields and headers in which data can be concealed. Often known as DNS tunneling, adversaries may abuse DNS to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.(Citation: PAN DNS Tunneling)(Citation: Medium DnsTunneling) DNS beaconing may be used to send commands to remote systems via DNS queries. A DNS beacon is created by tunneling DNS traffic (i.e. [Protocol Tunneling](https://attack.mitre.org/techniques/T1572)). The commands may be embedded into different DNS records, for example, TXT or A records.(Citation: OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government) DNS beacons may be difficult to detect because the beacons infrequently communicate with infected devices.(Citation: DNS Beacons) Infrequent communication conceals the malicious DNS traffic with normal DNS traffic.