alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit SAP Mobile Platform 3.0 SP05 ClientHub allows attackers to obtain the keystream and other sensitive information via the DataVault, aka SAP Security Note 2094830.
Matching passage: CVE-2015-7731. CWE: CWE-200. CVSS: 5.5. SAP Mobile Platform 3.0 SP05 ClientHub allows attackers to obtain the keystream and other sensitive information via the DataVault, aka SAP Security Note 2094830.
Near-miss passage: CVE-2015-5041. CWE: CWE-200. CVSS: 9.100000381469727. The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20, 7 before SR9 FP30, and 7 R1 before SR3 FP30 allows remote attackers to obtain sensitive information or inject data by invoking non-public interface methods.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the execution of Winrs.exe where it is used to execute commands locally. Commands executed this way are launched. Logsource: windows / process_creation. Rule: title: Winrs Local Command Execution id: bcfece3d-56fe-4545-9931-3b8e92927db1 status: experimental description: 'Detects the execution of Winrs.exe where it is used to execute commands locally. Commands executed this way are launched under Winrshost.exe and can represent proxy execution used for defense evasion or lateral movement. ' references: - https://cardinalops.com/blog/living-off-winrm-abusing-complexity-in-remote-management/ - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/winrs author: Liran Ravich, Nasreddine Bencherchali date: 2025-10-22 tags: - attack.lateral-movement - attack.stealth - attack.t1021.006 - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \winrs.exe - OriginalFileName: winrs.exe selection_local_ip: CommandLine|contains|windash: - /r:localhost - /r:127.0.0.1 - /r:[::1] - /remote:localhost - /remote:127.0.0.1 - /remote:[::1] filter_main_remote: CommandLine|contains|windash: - '/r:' - '/remote:' condition: all of selection_* or (selection_img and not 1 of filter_main_*) falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Monitor and alert for Sign-ins by unknown devices from non-Trusted locations.. Logsource: azure / signinlogs. Rule: title: Sign-ins by Unknown Devices id: 4d136857-6a1a-432a-82fc-5dd497ee5e7c status: test description: Monitor and alert for Sign-ins by unknown devices from non-Trusted locations. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#non-compliant-device-sign-in author: Michael Epping, '@mepples21' date: 2022-06-28 modified: 2022-10-05 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078.004 logsource: product: azure service: signinlogs detection: selection: AuthenticationRequirement: singleFactorAuthentication ResultType: 0 NetworkLocationDetails: '[]' DeviceDetail.deviceId: '' condition: selection falsepositives: - Unknown level: low
Query: Multiple failed authentications followed by Wi-Fi Discovery
Matching passage: T1016.002 Wi-Fi Discovery. Tactics: discovery. Description: Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems. Adversaries may use Wi-Fi information as part of [Account Discovery](https://attack.mitre.org/techniques/T1087), [Remote System Discovery](https://attack.mitre.org/techniques/T1018), and other discovery or [Credential Access](https://attack.mitre.org/tactics/TA0006) activity to support both ongoing and future campaigns. Adversaries may collect various types of information about Wi-Fi networks from hosts. For example, on Windows names and passwords of all Wi-Fi networks a device has previously connected to may be available through `netsh wlan show profiles` to enumerate Wi-Fi names and then `netsh wlan show profile “Wi-Fi name” key=clear` to show a Wi-Fi network’s corresponding password.(Citation: BleepingComputer Agent Tesla steal wifi passwords)(Citation: Malware Bytes New AgentTesla variant steals WiFi credentials)(Citation: Check Point APT35 CharmPower January 2022) Additionally, names and other details of locally reachable Wi-Fi networks can be discovered using calls to `wlanAPI.dll` [Native API](https://attack.mitre.org/techniques/T1106) functions.(Citation: Binary Defense Emotes Wi-Fi Spreader) On Linux, names and passwords of all Wi-Fi-networks a device has previously connected to may be available in files under ` /etc/NetworkManager/system-connections/`.(Citation: Wi-Fi Password of All Connected Networks in Windows/Linux) On macOS, the password of a known Wi-Fi may be identified with ` security find-generic-password -wa wifiname` (requires admin username/password).(Citation: Find Wi-Fi Password on Mac)
Near-miss passage: T1016.001 Internet Connection Discovery. Tactics: discovery. Description: Adversaries may check for Internet connectivity on compromised systems. This may be performed during automated discovery and can be accomplished in numerous ways such as using [Ping](https://attack.mitre.org/software/S0097), <code>tracert</code>, and GET requests to websites, or performing initial speed testing to confirm bandwidth. Adversaries may use the results and responses from these requests to determine if the system is capable of communicating with their C2 servers before attempting to connect to them. The results may also be used to identify routes, redirectors, and proxy servers.
Query: CVE similar to CVE-2015-7684
Matching passage: CVE-2015-7684. CWE: UNKNOWN. CVSS: 9.0. Unrestricted file upload in GLPI before 0.85.3 allows remote authenticated users to execute arbitrary code by adding a file with an executable extension as an attachment to a new ticket, then accessing it via a direct request to the file in files/_tmp/.
Near-miss passage: CVE-2015-0460. CWE: UNKNOWN. CVSS: 9.300000190734863. Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.
Query: CVE similar to CVE-2015-9262
Matching passage: CVE-2015-9262. CWE: CWE-119. CVSS: 9.800000190734863. _XcursorThemeInherits in library.c in libXcursor before 1.1.15 allows remote attackers to cause denial of service or potentially code execution via a one-byte heap overflow.
Near-miss passage: CVE-2015-5588. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5575, CVE-2015-5577, CVE-2015-5578, CVE-2015-5580, CVE-2015-5582, and CVE-2015-6677.
Query: detection rule: Identifies the suspicious use of AssumeRole. Attackers could move laterally and escalate privileges.
Matching passage: Sigma rule: Identifies the suspicious use of AssumeRole. Attackers could move laterally and escalate privileges.. Logsource: aws / cloudtrail. Rule: title: AWS STS AssumeRole Misuse id: 905d389b-b853-46d0-9d3d-dea0d3a3cd49 status: test description: Identifies the suspicious use of AssumeRole. Attackers could move laterally and escalate privileges. references: - https://github.com/elastic/detection-rules/pull/1214 - https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html author: Austin Songer @austinsonger date: 2021-07-24 modified: 2022-10-09 tags: - attack.lateral-movement - attack.privilege-escalation - attack.t1548 - attack.t1550 - attack.t1550.001 logsource: product: aws service: cloudtrail detection: selection: userIdentity.type: AssumedRole userIdentity.sessionContext.sessionIssuer.type: Role condition: selection falsepositives: - AssumeRole may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - AssumeRole from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule. - Automated processes that uses Terraform may lead to false positives. level: low
Near-miss passage: Sigma rule: Detects suspicious execution of 'Powercfg.exe' to change lock screen timeout. Logsource: windows / process_creation. Rule: title: Suspicious Powercfg Execution To Change Lock Screen Timeout id: f8d6a15e-4bc8-4c27-8e5d-2b10f0b73e5b status: test description: Detects suspicious execution of 'Powercfg.exe' to change lock screen timeout references: - https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html - https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/powercfg-command-line-options author: frack113 date: 2022-11-18 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_power: - Image|endswith: \powercfg.exe - OriginalFileName: PowerCfg.exe selection_standby: - CommandLine|contains|all: - '/setacvalueindex ' - SCHEME_CURRENT - SUB_VIDEO - VIDEOCONLOCK - CommandLine|contains|all: - '-change ' - -standby-timeout- condition: all of selection_* falsepositives: - Unknown level: medium
Query: risk of The Related Posts plugin before 1.8.2 for WordPress has XSS via add_query_arg() and remove_query_arg().
Matching passage: CVE-2015-9361. CWE: CWE-79. CVSS: 6.099999904632568. The Related Posts plugin before 1.8.2 for WordPress has XSS via add_query_arg() and remove_query_arg().
Near-miss passage: CVE-2015-6346. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Cisco Secure Access Control Server (ACS) 5.7(0.15) allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Query: weakness Insufficient Encapsulation of Machine-Dependent Functionality
Matching passage: CWE-1105 Insufficient Encapsulation of Machine-Dependent Functionality. The product or code uses machine-dependent functionality, but it does not sufficiently encapsulate or isolate this functionality from the rest of the code.
Near-miss passage: CWE-1243 Sensitive Non-Volatile Information Not Protected During Debug. Access to security-sensitive information stored in fuses is not limited during debug.
Query: CVE similar to CVE-2015-2661
Matching passage: CVE-2015-2661. CWE: UNKNOWN. CVSS: 2.0999999046325684. Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows local users to affect availability via unknown vectors related to Client.
Near-miss passage: CVE-2015-4885. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 12.1.0.4 allows remote attackers to affect confidentiality via vectors related to Agent Next Gen.
Query: exploit Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Mem
Matching passage: CVE-2015-0099. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-1068. CWE: CWE-399. CVSS: 6.800000190734863. WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Query: CVE similar to CVE-2015-0195
Matching passage: CVE-2015-0195. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in IBM Content Template Catalog 4.x before 4.1.4 for WebSphere Portal 8.0.x and 4.x before 4.3.1 for WebSphere Portal 8.5.x allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-6509. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in pfSense before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) proxypass parameter to system_advanced_misc.php; (2) adaptiveend, (3) adaptivestart, (4) maximumstates, (5) maximumtableentries, or (6) aliasesresolveinterval parameter to system_advanced_firewall.php; (7) proxyurl, (8) proxyuser, or (9) proxyport parameter to system_advanced_misc.php; or (10) name, (11) notification_name, (12) ipaddress, (13) password, (14) smtpipaddress, (15) smtpport, (16) smtpfromaddress, (17) smtpnotifyemailaddress, (18) smtpusername, or (19) smtppassword parameter to system_advanced_notifications.php.
Query: incident response steps for SIEM correlation: command and control activity consistent with External Proxy
Matching passage: Playbook for T1090.002 External Proxy. 1) Validate alert telemetry against T1090.002. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: command and control. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries u
Near-miss passage: Playbook for T1090 Proxy. Different response path focused on command and control.
Query: weakness Allocation of Resources Without Limits or Throttling
Matching passage: CWE-770 Allocation of Resources Without Limits or Throttling. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Near-miss passage: CWE-280 Improper Handling of Insufficient Permissions or Privileges. The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.
Query: describe CVE-2015-8356
Matching passage: CVE-2015-8356. CWE: CWE-89. CVSS: 8.0. Multiple SQL injection vulnerabilities in the mcart.xls module 6.5.2 and earlier for Bitrix allow remote authenticated users to execute arbitrary SQL commands via the (1) xls_profile parameter to admin/mcart_xls_import.php or the (2) xls_iblock_id, (3) xls_iblock_section_id, (4) firstRow, (5) titleRow, (6) firstColumn, (7) highestColumn, (8) sku_iblock_id, or (9) xls_iblock_section_id_new parameter to admin/mcart_xls_import_step_2.php.
Near-miss passage: CVE-2015-7714. CWE: CWE-89. CVSS: 7.199999809265137. Multiple SQL injection vulnerabilities in the Realtyna RPL (com_rpl) component before 8.9.5 for Joomla! allow remote administrators to execute arbitrary SQL commands via the (1) id, (2) copy_field in a data_copy action, (3) pshow in an update_field action, (4) css, (5) tip, (6) cat_id, (7) text_search, (8) plisting, or (9) pwizard parameter to administrator/index.php.
Query: exploit Microsoft Internet Explorer 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass."
Matching passage: CVE-2015-1685. CWE: CWE-264. CVSS: 4.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass."
Near-miss passage: CVE-2015-7051. CWE: CWE-264. CVSS: 9.300000190734863. MobileStorageMounter in Apple iOS before 9.2 and tvOS before 9.1 mishandles the timing of trust-cache loading, which allows attackers to execute arbitrary code in a privileged context via a crafted app.
Query: rule covering Detects MsiExec loading a DLL and calling its DllUnregisterServer function
Matching passage: Sigma rule: Detects MsiExec loading a DLL and calling its DllUnregisterServer function. Logsource: windows / process_creation. Rule: title: DllUnregisterServer Function Call Via Msiexec.EXE id: 84f52741-8834-4a8c-a413-2eb2269aa6c8 status: test description: Detects MsiExec loading a DLL and calling its DllUnregisterServer function references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md - https://lolbas-project.github.io/lolbas/Binaries/Msiexec/ - https://twitter.com/_st0pp3r_/status/1583914515996897281 author: frack113 date: 2022-04-24 modified: 2024-03-13 tags: - attack.stealth - attack.t1218.007 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \msiexec.exe - OriginalFileName: \msiexec.exe selection_flag: CommandLine|contains|windash: ' -z ' selection_dll: CommandLine|contains: .dll condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects creation of a scheduled task with a GUID like name. Logsource: windows / process_creation. Rule: title: Suspicious Scheduled Task Name As GUID id: ff2fff64-4cd6-4a2b-ba7d-e28a30bbe66b status: test description: Detects creation of a scheduled task with a GUID like name references: - https://thedfirreport.com/2022/10/31/follina-exploit-leads-to-domain-compromise/ - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-31 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1053.005 logsource: product: windows category: process_creation detection: selection_img: Image|endswith: \schtasks.exe CommandLine|contains: '/Create ' selection_tn: CommandLine|contains: - /TN "{ - /TN '{ - /TN { selection_end: CommandLine|contains: - '}"' - '}''' - '} ' condition: all of selection_* falsepositives: - Legitimate software naming their tasks as GUIDs level: medium
Query: patch priority for CVE-2015-1722
Matching passage: CVE-2015-1722. CWE: CWE-416. CVSS: 7.199999809265137. Use-after-free vulnerability in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Microsoft Windows Kernel Bitmap Handling Use After Free Vulnerability."
Near-miss passage: CVE-2015-3890. CWE: CWE-416. CVSS: 7.5. Use-after-free vulnerability in Open Litespeed before 1.3.10.
Query: patch priority for CVE-2015-4301
Matching passage: CVE-2015-4301. CWE: CWE-399. CVSS: 6.800000190734863. Cisco NX-OS on Nexus 9000 devices 11.1(1c) allows remote authenticated users to cause a denial of service (device hang) via large files that are copied to a device's filesystem, aka Bug ID CSCuu77225.
Near-miss passage: CVE-2015-7400. CWE: CWE-399. CVSS: 7.699999809265137. The Lotus Mashups component in IBM Mashup Center 3.0.0.1 allows remote authenticated users to cause a denial of service (CPU consumption) via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Query: detection rule: Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as
Matching passage: Sigma rule: Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as. Logsource: windows / process_creation. Rule: title: Time Travel Debugging Utility Usage id: 0b4ae027-2a2d-4b93-8c7e-962caaba5b2a related: - id: e76c8240-d68f-4773-8880-5c6f63595aaf type: derived status: test description: Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as lsass.exe, via tttracer.exe. references: - https://lolbas-project.github.io/lolbas/Binaries/Tttracer/ - https://twitter.com/mattifestation/status/1196390321783025666 - https://twitter.com/oulusoyum/status/1191329746069655553 author: Ensar Şamil, @sblmsrsn, @oscd_initiative date: 2020-10-06 modified: 2022-10-09 tags: - attack.credential-access - attack.stealth - attack.t1218 - attack.t1003.001 logsource: product: windows category: process_creation detection: selection: ParentImage|endswith: \tttracer.exe condition: selection falsepositives: - Legitimate usage by software developers/testers level: high
Near-miss passage: Sigma rule: Detects usage of the built-in PowerShell cmdlet "Enable-WindowsOptionalFeature" used as a Deployment Image Servicing and. Logsource: windows / ps_script. Rule: title: Potential Suspicious Windows Feature Enabled id: 55c925c1-7195-426b-a136-a9396800e29b related: - id: c740d4cf-a1e9-41de-bb16-8a46a4f57918 type: similar status: test description: 'Detects usage of the built-in PowerShell cmdlet "Enable-WindowsOptionalFeature" used as a Deployment Image Servicing and Management tool. Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images ' references: - https://learn.microsoft.com/en-us/powershell/module/dism/enable-windowsoptionalfeature?view=windowsserver2022-ps - https://learn.microsoft.com/en-us/windows/win32/projfs/enabling-windows-projected-file-system - https://learn.microsoft.com/en-us/windows/wsl/install-on-server author: frack113 date: 2022-09-10 modified: 2022-12-29 tags: - attack.stealth logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_cmd: ScriptBlockText|contains|all: - Enable-WindowsOptionalFeature - -Online - -FeatureName selection_feature: ScriptBlockText|contains: - TelnetServer - Internet-Explorer-Optional-amd64 - TFTP - SMB1Protocol - Client-ProjFS - Microsoft-Windows-Subsystem-Linux condition: all of selection_* falsepositives: - Legitimate usage of the features listed in the rule. level: medium
Query: exploit EMC Documentum Content Server before 6.7SP1 P32, 6.7SP2 before P25, 7.0 before P19, 7.1 before P16, and 7.2 before P02 does not properly check authorization and does not properly r
Matching passage: CVE-2015-4532. CWE: CWE-264. CVSS: 9.0. EMC Documentum Content Server before 6.7SP1 P32, 6.7SP2 before P25, 7.0 before P19, 7.1 before P16, and 7.2 before P02 does not properly check authorization and does not properly restrict object types, which allows remote authenticated users to run save RPC commands with super-user privileges, and consequently execute arbitrary code, via unspecified vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2514.
Near-miss passage: CVE-2015-8570. CWE: CWE-264. CVSS: 7.400000095367432. The password reset functionality in Lepide Active Directory Self Service allows remote authenticated users to change arbitrary domain user passwords via a crafted request.
Query: exploit The Framework Daemon in AlienVault Unified Security Management before 4.15 allows remote attackers to execute arbitrary Python code via a crafted plugin configuration file (.cfg).
Matching passage: CVE-2015-3446. CWE: CWE-94. CVSS: 9.300000190734863. The Framework Daemon in AlienVault Unified Security Management before 4.15 allows remote attackers to execute arbitrary Python code via a crafted plugin configuration file (.cfg).
Near-miss passage: CVE-2015-5243. CWE: CWE-94. CVSS: 9.800000190734863. phpWhois allows remote attackers to execute arbitrary code via a crafted whois record.
Query: describe CVE-2015-7724
Matching passage: CVE-2015-7724. CWE: CWE-59. CVSS: 7.800000190734863. AMD fglrx-driver before 15.9 allows local users to gain privileges via a symlink attack. NOTE: This vulnerability exists due to an incomplete fix for CVE-2015-7723.
Near-miss passage: CVE-2015-5705. CWE: CWE-59. CVSS: 7.5. Argument injection vulnerability in devscripts before 2.15.7 allows remote attackers to write to arbitrary files via a crafted symlink and crafted filename.