alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-8213
Matching passage: CVE-2015-8213. CWE: CWE-200. CVSS: 5.0. The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY.
Near-miss passage: CVE-2015-0757. CWE: CWE-200. CVSS: 5.0. The web framework in Cisco Identity Services Engine (ISE) 1.2(1.901) and 1.3(0.722) does not properly implement session handlers, which allows remote attackers to obtain sensitive information by reading web pages, as demonstrated by MnT reports, aka Bug ID CSCuq23140.
Query: containment actions for Persistence mechanism resembling IIS Components
Matching passage: Playbook for T1505.004 IIS Components. 1) Validate alert telemetry against T1505.004. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: persistence. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may install malicious components that run on Internet Information Services (IIS) web servers to establish persistence. IIS provides several mechanisms to extend the functionality of the web servers. For example, Internet Server Application Programming Interface (ISAPI) extensions and filters can be installed to examine and/or modify incoming and outgoing IIS web requests. Extensions an
Near-miss passage: Playbook for T1505.005 Terminal Services DLL. Different response path focused on persistence.
Query: patch priority for CVE-2015-6548
Matching passage: CVE-2015-6548. CWE: CWE-89. CVSS: 5.800000190734863. Multiple SQL injection vulnerabilities in a PHP script in the management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-1471. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in userprofile.lib.php in Pragyan CMS 3.0 allows remote attackers to execute arbitrary SQL commands via the user parameter to the default URI.
Query: detection engineering for Trusted Relationship
Matching passage: T1199 Trusted Relationship. Tactics: initial access. Description: Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network. Organizations often grant elevated access to second or third-party external providers in order to allow them to manage internal systems as well as cloud-based environments. Some examples of these relationships include IT services contractors, managed security providers, infrastructure contractors (e.g. HVAC, elevators, physical security). The third-party provider's access may be intended to be limited to the infrastructure being maintained, but may exist on the same network as the rest of the enterprise. As such, [Valid Accounts](https://attack.mitre.org/techniques/T1078) used by the other party for access to internal network systems may be compromised and used.(Citation: CISA IT Service Providers) In Office 365 environments, organizations may grant Microsoft partners or resellers delegated administrator permissions. By compromising a partner or reseller account, an adversary may be able to leverage existing delegated administrator relationships or send new delegated administrator offers to clients in order to gain administrative control over the victim tenant.(Citation: Office 365 Delegated Administration)
Near-miss passage: T1195.003 Compromise Hardware Supply Chain. Tactics: initial access. Description: Adversaries may manipulate hardware components in products prior to receipt by a final consumer for the purpose of data or system compromise. By modifying hardware or firmware in the supply chain, adversaries can insert a backdoor into consumer networks that may be difficult to detect and give the adversary a high degree of control over the system. Hardware backdoors may be inserted into various devices, such as servers, workstations, network infrastructure, or peripherals.
Query: risk of Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1.2(0.793), 1.3(0.876), 1.4(0.109), 2.0(0.147), and 2.0(0.169) allows r
Matching passage: CVE-2015-4267. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1.2(0.793), 1.3(0.876), 1.4(0.109), 2.0(0.147), and 2.0(0.169) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCus09940.
Near-miss passage: CVE-2015-3950. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in XZERES 442SR OS on 442SR wind turbines allows remote attackers to hijack the authentication of admins for requests that select a different default admin user via a GET request.
Query: describe CVE-2015-6344
Matching passage: CVE-2015-6344. CWE: CWE-200. CVSS: 4.0. The web-based GUI in Cisco Adaptive Security Appliance (ASA) CX Context-Aware Security 9.3(4.1.11) allows remote authenticated users to bypass intended access restrictions and obtain sensitive user information via an unspecified HTTP request, aka Bug ID CSCuv74105.
Near-miss passage: CVE-2015-1113. CWE: CWE-200. CVSS: 1.899999976158142. The Sandbox Profiles component in Apple iOS before 8.3 allows attackers to read the (1) telephone number or (2) e-mail address of a recent contact via a crafted app.
Query: Sigma YAML for linux / process_creation
Matching passage: Sigma rule: Detects user account creation on ESXi system via esxcli. Logsource: linux / process_creation. Rule: title: ESXi Account Creation Via ESXCLI id: b28e4eb3-8bbc-4f0c-819f-edfe8e2f25db status: test description: Detects user account creation on ESXi system via esxcli references: - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html author: Cedric Maurugeon date: 2023-08-22 tags: - attack.persistence - attack.execution - attack.t1136 - attack.t1059.012 logsource: category: process_creation product: linux detection: selection: Image|endswith: /esxcli CommandLine|contains|all: - 'system ' - 'account ' - 'add ' condition: selection falsepositives: - Legitimate administration activities level: medium
Near-miss passage: Sigma rule: Detects the attempt to install new skills for AI agents using the "npx skills" command. Agent skills enhance AI agents w. Logsource: windows / process_creation. Rule: title: New Agent Skills Installation Attempt Via Node.EXE id: afa71271-6a97-4e47-810f-83120fb1a4ce status: experimental description: 'Detects the attempt to install new skills for AI agents using the "npx skills" command. Agent skills enhance AI agents with new capabilities, but attackers may abuse this mechanism to inject malicious commands executed by the agent on behalf of the user. The "npx skills" command can install skills for various agents (e.g., Claude Code, Cursor, and others). Analysts should review any installed skills to verify their legitimacy. Note: Tune this rule based on whether AI agent tooling is allowed in your environment. In environments where such tooling is authorized, this detection may reflect normal activity and the alert level should be adjusted accordingly. In environments where AI agent tooling is not permitted, this activity is likely suspicious and may require immediate investigation. ' references: - https://blog.lukaszolejnik.com/supply-chain-risk-of-agentic-ai-infecting-infrastructures-via-skill-worms/ - https://github.com/vercel-labs/skills/blob/1f7fbc8d0e49c4e0601d364696bd1bdd15e80967/README.md - https://opensourcemalware.com/blog/clawdbot-skills-ganked-your-crypto - https://promptintel.novahunting.ai/molt author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) date: 2026-02-03 tags: - attack.execution - attack.t1059.007 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \node.exe - OriginalFileName: node.exe selection_cli: CommandLine|contains|all: - npx-cli.js - 'skills ' - ' add ' condition: all of selection_* falsepositives: - This rule will be triggered when a new agent skill is installed regardless if it is benign or malicious. - High false positive rate expected in environments where AI agent tooling is authorized and commonly used. level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_node_new_agent_skills_installed/info.yml
Query: Sigma YAML for linux / process_creation
Matching passage: Sigma rule: Detects the use of the "gcc" utility to execute a shell. Such behavior may be associated with privilege escalation, unau. Logsource: linux / process_creation. Rule: title: Shell Execution GCC - Linux id: 9b5de532-a757-4d70-946c-1f3e44f48b4d status: test description: 'Detects the use of the "gcc" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments. ' references: - https://gtfobins.github.io/gtfobins/gcc/#shell - https://gtfobins.github.io/gtfobins/c89/#shell - https://gtfobins.github.io/gtfobins/c99/#shell - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) date: 2024-09-02 tags: - attack.discovery - attack.t1083 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: - /c89 - /c99 - /gcc CommandLine|contains: -wrapper selection_cli: CommandLine|contains: - /bin/bash,-s - /bin/dash,-s - /bin/fish,-s - /bin/sh,-s - /bin/zsh,-s condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the pattern of a UAC bypass using Windows Event Viewer. Logsource: windows / file_event. Rule: title: UAC Bypass Using EventVwr id: 63e4f530-65dc-49cc-8f80-ccfa95c69d43 status: test description: Detects the pattern of a UAC bypass using Windows Event Viewer references: - https://twitter.com/orange_8361/status/1518970259868626944?s=20&t=RFXqZjtA7tWM3HxqEH78Aw - https://twitter.com/splinter_code/status/1519075134296006662?s=12&t=DLUXH86WtcmG_AZ5gY3C6g - https://lolbas-project.github.io/lolbas/Binaries/Eventvwr/#execute author: Antonio Cocomazzi (idea), Florian Roth (Nextron Systems) date: 2022-04-27 modified: 2022-11-22 tags: - attack.privilege-escalation - attack.stealth logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: - \Microsoft\Event Viewer\RecentViews - \Microsoft\EventV~1\RecentViews filter: Image|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ condition: selection and not filter falsepositives: - Unknown level: high
Query: vulnerability: Unspecified vulnerability in Oracle Java SE 7u85 and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via unknown vectors related to 2D.
Matching passage: CVE-2015-4840. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 7u85 and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via unknown vectors related to 2D.
Near-miss passage: CVE-2015-0389. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in the Oracle OpenSSO component in Oracle Fusion Middleware 8.0 Update 2 Patch 5 allows remote authenticated users to affect integrity via vectors related to SAML, a different vulnerability than CVE-2014-6592.
Query: CVE similar to CVE-2015-3156
Matching passage: CVE-2015-3156. CWE: CWE-59. CVSS: 5.5. The _write_config function in trove/guestagent/datastore/experimental/mongodb/service.py, reset_configuration function in trove/guestagent/datastore/experimental/postgresql/service/config.py, write_config function in trove/guestagent/datastore/experimental/redis/service.py, _write_mycnf function in trove/guestagent/datastore/mysql/service.py, InnoBackupEx::_run_prepare function in trove/guestagent/strategies/restore/mysql_impl.py, InnoBackupEx::cmd function in trove/guestagent/strategies/backup/mysql_impl.py, MySQLDump::cmd in trove/guestagent/strategies/backup/mysql_impl.py, InnoBackupExIncremental::cmd function in trove/guestagent/strategies/backup/mysql_impl.py, _get_actual_db_status function in trove/guestagent/datastore/experimental/cassandra/system.py and trove/guestagent/datastore/experimental/cassandra/service.py, and multiple class CbBackup methods in trove/guestagent/strategies/backup/experimental/couchbase_impl.py in Openstack DBaaS (aka Trove) as packaged in Openstack before 2015.1.0 (aka Kilo) allows local users to write to configuration files via a symlink attack on a temporary file.
Near-miss passage: CVE-2015-0858. CWE: CWE-59. CVSS: 3.299999952316284. Cool Projects TarDiff allows local users to write to arbitrary files via a symlink attack on a pathname in a /tmp/tardiff-$$ temporary directory.
Query: patch priority for CVE-2015-9187
Matching passage: CVE-2015-9187. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, lack of buffer length validation in pvr_cmd_handler leads to unauthorized access to secure memory.
Near-miss passage: CVE-2015-7896. CWE: CWE-119. CVSS: 6.5. LibQJpeg in the Samsung Galaxy S6 before the October 2015 MR allows remote attackers to cause a denial of service (memory corruption and SIGSEGV) via a crafted image file.
Query: vulnerability: vpxd in VMware vCenter Server 5.0 before u3e, 5.1 before u3, and 5.5 before u2 allows remote attackers to cause a denial of service via a long heartbeat message.
Matching passage: CVE-2015-1047. CWE: CWE-20. CVSS: 5.0. vpxd in VMware vCenter Server 5.0 before u3e, 5.1 before u3, and 5.5 before u2 allows remote attackers to cause a denial of service via a long heartbeat message.
Near-miss passage: CVE-2015-6172. CWE: CWE-20. CVSS: 9.300000190734863. Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2016, Word 2013 RT SP1, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted email message processed by Outlook, aka "Microsoft Office RCE Vulnerability."
Query: CVE similar to CVE-2015-0501
Matching passage: CVE-2015-0501. CWE: UNKNOWN. CVSS: 5.699999809265137. Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Compiling.
Near-miss passage: CVE-2015-8474. CWE: UNKNOWN. CVSS: 7.400000095367432. Open redirect vulnerability in the valid_back_url function in app/controllers/application_controller.rb in Redmine before 2.6.7, 3.0.x before 3.0.5, and 3.1.x before 3.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted back_url parameter, as demonstrated by "@attacker.com," a different vulnerability than CVE-2014-1985.
Query: vulnerability: Integer signedness error in the mobility_opt_print function in the IPv6 mobility printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (out-of-bounds
Matching passage: CVE-2015-0261. CWE: CWE-189. CVSS: 7.5. Integer signedness error in the mobility_opt_print function in the IPv6 mobility printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (out-of-bounds read and crash) or possibly execute arbitrary code via a negative length value.
Near-miss passage: CVE-2015-1539. CWE: CWE-189. CVSS: 10.0. Multiple integer underflows in the ESDS::parseESDescriptor function in ESDS.cpp in libstagefright in Android before 5.1.1 LMY48I allow remote attackers to execute arbitrary code via crafted ESDS atoms, aka internal bug 20139950, a related issue to CVE-2015-4493.
Query: risk of Cross-site scripting (XSS) vulnerability in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1, when is configured with a relative URL, 
Matching passage: CVE-2015-8622. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1, when is configured with a relative URL, allows remote authenticated users to inject arbitrary web script or HTML via wikitext, as demonstrated by a wikilink to a page named "javascript:alert('XSS!')."
Near-miss passage: CVE-2015-5337. CWE: CWE-79. CVSS: 6.099999904632568. Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not properly restrict the availability of Flowplayer, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted .swf file.
Query: exploit WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application cras
Matching passage: CVE-2015-5790. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Near-miss passage: CVE-2015-2493. CWE: CWE-119. CVSS: 9.300000190734863. The (1) VBScript and (2) JScript engines in Microsoft Internet Explorer 8 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability."
Query: Sigma YAML for m365 / threat_management
Matching passage: Sigma rule: Detects when a Security Compliance Center reported a user who exceeded sending limits of the service policies and becaus. Logsource: m365 / threat_management. Rule: title: Microsoft 365 - User Restricted from Sending Email id: ff246f56-7f24-402a-baca-b86540e3925c status: test description: Detects when a Security Compliance Center reported a user who exceeded sending limits of the service policies and because of this has been restricted from sending email. references: - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference author: austinsonger date: 2021-08-19 modified: 2022-10-09 tags: - attack.initial-access - attack.t1199 logsource: service: threat_management product: m365 detection: selection: eventSource: SecurityComplianceCenter eventName: User restricted from sending email status: success condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the execution of "dctask64.exe", a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This. Logsource: windows / process_creation. Rule: title: ManageEngine Endpoint Central Dctask64.EXE Potential Abuse id: 6345b048-8441-43a7-9bed-541133633d7a status: test description: 'Detects the execution of "dctask64.exe", a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This binary can be abused for DLL injection, arbitrary command and process execution. ' references: - https://twitter.com/gN3mes1s/status/1222088214581825540 - https://twitter.com/gN3mes1s/status/1222095963789111296 - https://twitter.com/gN3mes1s/status/1222095371175911424 author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2020-01-28 modified: 2025-01-22 tags: - attack.privilege-escalation - attack.stealth - attack.t1055.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \dctask64.exe - Hashes|contains: - IMPHASH=6834B1B94E49701D77CCB3C0895E1AFD - IMPHASH=1BB6F93B129F398C7C4A76BB97450BBA - IMPHASH=FAA2AC19875FADE461C8D89DCF2710A3 - IMPHASH=F1039CED4B91572AB7847D26032E6BBF selection_cli: CommandLine|contains: - ' executecmd64 ' - ' invokeexe ' - ' injectDll ' condition: all of selection_* falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-2908
Matching passage: CVE-2015-2908. CWE: CWE-345. CVSS: 9.0. Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, do not validate firmware updates, which allows remote attackers to execute arbitrary code by specifying an update server.
Near-miss passage: CVE-2015-6854. CWE: CWE-345. CVSS: 9.100000381469727. The non-Domino web agents in CA Single Sign-On (aka SSO, formerly SiteMinder) R6, R12.0 before SP3 CR13, R12.0J before SP3 CR1.2, and R12.5 before CR5 allow remote attackers to cause a denial of service (daemon crash) or obtain sensitive information via a crafted request.
Query: CVE similar to CVE-2015-7250
Matching passage: CVE-2015-7250. CWE: CWE-22. CVSS: 7.5. Absolute path traversal vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allows remote attackers to read arbitrary files via a full pathname in the getpage parameter.
Near-miss passage: CVE-2015-1429. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in Cybele Software Thinfinity Remote Desktop Workstation 3.0.0.3 32-bit and 64-bit allows remote attackers to download arbitrary files via a .. (dot dot) in an unspecified parameter.
Query: write Sigma for Detects the use of csrutil to view the Configure System Integrity Protection (SIP) status. This technique is used in pos
Matching passage: Sigma rule: Detects the use of csrutil to view the Configure System Integrity Protection (SIP) status. This technique is used in pos. Logsource: macos / process_creation. Rule: title: System Integrity Protection (SIP) Enumeration id: 53821412-17b0-4147-ade0-14faae67d54b status: test description: 'Detects the use of csrutil to view the Configure System Integrity Protection (SIP) status. This technique is used in post-exploit scenarios. ' references: - https://ss64.com/osx/csrutil.html - https://objective-see.org/blog/blog_0x6D.html - https://www.welivesecurity.com/2017/10/20/osx-proton-supply-chain-attack-elmedia/ - https://www.virustotal.com/gui/file/05a2adb266ec6c0ba9ed176d87d8530e71e845348c13caf9f60049760c312cd3/behavior author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2024-01-02 tags: - attack.discovery - attack.t1518.001 logsource: product: macos category: process_creation detection: selection: Image|endswith: /csrutil CommandLine|contains: status condition: selection falsepositives: - Legitimate administration activities level: low
Near-miss passage: Sigma rule: Detects potential persistence activity via startup add-ins that load when Microsoft Office starts (.wll/.xll are simply. Logsource: windows / file_event. Rule: title: Potential Persistence Via Microsoft Office Add-In id: 8e1cb247-6cf6-42fa-b440-3f27d57e9936 status: test description: Detects potential persistence activity via startup add-ins that load when Microsoft Office starts (.wll/.xll are simply .dll fit for Word or Excel). references: - Internal Research - https://labs.withsecure.com/publications/add-in-opportunities-for-office-persistence - https://github.com/redcanaryco/atomic-red-team/blob/4ae9580a1a8772db87a1b6cdb0d03e5af231e966/atomics/T1137.006/T1137.006.md author: NVISO date: 2020-05-11 modified: 2023-02-08 tags: - attack.persistence - attack.t1137.006 logsource: category: file_event product: windows detection: selection_wlldropped: TargetFilename|contains: \Microsoft\Word\Startup\ TargetFilename|endswith: .wll selection_xlldropped: TargetFilename|contains: \Microsoft\Excel\Startup\ TargetFilename|endswith: .xll selection_xladropped: TargetFilename|contains: Microsoft\Excel\XLSTART\ TargetFilename|endswith: .xlam selection_generic: TargetFilename|contains: \Microsoft\Addins\ TargetFilename|endswith: - .xlam - .xla - .ppam condition: 1 of selection_* falsepositives: - Legitimate add-ins level: high