alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-8310
Matching passage: CVE-2015-8310. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to inject arbitrary web script or HTML via the playlistname field when creating a new playlist.
Near-miss passage: CVE-2015-1041. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in e107_admin/filemanager.php in e107 1.0.4 allows remote attackers to inject arbitrary web script or HTML via the e107_files/ file path in the QUERY_STRING.
Query: alert when Detects the addition of a new rule to the Windows firewall via netsh
Matching passage: Sigma rule: Detects the addition of a new rule to the Windows firewall via netsh. Logsource: windows / process_creation. Rule: title: New Firewall Rule Added Via Netsh.EXE id: cd5cfd80-aa5f-44c0-9c20-108c4ae12e3c status: test description: Detects the addition of a new rule to the Windows firewall via netsh references: - https://web.archive.org/web/20190508165435/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf author: Markus Neis, Sander Wiebing date: 2019-01-29 modified: 2023-02-10 tags: - attack.defense-impairment - attack.t1686.003 - attack.s0246 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \netsh.exe - OriginalFileName: netsh.exe selection_cli: CommandLine|contains|all: - ' firewall ' - ' add ' filter_optional_dropbox: CommandLine|contains: - advfirewall firewall add rule name=Dropbox dir=in action=allow "program=?:\Program Files (x86)\Dropbox\Client\Dropbox.exe" enable=yes profile=Any - advfirewall firewall add rule name=Dropbox dir=in action=allow "program=?:\Program Files\Dropbox\Client\Dropbox.exe" enable=yes profile=Any condition: all of selection_* and not 1 of filter_optional_* falsepositives: - Legitimate administration activity - Software installations level: medium
Near-miss passage: Sigma rule: Detects the usage of attrib with the "+s" option to set scripts or executables located in suspicious locations as system. Logsource: windows / process_creation. Rule: title: Set Suspicious Files as System Files Using Attrib.EXE id: efec536f-72e8-4656-8960-5e85d091345b related: - id: bb19e94c-59ae-4c15-8c12-c563d23fe52b type: derived status: test description: 'Detects the usage of attrib with the "+s" option to set scripts or executables located in suspicious locations as system files to hide them from users and make them unable to be deleted with simple rights. The rule limits the search to specific extensions and directories to avoid FPs ' references: - https://app.any.run/tasks/c28cabc8-a19f-40f3-a78b-cae506a5c0d4 - https://app.any.run/tasks/cfc8870b-ccd7-4210-88cf-a8087476a6d0 - https://unit42.paloaltonetworks.com/unit42-sure-ill-take-new-combojack-malware-alters-clipboards-steal-cryptocurrency/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-28 modified: 2023-03-14 tags: - attack.stealth - attack.t1564.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \attrib.exe - OriginalFileName: ATTRIB.EXE selection_cli: CommandLine|contains: ' +s' selection_paths: CommandLine|contains: - ' %' - \Users\Public\ - \AppData\Local\ - \ProgramData\ - \Downloads\ - \Windows\Temp\ selection_ext: CommandLine|contains: - .bat - .dll - .exe - .hta - .ps1 - .vbe - .vbs filter_optional_installer: CommandLine|contains|all: - \Windows\TEMP\ - .exe condition: all of selection* and not 1 of filter_optional_* falsepositives: - Unknown level: high
Query: describe CVE-2015-0846
Matching passage: CVE-2015-0846. CWE: CWE-200. CVSS: 5.0. django-markupfield before 1.3.2 uses the default docutils RESTRUCTUREDTEXT_FILTER_SETTINGS settings, which allows remote attackers to include and read arbitrary files via unspecified vectors.
Near-miss passage: CVE-2015-2410. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to determine the existence of local files via a crafted stylesheet, aka "Internet Explorer Information Disclosure Vulnerability."
Query: rule covering Detects the creation of the file "rootlog" which is used by the TripleCross rootkit as a way to check if the backdoor is
Matching passage: Sigma rule: Detects the creation of the file "rootlog" which is used by the TripleCross rootkit as a way to check if the backdoor is. Logsource: linux / file_event. Rule: title: Triple Cross eBPF Rootkit Default LockFile id: c0239255-822c-4630-b7f1-35362bcb8f44 status: test description: Detects the creation of the file "rootlog" which is used by the TripleCross rootkit as a way to check if the backdoor is already running. references: - https://github.com/h3xduck/TripleCross/blob/1f1c3e0958af8ad9f6ebe10ab442e75de33e91de/src/helpers/execve_hijack.c#L33 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-05 modified: 2022-12-31 tags: - attack.stealth logsource: product: linux category: file_event detection: selection: TargetFilename: /tmp/rootlog condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389. Logsource: windows / network_connection. Rule: title: RDP Over Reverse SSH Tunnel id: 5f699bc5-5446-4a4a-a0b7-5ef2885a3eb4 status: test description: Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389 references: - https://twitter.com/cyb3rops/status/1096842275437625346 author: Samir Bousseaden date: 2019-02-16 modified: 2024-03-12 tags: - attack.command-and-control - attack.t1572 - attack.lateral-movement - attack.t1021.001 - car.2013-07-002 logsource: category: network_connection product: windows detection: selection_img: Image|endswith: \svchost.exe Initiated: 'true' SourcePort: 3389 selection_destination: DestinationIp|cidr: - 127.0.0.0/8 - ::1/128 condition: all of selection_* falsepositives: - Unknown level: high
Query: secure coding against Insufficient Isolation of System-Dependent Functions
Matching passage: CWE-1100 Insufficient Isolation of System-Dependent Functions. The product or code does not isolate system-dependent functionality into separate standalone modules.
Near-miss passage: CWE-696 Incorrect Behavior Order. The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways that may produce resultant weaknesses.
Query: vulnerability: The SDK for Komodia Redirector with SSL Digestor, as used in Lavasoft Ad-Aware Web Companion 1.1.885.1766 and Ad-Aware AdBlocker (alpha) 1.3.69.1, Qustodio for Windows, Atom Securi
Matching passage: CVE-2015-2077. CWE: CWE-200. CVSS: 5.0. The SDK for Komodia Redirector with SSL Digestor, as used in Lavasoft Ad-Aware Web Companion 1.1.885.1766 and Ad-Aware AdBlocker (alpha) 1.3.69.1, Qustodio for Windows, Atom Security, Inc. StaffCop 5.8, and other products, uses the same X.509 certificate private key for a root CA certificate across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging knowledge of this key, as originally reported for Superfish VisualDiscovery on certain Lenovo Notebook laptop products.
Near-miss passage: CVE-2015-1677. CWE: CWE-200. CVSS: 2.0999999046325684. The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to bypass the ASLR protection mechanism via a crafted function call, aka "Microsoft Windows Kernel Memory Disclosure Vulnerability," a different vulnerability than CVE-2015-1676, CVE-2015-1678, CVE-2015-1679, and CVE-2015-1680.
Query: describe CVE-2015-0197
Matching passage: CVE-2015-0197. CWE: CWE-264. CVSS: 7.199999809265137. IBM General Parallel File System (GPFS) 3.4 before 3.4.0.32, 3.5 before 3.5.0.24, and 4.1 before 4.1.0.7 allows local users to obtain root privileges for program execution via unspecified vectors.
Near-miss passage: CVE-2015-6265. CWE: CWE-264. CVSS: 4.300000190734863. The CLI in Cisco Application Control Engine (ACE) 4700 A5 3.0 and earlier allows local users to bypass intended access restrictions, and read or write to files, by entering an unspecified CLI command with a crafted file as this command's input, aka Bug ID CSCur23662.
Query: patch priority for CVE-2015-4475
Matching passage: CVE-2015-4475. CWE: CWE-119. CVSS: 7.5. The mozilla::AudioSink function in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 mishandles inconsistent sample formats within MP3 audio data, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via a malformed file.
Near-miss passage: CVE-2015-9143. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9615, MDM9625, MDM9640, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 600, SD 615/16/SD 415, and SDX20, when reading CDT from eMMC with a very large meta offset (>size of default CDT-array compiled in bootloader) for one of the CDBs, a buffer overflow occurs.
Query: vulnerability: CRLF injection vulnerability in Squid before 3.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted header in a re
Matching passage: CVE-2015-0881. CWE: UNKNOWN. CVSS: 4.300000190734863. CRLF injection vulnerability in Squid before 3.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted header in a response.
Near-miss passage: CVE-2015-4371. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in the Perfecto module before 7.x-1.2 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in an unspecified parameter.
Query: Sigma rule for Extract data from cab file and hide it in an alternate data stream
Matching passage: Sigma rule: Extract data from cab file and hide it in an alternate data stream. Logsource: windows / process_creation. Rule: title: Suspicious Extrac32 Alternate Data Stream Execution id: 4b13db67-0c45-40f1-aba8-66a1a7198a1e status: test description: Extract data from cab file and hide it in an alternate data stream references: - https://lolbas-project.github.io/lolbas/Binaries/Extrac32/ author: frack113 date: 2021-11-26 modified: 2022-12-30 tags: - attack.stealth - attack.t1564.004 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - extrac32.exe - .cab CommandLine|re: :[^\\] condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects activity as "net user administrator /domain" and "net group domain admins /domain". Logsource: windows / security. Rule: title: Reconnaissance Activity id: 968eef52-9cff-4454-8992-1e74b9cbad6c status: test description: Detects activity as "net user administrator /domain" and "net group domain admins /domain" references: - https://findingbad.blogspot.de/2017/01/hunting-what-does-it-look-like.html author: Florian Roth (Nextron Systems), Jack Croock (method), Jonhnathan Ribeiro (improvements), oscd.community date: 2017-03-07 modified: 2022-08-22 tags: - attack.discovery - attack.t1087.002 - attack.t1069.002 - attack.s0039 logsource: product: windows service: security definition: The volume of Event ID 4661 is high on Domain Controllers and therefore "Audit SAM" and "Audit Kernel Object" advanced audit policy settings are not configured in the recommendations for server systems detection: selection: EventID: 4661 AccessMask: '0x2d' ObjectType: - SAM_USER - SAM_GROUP ObjectName|startswith: S-1-5-21- ObjectName|endswith: - '-500' - '-512' condition: selection falsepositives: - Administrator activity level: high
Query: Multiple failed authentications followed by XDG Autostart Entries
Matching passage: T1547.013 XDG Autostart Entries. Tactics: persistence, privilege escalation. Description: Adversaries may add or modify XDG Autostart Entries to execute malicious programs or commands when a user’s desktop environment is loaded at login. XDG Autostart entries are available for any XDG-compliant Linux system. XDG Autostart entries use Desktop Entry files (`.desktop`) to configure the user’s desktop environment upon user login. These configuration files determine what applications launch upon user login, define associated applications to open specific file types, and define applications used to open removable media.(Citation: Free Desktop Application Autostart Feb 2006)(Citation: Free Desktop Entry Keys) Adversaries may abuse this feature to establish persistence by adding a path to a malicious binary or command to the `Exec` directive in the `.desktop` configuration file. When the user’s desktop environment is loaded at user login, the `.desktop` files located in the XDG Autostart directories are automatically executed. System-wide Autostart entries are located in the `/etc/xdg/autostart` directory while the user entries are located in the `~/.config/autostart` directory. Adversaries may combine this technique with [Masquerading](https://attack.mitre.org/techniques/T1036) to blend malicious Autostart entries with legitimate programs.(Citation: Red Canary Netwire Linux 2022)
Near-miss passage: T1547.014 Active Setup. Tactics: persistence, privilege escalation. Description: Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine. Active Setup is a Windows mechanism that is used to execute programs when a user logs in. The value stored in the Registry key will be executed after a user logs into the computer.(Citation: Klein Active Setup 2010) These programs will be executed under the context of the user and will have the account's associated permissions level. Adversaries may abuse Active Setup by creating a key under <code> HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\</code> and setting a malicious value for <code>StubPath</code>. This value will serve as the program that will be executed when a user logs into the computer.(Citation: Mandiant Glyer APT 2010)(Citation: Citizenlab Packrat 2015)(Citation: FireEye CFR Watering Hole 2012)(Citation: SECURELIST Bright Star 2015)(Citation: paloalto Tropic Trooper 2016) Adversaries can abuse these components to execute malware, such as remote access tools, to maintain persistence through system reboots. Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make the Registry entries look as if they are associated with legitimate programs.
Query: hunt for Domain Trust Discovery activity
Matching passage: T1482 Domain Trust Discovery. Tactics: discovery. Description: Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments. Domain trusts provide a mechanism for a domain to allow access to resources based on the authentication procedures of another domain.(Citation: Microsoft Trusts) Domain trusts allow the users of the trusted domain to access resources in the trusting domain. The information discovered may help the adversary conduct [SID-History Injection](https://attack.mitre.org/techniques/T1134/005), [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003), and [Kerberoasting](https://attack.mitre.org/techniques/T1558/003).(Citation: AdSecurity Forging Trust Tickets)(Citation: Harmj0y Domain Trusts) Domain trusts can be enumerated using the `DSEnumerateDomainTrusts()` Win32 API call, .NET methods, and LDAP.(Citation: Harmj0y Domain Trusts) The Windows utility [Nltest](https://attack.mitre.org/software/S0359) is known to be used by adversaries to enumerate domain trusts.(Citation: Microsoft Operation Wilysupply)
Near-miss passage: T1049 System Network Connections Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network. An adversary who gains access to a system that is part of a cloud-based environment may map out Virtual Private Clouds or Virtual Networks in order to determine what systems and services are connected. The actions performed are likely the same types of discovery techniques depending on the operating system, but the resulting information may include details about the networked cloud environment relevant to the adversary's goals. Cloud providers may have different ways in which their virtual networks operate.(Citation: Amazon AWS VPC Guide)(Citation: Microsoft Azure Virtual Network Overview)(Citation: Google VPC Overview) Similarly, adversaries who gain access to network devices may also perform similar discovery activities to gather information about connected systems and services. Utilities and commands that acquire this information include [netstat](https://attack.mitre.org/software/S0104), "net use," and "net session" with [Net](https://attack.mitre.org/software/S0039). In Mac and Linux, [netstat](https://attack.mitre.org/software/S0104) and <code>lsof</code> can be used to list current connections. <code>who -a</code> and <code>w</code> can be used to show which users are currently logged in, similar to "net session". Additionally, built-in features native to network devices and [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) may be used (e.g. <code>show ip sockets</code>, <code>show tcp brief</code>).(Citation: US-CERT-TA18-106A) On ESXi servers, the command `esxi network ip connection list` can be used to list active network connections.(Citation: Sygnia ESXi Ransomware 2025)
Query: describe CVE-2015-2061
Matching passage: CVE-2015-2061. CWE: CWE-119. CVSS: 7.5. Heap-based buffer overflow in the browser plugin for PTC Creo View allows remote attackers to execute arbitrary code via vectors involving setting a large buffer to an unspecified attribute.
Near-miss passage: CVE-2015-4931. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12.1 allows remote attackers to execute arbitrary code via a crafted packet, a different vulnerability than CVE-2015-4932, CVE-2015-4933, CVE-2015-4934, and CVE-2015-4935.
Query: detect Detects risky authentication from a non AD registered device without MFA being required. in logs
Matching passage: Sigma rule: Detects risky authentication from a non AD registered device without MFA being required.. Logsource: azure / signinlogs. Rule: title: Suspicious SignIns From A Non Registered Device id: 572b12d4-9062-11ed-a1eb-0242ac120002 status: test description: Detects risky authentication from a non AD registered device without MFA being required. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#non-compliant-device-sign-in author: Harjot Singh, '@cyb3rjy0t' date: 2023-01-10 modified: 2025-07-02 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078 logsource: product: azure service: signinlogs detection: selection_main: Status: Success AuthenticationRequirement: singleFactorAuthentication RiskState: atRisk selection_empty1: DeviceDetail.trusttype: '' selection_empty2: DeviceDetail.trusttype: null condition: selection_main and 1 of selection_empty* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: This events that are generated when using the hacktool Ruler by Sensepost. Logsource: windows / security. Rule: title: Hacktool Ruler id: 24549159-ac1b-479c-8175-d42aea947cae status: test description: This events that are generated when using the hacktool Ruler by Sensepost references: - https://github.com/sensepost/ruler - https://github.com/sensepost/ruler/issues/47 - https://github.com/staaldraad/go-ntlm/blob/cd032d41aa8ce5751c07cb7945400c0f5c81e2eb/ntlm/ntlmv1.go#L427 - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4776 - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4624 author: Florian Roth (Nextron Systems) date: 2017-05-31 modified: 2022-10-09 tags: - attack.discovery - attack.execution - attack.collection - attack.lateral-movement - attack.t1087 - attack.t1114 - attack.t1059 - attack.t1550.002 logsource: product: windows service: security detection: selection1: EventID: 4776 Workstation: RULER selection2: EventID: - 4624 - 4625 WorkstationName: RULER condition: (1 of selection*) falsepositives: - Go utilities that use staaldraad awesome NTLM library level: high
Query: patch priority for CVE-2015-0989
Matching passage: CVE-2015-0989. CWE: CWE-19. CVSS: 4.300000190734863. PACTware 4.1 SP3 allows remote attackers to cause a denial of service (application crash) via a crafted file that triggers an internal error.
Near-miss passage: CVE-2015-3225. CWE: CWE-19. CVSS: 5.0. lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to cause a denial of service (SystemStackError) via a request with a large parameter depth.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in IBM Security Access Manager for Web 8.0 before 8.0.1.3 IF4 and 9.0 before 9.0.0.1 IF1 allows remote attackers to inject arbitrary web sc
Matching passage: CVE-2015-8531. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in IBM Security Access Manager for Web 8.0 before 8.0.1.3 IF4 and 9.0 before 9.0.0.1 IF1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-1866. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Ember.js 1.10.x before 1.10.1 and 1.11.x before 1.11.2.
Query: exploit The HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.1 allows remote attackers to cause a denial of service (out-of-bounds access and daemon crash) or possibly
Matching passage: CVE-2015-3249. CWE: CWE-119. CVSS: 9.800000190734863. The HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.1 allows remote attackers to cause a denial of service (out-of-bounds access and daemon crash) or possibly execute arbitrary code via vectors related to the (1) frame_handlers array or (2) set_dynamic_table_size function.
Near-miss passage: CVE-2015-5779. CWE: CWE-119. CVSS: 7.5. QuickTime 7 in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted file, a different vulnerability than CVE-2015-3765, CVE-2015-3779, CVE-2015-3788, CVE-2015-3789, CVE-2015-3790, CVE-2015-3791, CVE-2015-3792, CVE-2015-5751, and CVE-2015-5753.
Query: secure coding against Use of Incorrect Operator
Matching passage: CWE-480 Use of Incorrect Operator. The product accidentally uses the wrong operator, which changes the logic in security-relevant ways.
Near-miss passage: CWE-1236 Improper Neutralization of Formula Elements in a CSV File. The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.