alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: The TRE library in Libc in Apple iOS before 8.4.1 and OS X before 10.10.5 allows context-dependent attackers to execute arbitrary code or cause a denial of service (memory corrupti
Matching passage: CVE-2015-3797. CWE: CWE-119. CVSS: 7.5. The TRE library in Libc in Apple iOS before 8.4.1 and OS X before 10.10.5 allows context-dependent attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted regular expression, a different vulnerability than CVE-2015-3796 and CVE-2015-3798.
Near-miss passage: CVE-2015-6091. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, and Word Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Query: detect Detects usage of "cdb.exe" to launch arbitrary processes or commands from a debugger script file in logs
Matching passage: Sigma rule: Detects usage of "cdb.exe" to launch arbitrary processes or commands from a debugger script file. Logsource: windows / process_creation. Rule: title: Potential Binary Proxy Execution Via Cdb.EXE id: b5c7395f-e501-4a08-94d4-57fe7a9da9d2 status: test description: Detects usage of "cdb.exe" to launch arbitrary processes or commands from a debugger script file references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Cdb/ - https://web.archive.org/web/20170715043507/http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html - https://twitter.com/nas_bench/status/1534957360032120833 author: Beyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2019-10-26 modified: 2024-04-22 tags: - attack.execution - attack.stealth - attack.t1106 - attack.t1218 - attack.t1127 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \cdb.exe - OriginalFileName: CDB.Exe selection_cli: CommandLine|contains: - ' -c ' - ' -cf ' condition: all of selection* falsepositives: - Legitimate use of debugging tools level: medium
Near-miss passage: Sigma rule: Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often us. Logsource: windows / ps_module. Rule: title: Potential Active Directory Enumeration Using AD Module - PsModule id: 74176142-4684-4d8a-8b0a-713257e7df8e related: - id: 70bc5215-526f-4477-963c-a47a5c9ebd12 type: similar - id: 9e620995-f2d8-4630-8430-4afd89f77604 type: similar status: test description: Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often used by attackers to perform AD enumeration. references: - https://github.com/samratashok/ADModule - https://twitter.com/cyb3rops/status/1617108657166061568?s=20 - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/active-directory-enumeration-with-ad-module-without-rsat-or-admin-privileges author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2023-01-22 tags: - attack.reconnaissance - attack.discovery - attack.impact logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_cmdlet: Payload|contains: - 'Import-Module ' - 'ipmo ' selection_dll: Payload|contains: Microsoft.ActiveDirectory.Management.dll condition: all of selection_* falsepositives: - Legitimate use of the library for administrative activity level: medium
Query: vulnerability: LXCFS before 0.12 does not properly enforce directory escapes, which might allow local users to gain privileges by (1) querying or (2) updating a cgroup.
Matching passage: CVE-2015-1342. CWE: CWE-264. CVSS: 4.599999904632568. LXCFS before 0.12 does not properly enforce directory escapes, which might allow local users to gain privileges by (1) querying or (2) updating a cgroup.
Near-miss passage: CVE-2015-2364. CWE: CWE-264. CVSS: 7.199999809265137. The graphics component in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application that leverages an incorrect bitmap conversion, aka "Graphics Component EOP Vulnerability."
Query: patch priority for CVE-2015-8470
Matching passage: CVE-2015-8470. CWE: CWE-200. CVSS: 6.5. The console in Puppet Enterprise 3.7.x, 3.8.x, and 2015.2.x does not set the secure flag for the JSESSIONID cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session.
Near-miss passage: CVE-2015-8224. CWE: CWE-200. CVSS: 3.700000047683716. Huawei P8 before GRA-CL00C92B210, before GRA-L09C432B200, before GRA-TL00C01B210, and before GRA-UL00C00B210 allows remote attackers to obtain user equipment (aka UE) measurements of signal strengths.
Query: Outbound C2 pattern associated with Container and Resource Discovery
Matching passage: T1613 Container and Resource Discovery. Tactics: discovery. Description: Adversaries may attempt to discover containers and other resources that are available within a containers environment. Other resources may include images, deployments, pods, nodes, and other information such as the status of a cluster. These resources can be viewed within web applications such as the Kubernetes dashboard or can be queried via the Docker and Kubernetes APIs.(Citation: Docker API)(Citation: Kubernetes API) In Docker, logs may leak information about the environment, such as the environment’s configuration, which services are available, and what cloud provider the victim may be utilizing. The discovery of these resources may inform an adversary’s next steps in the environment, such as how to perform lateral movement and which methods to utilize for execution.
Near-miss passage: T1526 Cloud Service Discovery. Tactics: discovery. Description: An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can include Continuous Integration and Continuous Delivery (CI/CD), Lambda Functions, Entra ID, etc. They may also include security services, such as AWS GuardDuty and Microsoft Defender for Cloud, and logging services, such as AWS CloudTrail and Google Cloud Audit Logs. Adversaries may attempt to discover information about the services enabled throughout the environment. Azure tools and APIs, such as the Microsoft Graph API and Azure Resource Manager API, can enumerate resources and services, including applications, management groups, resources and policy definitions, and their relationships that are accessible by an identity.(Citation: Azure - Resource Manager API)(Citation: Azure AD Graph API) For example, Stormspotter is an open source tool for enumerating and constructing a graph for Azure resources and services, and Pacu is an open source AWS exploitation framework that supports several methods for discovering cloud services.(Citation: Azure - Stormspotter)(Citation: GitHub Pacu) Adversaries may use the information gained to shape follow-on behaviors, such as targeting data or credentials from enumerated services or evading identified defenses through [Disable or Modify Tools](https://attack.mitre.org/techniques/T1685) or [Disable or Modify Cloud Log](https://attack.mitre.org/techniques/T1685/002).
Query: CVE similar to CVE-2015-7305
Matching passage: CVE-2015-7305. CWE: CWE-200. CVSS: 5.0. The Scald module 7.x-1.x before 7.x-1.5 for Drupal does not properly restrict access to fields, which allows remote attackers to obtain sensitive atom property information via vectors involving a "debug context."
Near-miss passage: CVE-2015-2374. CWE: CWE-200. CVSS: 3.299999952316284. The Netlogon service in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 Gold and R2 does not properly implement domain-controller communication, which allows remote attackers to discover credentials by leveraging certain PDC access and spoofing the BDC role in a PDC communication channel, aka "Elevation of Privilege Vulnerability in Netlogon."
Query: detection rule: Detects PowerShell called from an executable by the version mismatch method
Matching passage: Sigma rule: Detects PowerShell called from an executable by the version mismatch method. Logsource: windows / ps_classic_start. Rule: title: PowerShell Called from an Executable Version Mismatch id: c70e019b-1479-4b65-b0cc-cd0c6093a599 status: test description: Detects PowerShell called from an executable by the version mismatch method references: - https://adsecurity.org/?p=2921 author: Sean Metcalf (source), Florian Roth (Nextron Systems) date: 2017-03-05 modified: 2023-10-27 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_classic_start detection: selection_engine: Data|contains: - EngineVersion=2. - EngineVersion=4. - EngineVersion=5. selection_host: Data|contains: HostVersion=3. condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: load malicious registered COM objects. Logsource: windows / process_creation. Rule: title: Rundll32 Registered COM Objects id: f1edd233-30b5-4823-9e6a-c4171b24d316 status: test description: load malicious registered COM objects references: - https://nasbench.medium.com/a-deep-dive-into-rundll32-exe-642344b41e90 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.015/T1546.015.md author: frack113 date: 2022-02-13 modified: 2023-02-09 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.015 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE selection_cli: CommandLine|contains: - '-sta ' - '-localserver ' CommandLine|contains|all: - '{' - '}' condition: all of selection_* falsepositives: - Legitimate use level: high
Query: patch priority for CVE-2015-1812
Matching passage: CVE-2015-1812. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-1813.
Near-miss passage: CVE-2015-0128. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Rational Quality Manager 2.x and 3.x before 3.0.1.6 iFix4, 4.x before 4.0.7 iFix3, and 5.x before 5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-0124.
Query: risk of In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 41
Matching passage: CVE-2015-9184. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, and SD 835, lack of length checking in wv_dash_core_load_keys_v8() could lead to a buffer overflow vulnerability.
Near-miss passage: CVE-2015-0100. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Query: patch priority for CVE-2015-5234
Matching passage: CVE-2015-5234. CWE: CWE-20. CVSS: 6.800000190734863. IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks.
Near-miss passage: CVE-2015-3278. CWE: CWE-20. CVSS: 9.800000190734863. The cipherstring parsing code in nss_compat_ossl while in multi-keyword mode does not match the expected set of ciphers for a given cipher combination, which allows attackers to have unspecified impact via unknown vectors.
Query: CVE similar to CVE-2015-9393
Matching passage: CVE-2015-9393. CWE: CWE-79. CVSS: 5.400000095367432. The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_desc parameter.
Near-miss passage: CVE-2015-3976. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in GE Multilink ML810/3000/3100 series switch 5.2.0 and earlier, and GE Multilink ML800/1200/1600/2400 4.2.1 and earlier.
Query: detect Detects the use of Kali Linux through Windows Subsystem for Linux in logs
Matching passage: Sigma rule: Detects the use of Kali Linux through Windows Subsystem for Linux. Logsource: windows / process_creation. Rule: title: WSL Kali-Linux Usage id: 6f1a11aa-4b8a-4b7f-9e13-4d3e4ff0e0d4 status: experimental description: Detects the use of Kali Linux through Windows Subsystem for Linux references: - https://medium.com/@redfanatic7/running-kali-linux-on-windows-51ad95166e6e - https://learn.microsoft.com/en-us/windows/wsl/install author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-10-10 tags: - attack.stealth - attack.t1202 logsource: category: process_creation product: windows detection: selection_img_appdata: - Image|contains|all: - :\Users\ - \AppData\Local\packages\KaliLinux - Image|contains|all: - :\Users\ - \AppData\Local\Microsoft\WindowsApps\kali.exe selection_img_windowsapps: Image|contains: :\Program Files\WindowsApps\KaliLinux. Image|endswith: \kali.exe selection_kali_wsl_parent: ParentImage|endswith: - \wsl.exe - \wslhost.exe selection_kali_wsl_child: - Image|contains: - \kali.exe - \KaliLinux - CommandLine|contains: - Kali.exe - Kali-linux - kalilinux filter_main_install_uninstall: CommandLine|contains: - ' -i ' - ' --install ' - ' --unregister ' condition: 1 of selection_img_* or all of selection_kali_* and not 1 of filter_main_* falsepositives: - Legitimate installation or usage of Kali Linux WSL by administrators or security teams level: high
Near-miss passage: Sigma rule: Detects setting of a new registry value related to BgInfo configuration, which can be abused to execute custom WMI query. Logsource: windows / registry_set. Rule: title: New BgInfo.EXE Custom WMI Query Registry Configuration id: cd277474-5c52-4423-a52b-ac2d7969902f related: - id: 992dd79f-dde8-4bb0-9085-6350ba97cfb3 type: similar status: test description: Detects setting of a new registry value related to BgInfo configuration, which can be abused to execute custom WMI query via "BgInfo.exe" references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-16 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Software\Winternals\BGInfo\UserFields\ Details|startswith: '6' condition: selection falsepositives: - Legitimate WMI query level: medium
Query: rule covering Identifies when Rule Collections (Application, NAT, and Network) is being modified or deleted.
Matching passage: Sigma rule: Identifies when Rule Collections (Application, NAT, and Network) is being modified or deleted.. Logsource: azure / activitylogs. Rule: title: Azure Firewall Rule Collection Modified or Deleted id: 025c9fe7-db72-49f9-af0d-31341dd7dd57 status: test description: Identifies when Rule Collections (Application, NAT, and Network) is being modified or deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer @austinsonger date: 2021-08-08 modified: 2022-08-23 tags: - attack.impact - attack.defense-impairment - attack.t1686.001 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.NETWORK/AZUREFIREWALLS/APPLICATIONRULECOLLECTIONS/WRITE - MICROSOFT.NETWORK/AZUREFIREWALLS/APPLICATIONRULECOLLECTIONS/DELETE - MICROSOFT.NETWORK/AZUREFIREWALLS/NATRULECOLLECTIONS/WRITE - MICROSOFT.NETWORK/AZUREFIREWALLS/NATRULECOLLECTIONS/DELETE - MICROSOFT.NETWORK/AZUREFIREWALLS/NETWORKRULECOLLECTIONS/WRITE - MICROSOFT.NETWORK/AZUREFIREWALLS/NETWORKRULECOLLECTIONS/DELETE condition: selection falsepositives: - Rule Collections (Application, NAT, and Network) being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Rule Collections (Application, NAT, and Network) modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects remote RPC calls to get event log information via EVEN or EVEN6. Logsource: rpc_firewall / application. Rule: title: Remote Event Log Recon id: 2053961f-44c7-4a64-b62d-f6e72800af0d status: test description: Detects remote RPC calls to get event log information via EVEN or EVEN6 references: - https://github.com/zeronetworks/rpcfirewall - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/ author: Sagie Dulce, Dekel Paz date: 2022-01-01 tags: - attack.discovery logsource: product: rpc_firewall category: application definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:82273fdc-e32a-18c3-3f78-827929dc23ea and uuid:f6beaff7-1e19-4fbb-9f8f-b89e2018337c"' detection: selection: EventLog: RPCFW EventID: 3 InterfaceUuid: - 82273fdc-e32a-18c3-3f78-827929dc23ea - f6beaff7-1e19-4fbb-9f8f-b89e2018337c condition: selection falsepositives: - Remote administrative tasks on Windows Events level: high
Query: patch priority for CVE-2015-8867
Matching passage: CVE-2015-8867. CWE: CWE-310. CVSS: 7.5. The openssl_random_pseudo_bytes function in ext/openssl/openssl.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 incorrectly relies on the deprecated RAND_pseudo_bytes function, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors.
Near-miss passage: CVE-2015-1816. CWE: CWE-310. CVSS: 5.0. Forman before 1.7.4 does not verify SSL certificates for LDAP connections, which allows man-in-the-middle attackers to spoof LDAP servers via a crafted certificate.
Query: write Sigma for Detects creation of files with the ".pub" extension in suspicious or uncommon locations. This could be a sign of attacke
Matching passage: Sigma rule: Detects creation of files with the ".pub" extension in suspicious or uncommon locations. This could be a sign of attacke. Logsource: windows / file_event. Rule: title: Publisher Attachment File Dropped In Suspicious Location id: 3d2a2d59-929c-4b78-8c1a-145dfe9e07b1 status: test description: Detects creation of files with the ".pub" extension in suspicious or uncommon locations. This could be a sign of attackers abusing Publisher documents references: - https://twitter.com/EmericNasi/status/1623224526220804098 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-08 tags: - attack.stealth logsource: category: file_event product: windows detection: selection: TargetFilename|contains: - \AppData\Local\Temp\ - \Users\Public\ - \Windows\Temp\ - C:\Temp\ TargetFilename|endswith: .pub condition: selection falsepositives: - Legitimate usage of ".pub" files from those locations level: medium
Near-miss passage: Sigma rule: Adversaries may disable security tools to avoid possible detection of their tools and activities by removing Windows Def. Logsource: windows / process_creation. Rule: title: Windows Defender Definition Files Removed id: 9719a8aa-401c-41af-8108-ced7ec9cd75c status: test description: Adversaries may disable security tools to avoid possible detection of their tools and activities by removing Windows Defender Definition Files references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md - https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/ author: frack113 date: 2021-07-07 modified: 2023-07-18 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \MpCmdRun.exe - OriginalFileName: MpCmdRun.exe selection_cli: CommandLine|contains|all: - ' -RemoveDefinitions' - ' -All' condition: all of selection_* falsepositives: - Unknown level: high
Query: common weakness: Buffer Over-read
Matching passage: CWE-126 Buffer Over-read. The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
Near-miss passage: CWE-463 Deletion of Data Structure Sentinel. The accidental deletion of a data-structure sentinel can cause serious programming logic problems.
Query: write Sigma for Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using Windows Authentication.
Matching passage: Sigma rule: Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using Windows Authentication.. Logsource: opencanary / application. Rule: title: OpenCanary - MSSQL Login Attempt Via Windows Authentication id: 6e78f90f-0043-4a01-ac41-f97681613a66 status: test description: 'Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using Windows Authentication. ' references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.credential-access - attack.collection - attack.t1003 - attack.t1213 logsource: category: application product: opencanary detection: selection: logtype: 9002 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects when a Microsoft Cloud App Security reported when a user or IP address uses an app that is not sanctioned to per. Logsource: m365 / threat_management. Rule: title: Data Exfiltration to Unsanctioned Apps id: 2b669496-d215-47d8-bd9a-f4a45bf07cda status: test description: Detects when a Microsoft Cloud App Security reported when a user or IP address uses an app that is not sanctioned to perform an activity that resembles an attempt to exfiltrate information from your organization. references: - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference author: Austin Songer @austinsonger date: 2021-08-23 modified: 2022-10-09 tags: - attack.exfiltration - attack.t1537 logsource: service: threat_management product: m365 detection: selection: eventSource: SecurityComplianceCenter eventName: Data exfiltration to unsanctioned apps status: success condition: selection falsepositives: - Unknown level: medium
Query: risk of The captain-slider plugin 1.0.6 for WordPress has XSS via a Title or Caption section.
Matching passage: CVE-2015-9419. CWE: CWE-79. CVSS: 6.099999904632568. The captain-slider plugin 1.0.6 for WordPress has XSS via a Title or Caption section.
Near-miss passage: CVE-2015-7232. CWE: CWE-79. CVSS: 2.5999999046325684. Cross-site scripting (XSS) vulnerability in unspecified administration pages in the OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the OSF Ontology module is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.