alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to queue/api.
Matching passage: CVE-2015-5324. CWE: CWE-264. CVSS: 5.0. Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to queue/api.
Near-miss passage: CVE-2015-8994. CWE: CWE-264. CVSS: 7.5. An issue was discovered in PHP 5.x and 7.x, when the configuration uses apache2handler/mod_php or php-fpm with OpCache enabled. With 5.x after 5.6.28 or 7.x after 7.0.13, the issue is resolved in a non-default configuration with the opcache.validate_permission=1 setting. The vulnerability details are as follows. In PHP SAPIs where PHP interpreters share a common parent process, Zend OpCache creates a shared memory object owned by the common parent during initialization. Child PHP processes inherit the SHM descriptor, using it to cache and retrieve compiled script bytecode ("opcode" in PHP jargon). Cache keys vary depending on configuration, but filename is a central key component, and compiled opcode can generally be run if a script's filename is known or can be guessed. Many common shared-hosting configurations change EUID in child processes to enforce privilege separation among hosted users (for example using mod_ruid2 for the Apache HTTP Server, or php-fpm user settings). In these scenarios, the default Zend OpCache behavior defeats script file permissions by sharing a single SHM cache among all child PHP processes. PHP scripts often contain sensitive information: Think of CMS configurations where reading or running another user's script usually means gaining privileges to the CMS database.
Query: alert when Detects execution of perl using the "-e"/"-E" flags. This is could be used as a way to launch a reverse shell or execute
Matching passage: Sigma rule: Detects execution of perl using the "-e"/"-E" flags. This is could be used as a way to launch a reverse shell or execute. Logsource: windows / process_creation. Rule: title: Perl Inline Command Execution id: f426547a-e0f7-441a-b63e-854ac5bdf54d status: test description: Detects execution of perl using the "-e"/"-E" flags. This is could be used as a way to launch a reverse shell or execute live perl code. references: - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet - https://www.revshells.com/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-02 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \perl.exe - OriginalFileName: perl.exe selection_cli: CommandLine|contains: ' -e' condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the use of reg.exe to disable the Event Tracing for Windows (ETW) Autologger session for Windows Defender API an. Logsource: windows / process_creation. Rule: title: Disabling Windows Defender WMI Autologger Session via Reg.exe id: a1b2c3d4-e5f6-a7b8-c9d0-e1f2a3b4c5d6 related: - id: f37b4bce-49d0-4087-9f5b-58bffda77316 type: similar status: experimental description: 'Detects the use of reg.exe to disable the Event Tracing for Windows (ETW) Autologger session for Windows Defender API and Audit events. By setting the ''Start'' value to ''0'' for the ''DefenderApiLogger'' or ''DefenderAuditLogger'' session, an attacker can prevent these critical security events from being logged, effectively blinding monitoring tools that rely on this data. This is a powerful defense evasion technique. ' references: - https://research.splunk.com/endpoint/76406a0f-f5e0-4167-8e1f-337fdc0f1b0c/ - https://docs.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ - https://www.binarly.io/blog/design-issues-of-modern-edrs-bypassing-etw-based-solutions author: Matt Anderson (Huntress) date: 2025-07-09 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_reg_path: CommandLine|contains: - \Control\WMI\Autologger\DefenderApiLogger\Start - \Control\WMI\Autologger\DefenderAuditLogger\Start selection_reg_add: CommandLine|contains|all: - add - '0' filter_main_enable: CommandLine|contains: '0x00000001' condition: all of selection_* and not 1 of filter_main_* falsepositives: - Highly unlikely level: high
Query: exploit Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 40.0 allow remote attackers to cause a denial of service (memory corruption and application cra
Matching passage: CVE-2015-4474. CWE: UNKNOWN. CVSS: 10.0. Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 40.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Near-miss passage: CVE-2015-7472. CWE: UNKNOWN. CVSS: 7.199999809265137. IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF20, and 8.5.0 before CF10 allows remote attackers to conduct LDAP injection attacks, and consequently read or write to repository data, via unspecified vectors.
Query: exploit The escapeLike function in sqlsrv/database.inc in the Drupal 7 driver for SQL Server and SQL Azure 7.x-1.x before 7.x-1.4 does not properly escape certain characters, which allows 
Matching passage: CVE-2015-7876. CWE: CWE-89. CVSS: 7.5. The escapeLike function in sqlsrv/database.inc in the Drupal 7 driver for SQL Server and SQL Azure 7.x-1.x before 7.x-1.4 does not properly escape certain characters, which allows remote attackers to execute arbitrary SQL commands via vectors involving a module using the db_like function.
Near-miss passage: CVE-2015-0780. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in the GetReRequestData method of the GetStoredResult class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Query: patch priority for CVE-2015-4225
Matching passage: CVE-2015-4225. CWE: CWE-264. CVSS: 4.0. Cisco Application Policy Infrastructure Controller (APIC) 1.0(1.110a) and 1.0(1e) on Nexus 9000 devices does not properly implement RBAC health scoring, which allows remote authenticated users to obtain sensitive information via unspecified vectors, aka Bug ID CSCuq77485.
Near-miss passage: CVE-2015-2126. CWE: CWE-264. CVSS: 7.199999809265137. Unspecified vulnerability in pppoec in HP HP-UX 11iv2 and 11iv3 allows local users to gain privileges by leveraging setuid permissions.
Query: write Sigma for Detects the creation of a file by "dllhost.exe" in System32 directory part of "IDiagnosticProfileUAC" UAC bypass techniq
Matching passage: Sigma rule: Detects the creation of a file by "dllhost.exe" in System32 directory part of "IDiagnosticProfileUAC" UAC bypass techniq. Logsource: windows / file_event. Rule: title: UAC Bypass Using IDiagnostic Profile - File id: 48ea844d-19b1-4642-944e-fe39c2cc1fec status: test description: Detects the creation of a file by "dllhost.exe" in System32 directory part of "IDiagnosticProfileUAC" UAC bypass technique references: - https://github.com/Wh04m1001/IDiagnosticProfileUAC author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-03 tags: - attack.execution - attack.privilege-escalation - attack.t1548.002 logsource: product: windows category: file_event detection: selection: Image|endswith: \DllHost.exe TargetFilename|startswith: C:\Windows\System32\ TargetFilename|endswith: .dll condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects potential DLL injection and execution using "Tracker.exe". Logsource: windows / process_creation. Rule: title: Potential DLL Injection Or Execution Using Tracker.exe id: 148431ce-4b70-403d-8525-fcc2993f29ea status: test description: Detects potential DLL injection and execution using "Tracker.exe" references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Tracker/ author: Avneet Singh @v3t0_, oscd.community date: 2020-10-18 modified: 2023-01-09 tags: - attack.privilege-escalation - attack.stealth - attack.t1055.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \tracker.exe - Description: Tracker selection_cli: CommandLine|contains: - ' /d ' - ' /c ' filter_msbuild1: CommandLine|contains: ' /ERRORREPORT:PROMPT ' filter_msbuild2: ParentImage|endswith: - \Msbuild\Current\Bin\MSBuild.exe - \Msbuild\Current\Bin\amd64\MSBuild.exe condition: all of selection_* and not 1 of filter_* falsepositives: - Unknown level: medium
Query: vulnerability: WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application cras
Matching passage: CVE-2015-5806. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Near-miss passage: CVE-2015-4144. CWE: CWE-119. CVSS: 5.0. The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not validate that a message is long enough to contain the Total-Length field, which allows remote attackers to cause a denial of service (crash) via a crafted message.
Query: alert when Detects usage of the "systeminfo" command to retrieve information
Matching passage: Sigma rule: Detects usage of the "systeminfo" command to retrieve information. Logsource: windows / process_creation. Rule: title: Suspicious Execution of Systeminfo id: 0ef56343-059e-4cb6-adc1-4c3c967c5e46 status: test description: Detects usage of the "systeminfo" command to retrieve information references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1082/T1082.md#atomic-test-1---system-information-discovery - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/systeminfo author: frack113 date: 2022-01-01 modified: 2022-07-14 tags: - attack.discovery - attack.t1082 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \systeminfo.exe - OriginalFileName: sysinfo.exe condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects changes to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist. Logsource: windows / process_creation. Rule: title: Hiding User Account Via SpecialAccounts Registry Key - CommandLine id: 9ec9fb1b-e059-4489-9642-f270c207923d related: - id: f8aebc67-a56d-4ec9-9fbe-7b0e8b7b4efd type: similar status: test description: 'Detects changes to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen. ' references: - https://thedfirreport.com/2024/01/29/buzzing-on-christmas-eve-trigona-ransomware-in-3-hours/ - https://thedfirreport.com/2024/04/01/from-onenote-to-ransomnote-an-ice-cold-intrusion/ - https://thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days/ - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/ author: '@Kostastsale, TheDFIRReport' date: 2022-05-14 modified: 2024-08-23 tags: - attack.stealth - attack.t1564.002 logsource: category: process_creation product: windows detection: selection: Image|endswith: \reg.exe CommandLine|contains|all: - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList - add - /v - /d 0 condition: selection falsepositives: - System administrator activities level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_registry_special_accounts_hide_user/info.yml
Query: Sigma rule for Detects potential process patterns related to Cobalt Strike beacon activity
Matching passage: Sigma rule: Detects potential process patterns related to Cobalt Strike beacon activity. Logsource: windows / process_creation. Rule: title: Potential CobaltStrike Process Patterns id: f35c5d71-b489-4e22-a115-f003df287317 status: test description: Detects potential process patterns related to Cobalt Strike beacon activity references: - https://hausec.com/2021/07/26/cobalt-strike-and-tradecraft/ - https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2021-07-27 modified: 2023-03-29 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_generic_1: CommandLine|endswith: cmd.exe /C whoami ParentImage|startswith: C:\Temp\ selection_generic_2: ParentImage|endswith: - \runonce.exe - \dllhost.exe CommandLine|contains|all: - cmd.exe /c echo - '> \\\\.\\pipe' selection_conhost_1: ParentCommandLine|contains|all: - cmd.exe /C echo - ' > \\\\.\\pipe' CommandLine|endswith: conhost.exe 0xffffffff -ForceV1 selection_conhost_2: ParentCommandLine|endswith: /C whoami CommandLine|endswith: conhost.exe 0xffffffff -ForceV1 condition: 1 of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.. Logsource: windows / security. Rule: title: WMI Persistence - Security id: f033f3f3-fd24-4995-97d8-a3bb17550a88 related: - id: 0b7889b4-5577-4521-a60a-3376ee7f9f7b type: derived status: test description: Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs. references: - https://twitter.com/mattifestation/status/899646620148539397 - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/ author: Florian Roth (Nextron Systems), Gleb Sukhodolskiy, Timur Zinniatullin oscd.community date: 2017-08-22 modified: 2022-11-29 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.003 logsource: product: windows service: security detection: selection: EventID: 4662 ObjectType: WMI Namespace ObjectName|contains: subscription condition: selection falsepositives: - Unknown (data set is too small; further testing needed) level: medium
Query: explain CWE-924
Matching passage: CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel. The product establishes a communication channel with an endpoint and receives a message from that endpoint, but it does not sufficiently ensure that the message was not modified during transmission.
Near-miss passage: CWE-544 Missing Standardized Error Handling Mechanism. The product does not use a standardized method for handling errors throughout the code, which might introduce inconsistent error handling and resultant weaknesses.
Query: Encoded PowerShell / command-line abuse matching Regsvcs/Regasm
Matching passage: T1218.009 Regsvcs/Regasm. Tactics: stealth. Description: Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) assemblies. Both are binaries that may be digitally signed by Microsoft. (Citation: MSDN Regsvcs) (Citation: MSDN Regasm) Both utilities may be used to bypass application control through use of attributes within the binary to specify code that should be run before registration or unregistration: <code>[ComRegisterFunction]</code> or <code>[ComUnregisterFunction]</code> respectively. The code with the registration and unregistration attributes will be executed even if the process is run under insufficient privileges and fails to execute. (Citation: LOLBAS Regsvcs)(Citation: LOLBAS Regasm)
Near-miss passage: T1218.012 Verclsid. Tactics: stealth. Description: Adversaries may abuse verclsid.exe to proxy execution of malicious code. Verclsid.exe is known as the Extension CLSID Verification Host and is responsible for verifying each shell extension before they are used by Windows Explorer or the Windows Shell.(Citation: WinOSBite verclsid.exe) Adversaries may abuse verclsid.exe to execute malicious payloads. This may be achieved by running <code>verclsid.exe /S /C {CLSID}</code>, where the file is referenced by a Class ID (CLSID), a unique identification number used to identify COM objects. COM payloads executed by verclsid.exe may be able to perform various malicious actions, such as loading and executing COM scriptlets (SCT) from remote servers (similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010)). Since the binary may be signed and/or native on Windows systems, proxying execution via verclsid.exe may bypass application control solutions that do not account for its potential abuse.(Citation: LOLBAS Verclsid)(Citation: Red Canary Verclsid.exe)(Citation: BOHOPS Abusing the COM Registry)(Citation: Nick Tyrer GitHub)
Query: actor TTPs: Server Software Component
Matching passage: T1505 Server Software Component. Tactics: persistence. Description: Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application. Adversaries may install malicious components to extend and abuse server applications.(Citation: volexity_0day_sophos_FW)
Near-miss passage: T1505.005 Terminal Services DLL. Tactics: persistence. Description: Adversaries may abuse components of Terminal Services to enable persistent access to systems. Microsoft Terminal Services, renamed to Remote Desktop Services in some Windows Server OSs as of 2022, enable remote terminal connections to hosts. Terminal Services allows servers to transmit a full, interactive, graphical user interface to clients via RDP.(Citation: Microsoft Remote Desktop Services) [Windows Service](https://attack.mitre.org/techniques/T1543/003)s that are run as a "generic" process (ex: <code>svchost.exe</code>) load the service's DLL file, the location of which is stored in a Registry entry named <code>ServiceDll</code>.(Citation: Microsoft System Services Fundamentals) The <code>termsrv.dll</code> file, typically stored in `%SystemRoot%\System32\`, is the default <code>ServiceDll</code> value for Terminal Services in `HKLM\System\CurrentControlSet\services\TermService\Parameters\`. Adversaries may modify and/or replace the Terminal Services DLL to enable persistent access to victimized hosts.(Citation: James TermServ DLL) Modifications to this DLL could be done to execute arbitrary payloads (while also potentially preserving normal <code>termsrv.dll</code> functionality) as well as to simply enable abusable features of Terminal Services. For example, an adversary may enable features such as concurrent [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) sessions by either patching the <code>termsrv.dll</code> file or modifying the <code>ServiceDll</code> value to point to a DLL that provides increased RDP functionality.(Citation: Windows OS Hub RDP)(Citation: RDPWrap Github) On a non-server Windows OS this increased functionality may also enable an adversary to avoid Terminal Services prompts that warn/log out users of a system when a new RDP session is created.
Query: describe CVE-2015-3663
Matching passage: CVE-2015-3663. CWE: CWE-119. CVSS: 6.800000190734863. QT Media Foundation in Apple QuickTime before 7.7.7, as used in OS X before 10.10.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, a different vulnerability than CVE-2015-3661, CVE-2015-3662, CVE-2015-3666, CVE-2015-3667, and CVE-2015-3668.
Near-miss passage: CVE-2015-8662. CWE: CWE-119. CVSS: 7.300000190734863. The ff_dwt_decode function in libavcodec/jpeg2000dwt.c in FFmpeg before 2.8.4 does not validate the number of decomposition levels before proceeding with Discrete Wavelet Transform decoding, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG 2000 data.
Query: describe CVE-2015-6284
Matching passage: CVE-2015-6284. CWE: CWE-119. CVSS: 7.800000190734863. Buffer overflow in the Conference Control Protocol API implementation in Cisco TelePresence Server software before 4.1(2.33) on 7010, MSE 8710, Multiparty Media 310 and 320, and Virtual Machine devices allows remote attackers to cause a denial of service (device crash) via a crafted URL, aka Bug ID CSCuu28277.
Near-miss passage: CVE-2015-4422. CWE: CWE-119. CVSS: 7.0. The TEEOS module in Huawei Mate 7 (Mate7-TL10) smartphones before V100R001CHNC00B126SP03 allows local users with root permissions to gain privileges or cause a denial of service (memory corruption) via a crafted application.
Query: patch priority for CVE-2015-4046
Matching passage: CVE-2015-4046. CWE: CWE-77. CVSS: 7.199999809265137. The asset discovery scanner in AlienVault OSSIM before 5.0.1 allows remote authenticated users to execute arbitrary commands via the assets array parameter to netscan/do_scan.php.
Near-miss passage: CVE-2015-4336. CWE: CWE-77. CVSS: 6.5. cloner.functions.php in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to execute arbitrary commands via a file containing filenames with shell metacharacters, as demonstrated by using the backup comments feature to create the file.