alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Detects the execution of obfuscated PowerShell commands that attempt to install MSI packages via the Windows Installer C
Matching passage: Sigma rule: Detects the execution of obfuscated PowerShell commands that attempt to install MSI packages via the Windows Installer C. Logsource: windows / process_creation. Rule: title: Obfuscated PowerShell MSI Install via WindowsInstaller COM id: 7b6a7418-3afc-11f0-aff4-000d3abf478c status: experimental description: 'Detects the execution of obfuscated PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (`WindowsInstaller.Installer`). The technique involves manipulating strings to hide functionality, such as constructing class names using string insertion (e.g., ''indowsInstaller.Installer''.Insert(0,''W'')) and correcting malformed URLs (e.g., converting ''htps://'' to ''https://'') at runtime. This behavior is commonly associated with malware loaders or droppers that aim to bypass static detection by hiding intent in runtime-generated strings and using legitimate tools for code execution. The use of `InstallProduct` and COM object creation, particularly combined with hidden window execution and suppressed UI, indicates an attempt to install software (likely malicious) without user interaction. ' references: - https://informationsecuritybuzz.com/the-real-danger-behind-a-simple-windows-shortcut/ - https://redcanary.com/blog/threat-intelligence/intelligence-insights-may-2025/ - https://www.virustotal.com/gui/file/f9710b0ba4de5fa0e7ec27da462d4d2fc6838eba83a19f23f6617a466bbad457 author: Meroujan Antonyan (vx3r) date: 2025-05-27 tags: - attack.stealth - attack.t1027.010 - attack.t1218.007 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell_ise.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell_ISE.EXE - PowerShell.EXE - pwsh.dll selection_cli: CommandLine|contains|all: - -ComObject - InstallProduct( - .Insert( - UILevel condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the creation of suspicious accounts similar to ANONYMOUS LOGON, such as using additional spaces. Created as an c. Logsource: windows / security. Rule: title: Suspicious Windows ANONYMOUS LOGON Local Account Created id: 1bbf25b9-8038-4154-a50b-118f2a32be27 status: test description: Detects the creation of suspicious accounts similar to ANONYMOUS LOGON, such as using additional spaces. Created as an covering detection for exclusion of Logon Type 3 from ANONYMOUS LOGON accounts. references: - https://twitter.com/SBousseaden/status/1189469425482829824 author: James Pemberton / @4A616D6573 date: 2019-10-31 modified: 2022-10-09 tags: - attack.persistence - attack.t1136.001 - attack.t1136.002 logsource: product: windows service: security detection: selection: EventID: 4720 SamAccountName|contains|all: - ANONYMOUS - LOGON condition: selection falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-4209
Matching passage: CVE-2015-4209. CWE: CWE-200. CVSS: 6.400000095367432. Cisco WebEx Meeting Center does not properly determine authorization for reading a host calendar, which allows remote attackers to obtain sensitive information by obtaining a list of all meetings and then sending a calendar request for each one, aka Bug ID CSCur23913.
Near-miss passage: CVE-2015-4069. CWE: CWE-200. CVSS: 7.800000190734863. The EdgeServiceImpl web service in Arcserve UDP before 5.0 Update 4 allows remote attackers to obtain sensitive credentials via a crafted SOAP request to the (1) getBackupPolicy or (2) getBackupPolicies method.
Query: risk of Unspecified vulnerability in Jazz Team Server in Jazz Foundation in IBM Rational Collaborative Lifecycle Management (CLM) 3.x and 4.x before 4.0.7 IF8 and 5.x before 5.0.2 IF10; Ra
Matching passage: CVE-2015-1971. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in Jazz Team Server in Jazz Foundation in IBM Rational Collaborative Lifecycle Management (CLM) 3.x and 4.x before 4.0.7 IF8 and 5.x before 5.0.2 IF10; Rational Quality Manager (RQM) 2.x and 3.x before 3.0.1.6 IF7, 4.x before 4.0.7 IF8, and 5.x before 5.0.2 IF10; Rational Team Concert (RTC) 2.x and 3.x before 3.0.1.6 IF7, 4.x before 4.0.7 IF8, and 5.x before 5.0.2 IF10; Rational Requirements Composer (RRC) 2.x and 3.x before 3.0.1.6 IF7 and 4.0 through 4.0.7; Rational DOORS Next Generation (RDNG) 4.x before 4.0.7 IF8 and 5.x before 5.0.2 IF10; Rational Engineering Lifecycle Manager (RELM) 1.0 through 1.0.0.1, 4.0.3 through 4.0.7, and 5.0 through 5.0.2; Rational Rhapsody Design Manager (DM) 3.0 through 3.0.1, 4.0 through 4.0.7, 5.0 through 5.0.2, and 6.0; and Rational Software Architect Design Manager (DM) 3.0 through 3.0.1, 4.0 through 4.0.7, and 5.0 through 5.0.2 allows remote attackers to cause a denial of service via unknown vectors.
Near-miss passage: CVE-2015-0836. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Query: explain CWE-1322
Matching passage: CWE-1322 Use of Blocking Code in Single-threaded, Non-blocking Context. The product uses a non-blocking model that relies on a single threaded process for features such as scalability, but it contains code that can block when it is invoked.
Near-miss passage: CWE-279 Incorrect Execution-Assigned Permissions. While it is executing, the product sets the permissions of an object in a way that violates the intended permissions that have been specified by the user.
Query: describe CVE-2015-8070
Matching passage: CVE-2015-8070. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Near-miss passage: CVE-2015-2473. CWE: UNKNOWN. CVSS: 9.300000190734863. Untrusted search path vulnerability in the client in Remote Desktop Protocol (RDP) through 8.1 in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .rdp file, aka "Remote Desktop Protocol DLL Planting Remote Code Execution Vulnerability."
Query: CVE similar to CVE-2015-1377
Matching passage: CVE-2015-1377. CWE: CWE-59. CVSS: 4.900000095367432. The Read Mail module in Webmin 1.720 allows local users to read arbitrary files via a symlink attack on an unspecified file.
Near-miss passage: CVE-2015-1130. CWE: CWE-59. CVSS: 7.800000190734863. The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges via unspecified vectors.
Query: exploit Moodle 2.8.x before 2.8.6 does not consider the tool/monitor:subscribe capability before entering subscriptions to site-wide event-monitor rules, which allows remote authenticated 
Matching passage: CVE-2015-3177. CWE: CWE-17. CVSS: 3.5. Moodle 2.8.x before 2.8.6 does not consider the tool/monitor:subscribe capability before entering subscriptions to site-wide event-monitor rules, which allows remote authenticated users to obtain sensitive information via a subscription request.
Near-miss passage: CVE-2015-1334. CWE: CWE-17. CVSS: 4.599999904632568. attach.c in LXC 1.1.2 and earlier uses the proc filesystem in a container, which allows local container users to escape AppArmor or SELinux confinement by mounting a proc filesystem with a crafted (1) AppArmor profile or (2) SELinux label.
Query: Encoded PowerShell / command-line abuse matching Scanning IP Blocks
Matching passage: T1595.001 Scanning IP Blocks. Tactics: reconnaissance. Description: Adversaries may scan victim IP blocks to gather information that can be used during targeting. Public IP addresses may be allocated to organizations by block, or a range of sequential addresses. Adversaries may scan IP blocks in order to [Gather Victim Network Information](https://attack.mitre.org/techniques/T1590), such as which IP addresses are actively in use as well as more detailed information about hosts assigned these addresses. Scans may range from simple pings (ICMP requests and responses) to more nuanced scans that may reveal host software/versions via server banners or other network artifacts.(Citation: Botnet Scan) Information from these scans may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133)).
Near-miss passage: T1595.003 Wordlist Scanning. Tactics: reconnaissance. Description: Adversaries may iteratively probe infrastructure using brute-forcing and crawling techniques. While this technique employs similar methods to [Brute Force](https://attack.mitre.org/techniques/T1110), its goal is the identification of content and infrastructure rather than the discovery of valid credentials. Wordlists used in these scans may contain generic, commonly used names and file extensions or terms specific to a particular software. Adversaries may also create custom, target-specific wordlists using data gathered from other Reconnaissance techniques (ex: [Gather Victim Org Information](https://attack.mitre.org/techniques/T1591), or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)). For example, adversaries may use web content discovery tools such as Dirb, DirBuster, and GoBuster and generic or custom wordlists to enumerate a website’s pages and directories.(Citation: ClearSky Lebanese Cedar Jan 2021) This can help them to discover old, vulnerable pages or hidden administrative portals that could become the target of further operations (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190) or [Brute Force](https://attack.mitre.org/techniques/T1110)). As cloud storage solutions typically use globally unique names, adversaries may also use target-specific wordlists and tools such as s3recon and GCPBucketBrute to enumerate public and private buckets on cloud infrastructure.(Citation: S3Recon GitHub)(Citation: GCPBucketBrute) Once storage objects are discovered, adversaries may leverage [Data from Cloud Storage](https://attack.mitre.org/techniques/T1530) to access valuable information that can be exfiltrated or used to escalate privileges and move laterally.
Query: write Sigma for Detects execution of shells from a parent process located in a temporary (/tmp) directory
Matching passage: Sigma rule: Detects execution of shells from a parent process located in a temporary (/tmp) directory. Logsource: linux / process_creation. Rule: title: Shell Execution Of Process Located In Tmp Directory id: 2fade0b6-7423-4835-9d4f-335b39b83867 status: test description: Detects execution of shells from a parent process located in a temporary (/tmp) directory references: - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/ - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-06-02 tags: - attack.execution logsource: product: linux category: process_creation detection: selection: ParentImage|startswith: /tmp/ Image|endswith: - /bash - /csh - /dash - /fish - /ksh - /sh - /zsh condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the addition of a SSP to the registry. Upon a reboot or API call, SSP DLLs gain access to encrypted and plaintex. Logsource: windows / registry_event. Rule: title: Security Support Provider (SSP) Added to LSA Configuration id: eeb30123-9fbd-4ee8-aaa0-2e545bbed6dc status: test description: 'Detects the addition of a SSP to the registry. Upon a reboot or API call, SSP DLLs gain access to encrypted and plaintext passwords stored in Windows. ' references: - https://powersploit.readthedocs.io/en/latest/Persistence/Install-SSP/ - https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/data/module_source/persistence/Install-SSP.ps1#L157 author: iwillkeepwatch date: 2019-01-18 modified: 2026-03-30 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.005 logsource: category: registry_event product: windows detection: selection: TargetObject|endswith: - \Control\Lsa\Security Packages - \Control\Lsa\OSConfig\Security Packages filter_main_msiexec: Image: - C:\Windows\system32\msiexec.exe - C:\Windows\syswow64\MsiExec.exe filter_main_image_null: Image: null condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: exploit A vulnerability was found in juju2143 WalrusIRC 0.0.2. It has been rated as problematic. This issue affects the function parseLinks of the file public/parser.js. The manipulation o
Matching passage: CVE-2015-10079. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability was found in juju2143 WalrusIRC 0.0.2. It has been rated as problematic. This issue affects the function parseLinks of the file public/parser.js. The manipulation of the argument text leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 0.0.3 is able to address this issue. The patch is named 45fd885895ae13e8d9b3a71e89d59768914f60af. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220751.
Near-miss passage: CVE-2015-9414. CWE: CWE-79. CVSS: 6.099999904632568. The wp-symposium plugin through 15.8.1 for WordPress has XSS via the wp-content/plugins/wp-symposium/get_album_item.php?size parameter.
Query: risk of The SNMP implementation in Cisco NX-OS 6.1(2)I2(3) on Nexus 9000 devices, when a Reset High Availability (HA) policy is configured, allows remote authenticated users to cause a den
Matching passage: CVE-2015-0686. CWE: CWE-399. CVSS: 6.300000190734863. The SNMP implementation in Cisco NX-OS 6.1(2)I2(3) on Nexus 9000 devices, when a Reset High Availability (HA) policy is configured, allows remote authenticated users to cause a denial of service (device reload) via unspecified vectors, aka Bug ID CSCuq92240.
Near-miss passage: CVE-2015-8002. CWE: CWE-399. CVSS: 6.800000190734863. The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 allows remote authenticated users to cause a denial of service (disk consumption) via a file upload using one byte chunks.
Query: risk of The YCbCrImageDataDeserializer::ToDataSourceSurface function in the YCbCr implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thun
Matching passage: CVE-2015-2738. CWE: CWE-17. CVSS: 10.0. The YCbCrImageDataDeserializer::ToDataSourceSurface function in the YCbCr implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 reads data from uninitialized memory locations, which has unspecified impact and attack vectors.
Near-miss passage: CVE-2015-2751. CWE: CWE-17. CVSS: 7.099999904632568. Xen 4.3.x, 4.4.x, and 4.5.x, when using toolstack disaggregation, allows remote domains with partial management control to cause a denial of service (host lock) via unspecified domctl operations.
Query: describe CVE-2015-4703
Matching passage: CVE-2015-4703. CWE: CWE-22. CVSS: 5.300000190734863. Absolute path traversal vulnerability in mysqldump_download.php in the WordPress Rename plugin 1.0 for WordPress allows remote attackers to read arbitrary files via a full pathname in the dumpfname parameter.
Near-miss passage: CVE-2015-9464. CWE: CWE-22. CVSS: 7.5. The s3bubble-amazon-s3-html-5-video-with-adverts plugin 0.7 for WordPress has directory traversal via the adverts/assets/plugins/ultimate/content/downloader.php path parameter.
Query: alert when Detects suspicious PowerShell invocation command parameters
Matching passage: Sigma rule: Detects suspicious PowerShell invocation command parameters. Logsource: windows / ps_script. Rule: title: Suspicious PowerShell Invocations - Specific id: ae7fbf8e-f3cb-49fd-8db4-5f3bed522c71 related: - id: fce5f582-cc00-41e1-941a-c6fabf0fdb8c type: obsolete - id: 8ff28fdd-e2fa-4dfa-aeda-ef3d61c62090 type: similar - id: 536e2947-3729-478c-9903-745aaffe60d2 type: similar status: test description: Detects suspicious PowerShell invocation command parameters references: - Internal Research - https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro date: 2017-03-05 modified: 2025-02-17 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_convert_b64: ScriptBlockText|contains|all: - -nop - ' -w ' - hidden - ' -c ' - '[Convert]::FromBase64String' selection_iex_selection: ScriptBlockText|contains|all: - ' -w ' - hidden - -noni - -nop - ' -c ' - iex - New-Object selection_enc_selection: ScriptBlockText|contains|all: - ' -w ' - hidden - -ep - bypass - -Enc selection_reg_selection: ScriptBlockText|contains|all: - powershell - reg - add ScriptBlockText|contains: - \software\microsoft\windows\currentversion\run - \software\wow6432node\microsoft\windows\currentversion\run - \software\microsoft\windows\currentversion\policies\explorer\run selection_webclient_selection: ScriptBlockText|contains|all: - bypass - -noprofile - -windowstyle - hidden - new-object - system.net.webclient - .download selection_iex_webclient: ScriptBlockText|contains|all: - iex - New-Object - Net.WebClient - .Download filter_chocolatey: ScriptBlockText|contains: - (New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1 - (New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1') - Write-ChocolateyWarning condition: 1 of selection_* and not 1 of filter_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using SQLAuth.. Logsource: opencanary / application. Rule: title: OpenCanary - MSSQL Login Attempt Via SQLAuth id: 3ec9a16d-0b4f-4967-9542-ebf38ceac7dd status: test description: 'Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using SQLAuth. ' references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.credential-access - attack.collection - attack.t1003 - attack.t1213 logsource: category: application product: opencanary detection: selection: logtype: 9001 condition: selection falsepositives: - Unlikely level: high
Query: exploit The svn_repos_trace_node_locations function in Apache Subversion before 1.7.21 and 1.8.x before 1.8.14, when path-based authorization is used, allows remote authenticated users to 
Matching passage: CVE-2015-3187. CWE: CWE-200. CVSS: 4.0. The svn_repos_trace_node_locations function in Apache Subversion before 1.7.21 and 1.8.x before 1.8.14, when path-based authorization is used, allows remote authenticated users to obtain sensitive path information by reading the history of a node that has been moved from a hidden path.
Near-miss passage: CVE-2015-0519. CWE: CWE-200. CVSS: 2.0999999046325684. The InputAccel Database (IADB) installation process in EMC Captiva Capture 7.0 before patch 25 and 7.1 before patch 13 places a cleartext InputAccel (IA) SQL password in a DAL log file, which allows local users to obtain sensitive information by reading a file.
Query: vulnerability: Double free vulnerability in the format printer in PHP 7.x before 7.0.1 allows remote attackers to have an unspecified impact by triggering an error.
Matching passage: CVE-2015-8880. CWE: CWE-415. CVSS: 9.800000190734863. Double free vulnerability in the format printer in PHP 7.x before 7.0.1 allows remote attackers to have an unspecified impact by triggering an error.
Near-miss passage: CVE-2015-8962. CWE: CWE-415. CVSS: 7.300000190734863. Double free vulnerability in the sg_common_write function in drivers/scsi/sg.c in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (memory corruption and system crash) by detaching a device during an SG_IO ioctl call.
Query: risk of Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explore
Matching passage: CVE-2015-1691. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1712.
Near-miss passage: CVE-2015-5949. CWE: CWE-119. CVSS: 6.800000190734863. VideoLAN VLC media player 2.2.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted 3GP file, which triggers the freeing of arbitrary pointers.
Query: describe CVE-2015-7197
Matching passage: CVE-2015-7197. CWE: CWE-264. CVSS: 5.0. Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 improperly control the ability of a web worker to create a WebSocket object, which allows remote attackers to bypass intended mixed-content restrictions via crafted JavaScript code.
Near-miss passage: CVE-2015-1715. CWE: CWE-264. CVSS: 9.300000190734863. Microsoft Silverlight 5 before 5.1.40416.00 allows remote attackers to bypass intended integrity-level restrictions via a crafted Silverlight application, aka "Microsoft Silverlight Out of Browser Application Vulnerability."