alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-9256
Matching passage: CVE-2015-9256. CWE: CWE-200. CVSS: 5.300000190734863. Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information via access to device/VM restore mount points, because they do not have ACLs by default.
Near-miss passage: CVE-2015-5321. CWE: CWE-200. CVSS: 5.0. The sidepanel widgets in the CLI command overview and help pages in Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to the pages.
Query: playbook for alert: SIEM correlation: stealth activity consistent with Compiled HTML File
Matching passage: Playbook for T1218.001 Compiled HTML File. 1) Validate alert telemetry against T1218.001. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. (Citation: Microsoft HTML Help May 2018) CHM content is displayed using
Near-miss passage: Playbook for T1218.015 Electron Applications. Different response path focused on stealth.
Query: common weakness: Creation of Class Instance within a Static Code Block
Matching passage: CWE-1063 Creation of Class Instance within a Static Code Block. A static code block creates an instance of a class.
Near-miss passage: CWE-1222 Insufficient Granularity of Address Regions Protected by Register Locks. The product defines a large address region protected from modification by the same register lock control bit. This results in a conflict between the functional requirement that some addresses need to be writable by software during operation and the security requirement that the system configuration lock bit must be set during the boot process.
Query: describe CVE-2015-6752
Matching passage: CVE-2015-6752. CWE: CWE-79. CVSS: 2.0999999046325684. Cross-site scripting (XSS) vulnerability in the Search API Autocomplete module 7.x-1.x before 7.x-1.3 for Drupal, when the search index is configured to use the HTML filter processor, allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in the returned suggestions.
Near-miss passage: CVE-2015-1053. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the administrative backend in Croogo before 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the path parameter to admin/file_manager/file_manager/editfile.
Query: exploit Multiple integer overflows in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allow remote attackers to execute arbitrary code via a crafted saio chu
Matching passage: CVE-2015-4479. CWE: CWE-189. CVSS: 10.0. Multiple integer overflows in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allow remote attackers to execute arbitrary code via a crafted saio chunk in MPEG-4 video data.
Near-miss passage: CVE-2015-4625. CWE: CWE-189. CVSS: 4.599999904632568. Integer overflow in the authentication_agent_new_cookie function in PolicyKit (aka polkit) before 0.113 allows local users to gain privileges by creating a large number of connections, which triggers the issuance of a duplicate cookie value.
Query: vulnerability: QEMU (aka Quick Emulator) built with a VMWARE VMXNET3 paravirtual NIC emulator support is vulnerable to crash issue. It occurs when a guest sends a Layer-2 packet smaller than 22 b
Matching passage: CVE-2015-8744. CWE: CWE-20. CVSS: 5.5. QEMU (aka Quick Emulator) built with a VMWARE VMXNET3 paravirtual NIC emulator support is vulnerable to crash issue. It occurs when a guest sends a Layer-2 packet smaller than 22 bytes. A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance resulting in DoS.
Near-miss passage: CVE-2015-3004. CWE: CWE-20. CVSS: 4.300000190734863. J-Web in Juniper Junos 11.4 before 11.4R12, 12.1X44 before 12.1X44-D35, 12.1X46 before 12.1X46-D25, 12.1X47 before 12.1X47-D10, 12.3X48 before 12.3X48-D10, 12.2 before 12.2R9, 12.3 before 12.3R7, 13.2 before 13.2R6, 13.2X51 before 13.2X51-D20, 13.3 before 13.3R5, 14.1 before 14.1R3, 14.1X53 before 14.1X53-D10, and 14.2 before 14.2R1 allows remote attackers to conduct clickjacking attacks via an X-Frame-Options header.
Query: CVE similar to CVE-2015-0492
Matching passage: CVE-2015-0492. CWE: UNKNOWN. CVSS: 9.300000190734863. Unspecified vulnerability in Oracle Java SE 7u76 and 8u40, and JavaFX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-0484.
Near-miss passage: CVE-2015-2789. CWE: UNKNOWN. CVSS: 4.400000095367432. Unquoted Windows search path vulnerability in the Foxit Cloud Safe Update Service in the Cloud plugin in Foxit Reader 6.1 through 7.0.6.1126 allows local users to gain privileges via a Trojan horse program in the %SYSTEMDRIVE% folder.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: There is an option for a MS VS Just-In-Time Debugger "vsjitdebugger.exe" to launch specified executable and attach a deb. Logsource: windows / process_creation. Rule: title: Malicious PE Execution by Microsoft Visual Studio Debugger id: 15c7904e-6ad1-4a45-9b46-5fb25df37fd2 status: test description: 'There is an option for a MS VS Just-In-Time Debugger "vsjitdebugger.exe" to launch specified executable and attach a debugger. This option may be used adversaries to execute malicious code by signed verified binary. The debugger is installed alongside with Microsoft Visual Studio package. ' references: - https://twitter.com/pabraeken/status/990758590020452353 - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Vsjitdebugger/ - https://learn.microsoft.com/en-us/visualstudio/debugger/debug-using-the-just-in-time-debugger?view=vs-2019 author: Agro (@agro_sev), Ensar Şamil (@sblmsrsn), oscd.community date: 2020-10-14 modified: 2022-10-09 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \vsjitdebugger.exe reduction1: Image|endswith: \vsimmersiveactivatehelper*.exe reduction2: Image|endswith: \devenv.exe condition: selection and not (reduction1 or reduction2) falsepositives: - The process spawned by vsjitdebugger.exe is uncommon. level: medium
Near-miss passage: Sigma rule: Detects successful installation of Atera Remote Monitoring & Management (RMM) agent as recently found to be used by Cont. Logsource: windows / application. Rule: title: Atera Agent Installation id: 87261fb2-69d0-42fe-b9de-88c6b5f65a43 status: test description: Detects successful installation of Atera Remote Monitoring & Management (RMM) agent as recently found to be used by Conti operators references: - https://www.advintel.io/post/secret-backdoor-behind-conti-ransomware-operation-introducing-atera-agent author: Bhabesh Raj date: 2021-09-01 modified: 2022-12-25 tags: - attack.command-and-control - attack.t1219.002 logsource: service: application product: windows detection: selection: EventID: 1033 Provider_Name: MsiInstaller Message|contains: AteraAgent condition: selection falsepositives: - Legitimate Atera agent installation level: high
Query: vulnerability: Absolute path traversal vulnerability in lib/download.php in the IBS Mappro plugin before 1.0 for WordPress allows remote attackers to read arbitrary files via a full pathname in t
Matching passage: CVE-2015-5472. CWE: CWE-22. CVSS: 7.800000190734863. Absolute path traversal vulnerability in lib/download.php in the IBS Mappro plugin before 1.0 for WordPress allows remote attackers to read arbitrary files via a full pathname in the file parameter.
Near-miss passage: CVE-2015-3337. CWE: CWE-22. CVSS: 4.300000190734863. Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, allows remote attackers to read arbitrary files via unspecified vectors.
Query: alert when Detects execution of Impacket's psexec.py.
Matching passage: Sigma rule: Detects execution of Impacket's psexec.py.. Logsource: windows / security. Rule: title: Impacket PsExec Execution id: 32d56ea1-417f-44ff-822b-882873f5f43b status: test description: Detects execution of Impacket's psexec.py. references: - https://web.archive.org/web/20230329171218/https://blog.menasec.net/2019/02/threat-hunting-3-detecting-psexec.html author: Bhabesh Raj date: 2020-12-14 modified: 2022-09-22 tags: - attack.lateral-movement - attack.t1021.002 logsource: product: windows service: security definition: The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure detection: selection1: EventID: 5145 ShareName: \\\\\*\\IPC$ RelativeTargetName|contains: - RemCom_stdin - RemCom_stdout - RemCom_stderr condition: selection1 falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the addition of the 'MiniNt' key to the registry. Upon a reboot, Windows Event Log service will stop writing eve. Logsource: windows / registry_set. Rule: title: Security Event Logging Disabled via MiniNt Registry Key - Registry Set id: 8839e550-52d7-4958-9f2f-e13c1e736838 related: - id: 1a4bd6af-99ac-4466-b5b2-7b72b4a05462 type: similar status: experimental description: 'Detects the addition of the ''MiniNt'' key to the registry. Upon a reboot, Windows Event Log service will stop writing events. Windows Event Log is a service that collects and stores event logs from the operating system and applications. It is an important component of Windows security and auditing. Adversary may want to disable this service to disable logging of security events which could be used to detect their activities. ' references: - https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-04-09 tags: - attack.persistence - attack.defense-impairment - attack.t1685.001 - attack.t1112 - car.2022-03-001 logsource: category: registry_set product: windows detection: selection: TargetObject: HKLM\System\CurrentControlSet\Control\MiniNt\(Default) condition: selection falsepositives: - Highly Unlikely level: high
Query: CVE similar to CVE-2015-9406
Matching passage: CVE-2015-9406. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in the mTheme-Unus theme before 2.3 for WordPress allows an attacker to read arbitrary files via a .. (dot dot) in the files parameter to css/css.php.
Near-miss passage: CVE-2015-7888. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in the WifiHs20UtilityService on the Samsung S6 Edge LRX22G.G925VVRU1AOE2 allows remote attackers to overwrite or create arbitrary files as the system-level user via a .. (dot dot) in the name of a file, compressed into a zipped file named cred.zip, and downloaded to /sdcard/Download.
Query: CVE similar to CVE-2015-3040
Matching passage: CVE-2015-3040. CWE: CWE-200. CVSS: 5.0. Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux does not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors, a different vulnerability than CVE-2015-0357.
Near-miss passage: CVE-2015-8095. CWE: CWE-200. CVSS: 5.0. The recycle bin feature in the Monster Menus module 7.x-1.21 before 7.x-1.24 for Drupal does not properly remove nodes from view, which allows remote attackers to obtain sensitive information via an unspecified URL pattern.
Query: exploit Cross-site request forgery (CSRF) vulnerability in the Spider Video Player module for Drupal allows remote attackers to hijack the authentication of administrators for requests tha
Matching passage: CVE-2015-4352. CWE: CWE-352. CVSS: 5.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Spider Video Player module for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete videos via unspecified vectors.
Near-miss passage: CVE-2015-5188. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Web Console (web-console) in Red Hat Enterprise Application Platform before 6.4.4 and WildFly (formerly JBoss Application Server) before 2.0.0.CR9 allows remote attackers to hijack the authentication of administrators for requests that make arbitrary changes to an instance via vectors involving a file upload using a multipart/form-data submission.
Query: vulnerability: Unspecified vulnerability in the Oracle WebCenter Portal component in Oracle Fusion Middleware 11.1.1.8.0 allows remote attackers to affect integrity via unknown vectors related to
Matching passage: CVE-2015-0456. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle WebCenter Portal component in Oracle Fusion Middleware 11.1.1.8.0 allows remote attackers to affect integrity via unknown vectors related to Portlet Services.
Near-miss passage: CVE-2015-4876. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53 and 8.54 allows remote authenticated users to affect integrity via unknown vectors related to Pivot Grid.
Query: rule covering Detects the use of Python's base64 decoding functions in command line executions on Linux systems. Malicious scripts oft
Matching passage: Sigma rule: Detects the use of Python's base64 decoding functions in command line executions on Linux systems. Malicious scripts oft. Logsource: linux / process_creation. Rule: title: Python One-Liners with Base64 Decoding - Linux id: 55e862a8-dd9c-4651-807a-f21fcad56716 related: - id: 50a0aa3d-ab16-4594-a8aa-5145a6e6792b type: similar status: experimental description: 'Detects the use of Python''s base64 decoding functions in command line executions on Linux systems. Malicious scripts often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion. ' references: - https://docs.python.org/3/library/base64.html - https://www.virustotal.com/gui/file/bc43e925d7b4b74319f6e74e836a96f1997ba404e14ac566cf12a21e9da463db/behavior - https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites author: Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-03-09 tags: - attack.execution - attack.stealth - attack.t1059.006 - attack.t1027.010 logsource: category: process_creation product: linux detection: selection_img: Image|contains: /python selection_cli: CommandLine|contains|all: - import - base64 - ' -c' CommandLine|contains: - .decode - b16decode - b32decode - b32hexdecode - b64decode - b85decode - z85decode condition: all of selection_* falsepositives: - Legitimate use of Python for decoding data, which is uncommon in typical enterprise environments but possible in development or data analysis contexts. level: high
Near-miss passage: Sigma rule: Monitor and alert on group membership removal of groups that have CA policy modification access. Logsource: azure / auditlogs. Rule: title: User Removed From Group With CA Policy Modification Access id: 665e2d43-70dc-4ccc-9d27-026c9dd7ed9c status: test description: Monitor and alert on group membership removal of groups that have CA policy modification access references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure#conditional-access author: Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner' date: 2022-08-04 tags: - attack.privilege-escalation - attack.credential-access - attack.persistence - attack.defense-impairment - attack.t1548 - attack.t1556 logsource: product: azure service: auditlogs detection: selection: properties.message: Remove member from group condition: selection falsepositives: - User removed from the group is approved level: medium
Query: Sigma rule for Detects when Kubernetes Secrets are Modified or Deleted.
Matching passage: Sigma rule: Detects when Kubernetes Secrets are Modified or Deleted.. Logsource: kubernetes / audit. Rule: title: Kubernetes Secrets Modified or Deleted id: 58d31a75-a4f8-4c40-985b-373d58162ca2 related: - id: 2f0bae2d-bf20-4465-be86-1311addebaa3 type: similar status: test description: 'Detects when Kubernetes Secrets are Modified or Deleted. ' references: - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/ - https://commandk.dev/blog/guide-to-audit-k8s-secrets-for-compliance/ author: kelnage date: 2024-07-11 tags: - attack.credential-access logsource: product: kubernetes service: audit detection: selection: objectRef.resource: secrets verb: - create - delete - patch - replace - update condition: selection falsepositives: - Secrets being modified or deleted may be performed by a system administrator. - Automated processes may need to take these actions and may need to be filtered. level: medium
Near-miss passage: Sigma rule: Detects potential web shell execution from the ScreenConnect server process.. Logsource: windows / process_creation. Rule: title: Remote Access Tool - ScreenConnect Server Web Shell Execution id: b19146a3-25d4-41b4-928b-1e2a92641b1b status: test description: Detects potential web shell execution from the ScreenConnect server process. references: - https://blackpointcyber.com/resources/blog/breaking-through-the-screen/ - https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8 author: Jason Rathbun (Blackpoint Cyber) date: 2024-02-26 tags: - attack.initial-access - attack.t1190 logsource: product: windows category: process_creation detection: selection: ParentImage|endswith: \ScreenConnect.Service.exe Image|endswith: - \cmd.exe - \csc.exe condition: selection falsepositives: - Unlikely level: high
Query: alert when Detects setting of a new registry database value related to BgInfo configuration. Attackers can for example set this val
Matching passage: Sigma rule: Detects setting of a new registry database value related to BgInfo configuration. Attackers can for example set this val. Logsource: windows / registry_set. Rule: title: New BgInfo.EXE Custom DB Path Registry Configuration id: 53330955-dc52-487f-a3a2-da24dcff99b5 status: test description: Detects setting of a new registry database value related to BgInfo configuration. Attackers can for example set this value to save the results of the commands executed by BgInfo in order to exfiltrate information. references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-16 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Software\Winternals\BGInfo\Database condition: selection falsepositives: - Legitimate use of external DB to save the results level: medium
Near-miss passage: Sigma rule: Detects suspicious user agent strings user by hack tools in proxy logs. Logsource: proxy. Rule: title: Hack Tool User Agent id: c42a3073-30fb-48ae-8c99-c23ada84b103 status: test description: Detects suspicious user agent strings user by hack tools in proxy logs references: - https://github.com/fastly/waf_testbed/blob/8bfc406551f3045e418cbaad7596cff8da331dfc/templates/default/scanners-user-agents.data.erb - http://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-user_agents.rules author: Florian Roth (Nextron Systems) date: 2017-07-08 modified: 2022-07-07 tags: - attack.initial-access - attack.t1190 - attack.credential-access - attack.t1110 logsource: category: proxy detection: selection: c-useragent|contains: - (hydra) - ' arachni/' - ' BFAC ' - ' brutus ' - ' cgichk ' - core-project/1.0 - ' crimscanner/' - datacha0s - dirbuster - domino hunter - dotdotpwn - FHScan Core - floodgate - get-minimal - gootkit auto-rooter scanner - grendel-scan - ' inspath ' - internet ninja - jaascois - ' zmeu ' - masscan - ' metis ' - morfeus fucking scanner - n-stealth - nsauditor - pmafind - security scan - springenwerk - teh forest lobster - toata dragostea - ' vega/' - voideye - webshag - webvulnscan - ' whcc/' - ' Havij' - absinthe - bsqlbf - mysqloit - pangolin - sql power injector - sqlmap - sqlninja - uil2pn - ruler - Mozilla/5.0 (Windows; U; Windows NT 5.1; pt-PT; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR 3.5.30729) condition: selection falsepositives: - Unknown level: high
Query: vulnerability: Cross-site scripting (XSS) vulnerability in the Camtasia Relay module 6.x-2.x before 6.x-3.2 and 7.x-2.x before 7.x-1.3 for Drupal allows remote authenticated users with the "view 
Matching passage: CVE-2015-5487. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Camtasia Relay module 6.x-2.x before 6.x-3.2 and 7.x-2.x before 7.x-1.3 for Drupal allows remote authenticated users with the "view meta information" permission to inject arbitrary web script or HTML via unspecified vectors related to the meta access tab.
Near-miss passage: CVE-2015-2764. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Websense TRITON AP-DATA before 8.0.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to the DSS (1) Mobile or (2) DLP report catalog.
Query: exploit Multiple cross-site scripting (XSS) vulnerabilities in HP ArcSight Management Center before 2.1 and ArcSight Logger before 6.1 allow remote attackers to inject arbitrary web script
Matching passage: CVE-2015-5441. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in HP ArcSight Management Center before 2.1 and ArcSight Logger before 6.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-10075. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability was found in Custom-Content-Width 1.0. It has been declared as problematic. Affected by this vulnerability is the function override_content_width/register_settings of the file custom-content-width.php. The manipulation leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.1 is able to address this issue. The patch is named e05e0104fc42ad13b57e2b2cb2d1857432624d39. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220219. NOTE: This attack is not very likely.
Query: risk of Cross-site scripting (XSS) vulnerability in Polycom RealPresence CloudAXIS Suite before 1.7.0 allows remote authenticated users to inject arbitrary web script or HTML via unspecifi
Matching passage: CVE-2015-1516. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in Polycom RealPresence CloudAXIS Suite before 1.7.0 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-1204. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Save Filters functionality in the WP Slimstat plugin before 3.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the fs[resource] parameter in the wp-slim-view-2 page to wp-admin/admin.php.