alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit The Bluetooth subsystem in Apple OS X before 10.10.5 does not properly restrict Notification Center Service access, which allows attackers to read Notification Center notifications
Matching passage: CVE-2015-3786. CWE: CWE-200. CVSS: 4.300000190734863. The Bluetooth subsystem in Apple OS X before 10.10.5 does not properly restrict Notification Center Service access, which allows attackers to read Notification Center notifications of certain paired devices via a crafted app.
Near-miss passage: CVE-2015-6624. CWE: CWE-200. CVSS: 4.300000190734863. System Server in Android 6.0 before 2015-12-01 allows attackers to obtain sensitive information via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 23999740.
Query: Sigma rule for Detects the execution of the "msxsl" binary with an "http" keyword in the command line. This might indicate a potential
Matching passage: Sigma rule: Detects the execution of the "msxsl" binary with an "http" keyword in the command line. This might indicate a potential. Logsource: windows / process_creation. Rule: title: Remote XSL Execution Via Msxsl.EXE id: 75d0a94e-6252-448d-a7be-d953dff527bb status: test description: Detects the execution of the "msxsl" binary with an "http" keyword in the command line. This might indicate a potential remote execution of XSL files. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1220/T1220.md - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msxsl/ author: Swachchhanda Shrawan Poudel date: 2023-11-09 tags: - attack.stealth - attack.t1220 logsource: category: process_creation product: windows detection: selection: Image|endswith: \msxsl.exe CommandLine|contains: http condition: selection falsepositives: - Msxsl is not installed by default and is deprecated, so unlikely on most systems. level: high
Near-miss passage: Sigma rule: Detect when users are authenticating without MFA being required.. Logsource: azure / signinlogs. Rule: title: Azure AD Only Single Factor Authentication Required id: 28eea407-28d7-4e42-b0be-575d5ba60b2c status: test description: Detect when users are authenticating without MFA being required. references: - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-user-accounts author: MikeDuddington, '@dudders1' date: 2022-07-27 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.credential-access - attack.stealth - attack.defense-impairment - attack.t1078.004 - attack.t1556.006 logsource: product: azure service: signinlogs detection: selection: Status: Success AuthenticationRequirement: singleFactorAuthentication condition: selection falsepositives: - If this was approved by System Administrator. level: low
Query: describe CVE-2015-1547
Matching passage: CVE-2015-1547. CWE: CWE-119. CVSS: 6.5. The NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted TIFF image, as demonstrated by libtiff5.tif.
Near-miss passage: CVE-2015-3746. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Query: weakness Improper Neutralization of Leading Special Elements
Matching passage: CWE-160 Improper Neutralization of Leading Special Elements. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes leading special elements that could be interpreted in unexpected ways when they are sent to a downstream component.
Near-miss passage: CWE-554 ASP.NET Misconfiguration: Not Using Input Validation Framework. The ASP.NET application does not use an input validation framework.
Query: describe CVE-2015-3675
Matching passage: CVE-2015-3675. CWE: CWE-284. CVSS: 5.0. The default configuration of the Apache HTTP Server on Apple OS X before 10.10.4 does not enable the mod_hfs_apple module, which allows remote attackers to bypass HTTP authentication via a crafted URL.
Near-miss passage: CVE-2015-3155. CWE: CWE-284. CVSS: 5.0. Foreman before 1.8.1 does not set the secure flag for the _session_id cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
Query: patch priority for CVE-2015-2706
Matching passage: CVE-2015-2706. CWE: CWE-362. CVSS: 6.800000190734863. Race condition in the AsyncPaintWaitEvent::AsyncPaintWaitEvent function in Mozilla Firefox before 37.0.2 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via a crafted plugin that does not properly complete initialization.
Near-miss passage: CVE-2015-7550. CWE: CWE-362. CVSS: 5.5. The keyctl_read_key function in security/keys/keyctl.c in the Linux kernel before 4.3.4 does not properly use a semaphore, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted application that leverages a race condition between keyctl_revoke and keyctl_read calls.
Query: Sigma YAML for windows / file_event
Matching passage: Sigma rule: Detects the creation of potentially suspicious files by OpenEDR's ITSMService process. The ITSMService is responsible fo. Logsource: windows / file_event. Rule: title: Potentially Suspicious File Creation by OpenEDR's ITSMService id: 9e4b7d3a-6f2c-4e9a-8d1b-3c5e7a9f2b4d status: experimental description: 'Detects the creation of potentially suspicious files by OpenEDR''s ITSMService process. The ITSMService is responsible for remote management operations and can create files on the system through the Process Explorer or file management features. While legitimate for IT operations, creation of executable or script files could indicate unauthorized file uploads, data staging, or malicious file deployment. ' author: '@kostastsale' date: 2026-02-19 references: - https://kostas-ts.medium.com/detecting-abuse-of-openedrs-permissive-edr-trial-a-security-researcher-s-perspective-fc55bf53972c tags: - attack.command-and-control - attack.t1105 - attack.lateral-movement - attack.t1570 - attack.t1219 logsource: product: windows category: file_event detection: selection_process: Image|endswith: \COMODO\Endpoint Manager\ITSMService.exe selection_suspicious_extensions: TargetFilename|endswith: - .7z - .bat - .cmd - .com - .dll - .exe - .hta - .js - .pif - .ps1 - .rar - .scr - .vbe - .vbs - .zip condition: all of selection_* falsepositives: - Legitimate OpenEDR file management operations - Authorized remote file uploads by IT administrators - Software deployment through OpenEDR console level: medium
Near-miss passage: Sigma rule: Detects command line parameters used by ADCSPwn, a tool to escalate privileges in an active directory network by coercin. Logsource: windows / process_creation. Rule: title: HackTool - ADCSPwn Execution id: cd8c163e-a19b-402e-bdd5-419ff5859f12 status: test description: Detects command line parameters used by ADCSPwn, a tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service references: - https://github.com/bats3c/ADCSPwn author: Florian Roth (Nextron Systems) date: 2021-07-31 modified: 2023-02-04 tags: - attack.collection - attack.credential-access - attack.t1557.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - ' --adcs ' - ' --port ' condition: selection falsepositives: - Unlikely level: high
Query: vulnerability: The Newphoria MEGAPHONE MUSIC application before 1.1 for Android and before 1.1 for iOS allows attackers to bypass a URL whitelist protection mechanism and obtain API access via un
Matching passage: CVE-2015-5634. CWE: CWE-264. CVSS: 6.800000190734863. The Newphoria MEGAPHONE MUSIC application before 1.1 for Android and before 1.1 for iOS allows attackers to bypass a URL whitelist protection mechanism and obtain API access via unspecified vectors.
Near-miss passage: CVE-2015-2364. CWE: CWE-264. CVSS: 7.199999809265137. The graphics component in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application that leverages an incorrect bitmap conversion, aka "Graphics Component EOP Vulnerability."
Query: CVE similar to CVE-2015-7620
Matching passage: CVE-2015-7620. CWE: UNKNOWN. CVSS: 6.800000190734863. The ANSendForBrowserReview method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6712, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7616, CVE-2015-7618, CVE-2015-7619, and CVE-2015-7623.
Near-miss passage: CVE-2015-2994. CWE: UNKNOWN. CVSS: 6.5. Unrestricted file upload vulnerability in ChangePhoto.jsp in SysAid Help Desk before 15.2 allows remote administrators to execute arbitrary code by uploading a file with a .jsp extension, then accessing it via a direct request to the file in icons/user_photo/.
Query: write Sigma for Detects suspicious processes including shells spawnd from WinRM host process
Matching passage: Sigma rule: Detects suspicious processes including shells spawnd from WinRM host process. Logsource: windows / process_creation. Rule: title: Suspicious Processes Spawned by WinRM id: 5cc2cda8-f261-4d88-a2de-e9e193c86716 status: test description: Detects suspicious processes including shells spawnd from WinRM host process author: Andreas Hunkeler (@Karneades), Markus Neis references: - Internal Research date: 2021-05-20 modified: 2022-07-14 tags: - attack.t1190 - attack.initial-access - attack.persistence - attack.privilege-escalation logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \wsmprovhost.exe Image|endswith: - \cmd.exe - \sh.exe - \bash.exe - \powershell.exe - \pwsh.exe - \wsl.exe - \schtasks.exe - \certutil.exe - \whoami.exe - \bitsadmin.exe condition: selection falsepositives: - Legitimate WinRM usage level: high
Near-miss passage: Sigma rule: Detects outlvba (Microsoft VBA for Outlook Addin) DLL being loaded by the outlook process. Logsource: windows / image_load. Rule: title: Microsoft VBA For Outlook Addin Loaded Via Outlook id: 9a0b8719-cd3c-4f0a-90de-765a4cb3f5ed status: test description: Detects outlvba (Microsoft VBA for Outlook Addin) DLL being loaded by the outlook process references: - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=58 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-08 modified: 2024-03-12 tags: - attack.execution - attack.t1204.002 logsource: category: image_load product: windows detection: selection: Image|endswith: \outlook.exe ImageLoaded|endswith: \outlvba.dll condition: selection falsepositives: - Legitimate macro usage. Add the appropriate filter according to your environment level: medium
Query: detection engineering for Email Addresses
Matching passage: T1589.002 Email Addresses. Tactics: reconnaissance. Description: Adversaries may gather email addresses that can be used during targeting. Even if internal instances exist, organizations may have public-facing email infrastructure and addresses for employees. Adversaries may easily gather email addresses, since they may be readily available and exposed via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: HackersArise Email)(Citation: CNET Leaks) Email addresses could also be enumerated via more active means (i.e. [Active Scanning](https://attack.mitre.org/techniques/T1595)), such as probing and analyzing responses from authentication services that may reveal valid usernames in a system.(Citation: GrimBlog UsernameEnum) For example, adversaries may be able to enumerate email addresses in Office 365 environments by querying a variety of publicly available API endpoints, such as autodiscover and GetCredentialType.(Citation: GitHub Office 365 User Enumeration)(Citation: Azure Active Directory Reconnaisance) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Email Accounts](https://attack.mitre.org/techniques/T1586/002)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Brute Force](https://attack.mitre.org/techniques/T1110) via [External Remote Services](https://attack.mitre.org/techniques/T1133)).
Near-miss passage: T1589.003 Employee Names. Tactics: reconnaissance. Description: Adversaries may gather employee names that can be used during targeting. Employee names be used to derive email addresses as well as to help guide other reconnaissance efforts and/or craft more-believable lures. Adversaries may easily gather employee names, since they may be readily available and exposed via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: OPM Leak) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).
Query: describe CVE-2015-5591
Matching passage: CVE-2015-5591. CWE: CWE-89. CVSS: 7.199999809265137. SQL injection vulnerability in Zenphoto before 1.4.9 allow remote administrators to execute arbitrary SQL commands.
Near-miss passage: CVE-2015-1576. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in u5CMS before 3.9.4 allow remote attackers to execute arbitrary SQL commands via the name parameter to (1) copy2.php, (2) localize.php, (3) metai.php, (4) nc.php, (5) new2.php, or (6) rename2.php in u5admin/; (7) c parameter to u5admin/editor.php; (8) typ parameter to u5admin/meta2.php; or (9) newname parameter to u5admin/rename2.php.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in admin/comments.php in Dotclear before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via the author name in a comm
Matching passage: CVE-2015-8831. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in admin/comments.php in Dotclear before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via the author name in a comment.
Near-miss passage: CVE-2015-1437. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Asus RT-N10+ D1 router with firmware 2.1.1.1.70 allow remote attackers to inject arbitrary web script or HTML via the flag parameter to (1) result_of_get_changed_status.asp or (2) error_page.htm.
Query: exploit Open redirect vulnerability in the clean_param function in lib/moodlelib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allows remote 
Matching passage: CVE-2015-3272. CWE: UNKNOWN. CVSS: 7.400000095367432. Open redirect vulnerability in the clean_param function in lib/moodlelib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving an HTTP Referer header that has a substring match with a local URL.
Near-miss passage: CVE-2015-4812. CWE: UNKNOWN. CVSS: 2.5999999046325684. Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 11.1.1.9 allows remote attackers to affect confidentiality via vectors related to OSSL Module.
Query: risk of Multiple cross-site scripting (XSS) vulnerabilities in the Welcart plugin before 1.4.18 for WordPress allow remote attackers to inject arbitrary web script or HTML via the usces_re
Matching passage: CVE-2015-2973. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the Welcart plugin before 1.4.18 for WordPress allow remote attackers to inject arbitrary web script or HTML via the usces_referer parameter to (1) classes/usceshop.class.php, (2) includes/edit-form-advanced.php, (3) includes/edit-form-advanced30.php, (4) includes/edit-form-advanced34.php, (5) includes/member_edit_form.php, (6) includes/order_edit_form.php, (7) includes/order_list.php, or (8) includes/usces_item_master_list.php, related to admin.php.
Near-miss passage: CVE-2015-0862. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in the management web UI in the RabbitMQ management plugin before 3.4.3 allow remote authenticated users to inject arbitrary web script or HTML via (1) message details when a message is unqueued, such as headers or arguments; (2) policy names, which are not properly handled when viewing policies; (3) details for AMQP network clients, such as the version; allow remote authenticated administrators to inject arbitrary web script or HTML via (4) user names, (5) the cluster name; or allow RabbitMQ cluster administrators to (6) modify unspecified content.
Query: describe CVE-2015-3791
Matching passage: CVE-2015-3791. CWE: CWE-119. CVSS: 6.800000190734863. QuickTime 7 in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted file, a different vulnerability than CVE-2015-3765, CVE-2015-3779, CVE-2015-3788, CVE-2015-3789, CVE-2015-3790, CVE-2015-3792, CVE-2015-5751, CVE-2015-5753, and CVE-2015-5779.
Near-miss passage: CVE-2015-5131. CWE: CWE-119. CVSS: 10.0. Buffer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5132 and CVE-2015-5133.
Query: detection rule: Detects usage of the PHP CLI with the "-r" flag which allows it to run inline PHP code. The rule looks for calls to the
Matching passage: Sigma rule: Detects usage of the PHP CLI with the "-r" flag which allows it to run inline PHP code. The rule looks for calls to the. Logsource: linux / process_creation. Rule: title: Potential PHP Reverse Shell id: c6714a24-d7d5-4283-a36b-3ffd091d5f7e status: test description: 'Detects usage of the PHP CLI with the "-r" flag which allows it to run inline PHP code. The rule looks for calls to the "fsockopen" function which allows the creation of sockets. Attackers often leverage this in combination with functions such as "exec" or "fopen" to initiate a reverse shell connection. ' references: - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet - https://www.revshells.com/ author: '@d4ns4n_' date: 2023-04-07 tags: - attack.execution logsource: category: process_creation product: linux detection: selection: Image|contains: /php CommandLine|contains|all: - ' -r ' - fsockopen CommandLine|contains: - ash - bash - bsh - csh - ksh - pdksh - sh - tcsh - zsh condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a potentially suspicious execution of a process located in the '/tmp/' folder. Logsource: linux / process_creation. Rule: title: Potentially Suspicious Execution From Tmp Folder id: 312b42b1-bded-4441-8b58-163a3af58775 status: test description: Detects a potentially suspicious execution of a process located in the '/tmp/' folder references: - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/ - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-06-02 modified: 2025-08-05 tags: - attack.stealth - attack.t1036 logsource: product: linux category: process_creation detection: selection: Image|startswith: /tmp/ filter_optional_nextcloud: Image|endswith: /usr/bin/nextcloud condition: selection and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-3798
Matching passage: CVE-2015-3798. CWE: CWE-119. CVSS: 7.5. The TRE library in Libc in Apple iOS before 8.4.1 and OS X before 10.10.5 allows context-dependent attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted regular expression, a different vulnerability than CVE-2015-3796 and CVE-2015-3797.
Near-miss passage: CVE-2015-9126. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 835, SD 845, SD 850, and SDX20, possible buffer overflow when processing 1X circuit service message.
Query: risk of bsdtar in libarchive before 3.2.0 returns a success code without filling the entry when the header is a "split file in multivolume RAR," which allows remote attackers to cause a de
Matching passage: CVE-2015-8916. CWE: CWE-476. CVSS: 6.5. bsdtar in libarchive before 3.2.0 returns a success code without filling the entry when the header is a "split file in multivolume RAR," which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted rar file.
Near-miss passage: CVE-2015-9127. CWE: CWE-476. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, and SD 810, possible null pointer dereference occurs due to failure of memory allocation when a large value is passed for buffer allocation in the Playready App.
Query: describe CVE-2015-0483
Matching passage: CVE-2015-0483. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect integrity via unknown vectors.
Near-miss passage: CVE-2015-0365. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Siebel Core - Server Infrastructure component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Security.