alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-0019
Matching passage: CVE-2015-0019. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-4277. CWE: CWE-399. CVSS: 4.900000095367432. The global-configuration implementation on Cisco ASR 9000 devices with software 5.1.3 and 5.3.0 improperly closes vty sessions after a commit/end operation, which allows local users to cause a denial of service (tmp/*config file creation, memory consumption, and device hang) via unspecified vectors, aka Bug ID CSCut93842.
Query: exploit Cross-site request forgery (CSRF) vulnerability on Actiontec GT784WN modems with firmware before NCS01-1.0.13 allows remote attackers to hijack the authentication or intranet conne
Matching passage: CVE-2015-2905. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability on Actiontec GT784WN modems with firmware before NCS01-1.0.13 allows remote attackers to hijack the authentication or intranet connectivity of arbitrary users.
Near-miss passage: CVE-2015-6973. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the authentication of administrators for requests that (1) change a password via a crafted request to user-password.jsp, (2) add users via a crafted request to user-create.jsp, (3) edit server settings or (4) disable SSL on the server via a crafted request to server-props.jsp, or (5) add clients via a crafted request to plugins/clientcontrol/permitted-clients.jsp.
Query: exploit Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R
Matching passage: CVE-2015-0087. CWE: CWE-200. CVSS: 5.0. Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to obtain sensitive information from kernel memory, and possibly bypass the KASLR protection mechanism, via a crafted font, aka "Adobe Font Driver Information Disclosure Vulnerability," a different vulnerability than CVE-2015-0089.
Near-miss passage: CVE-2015-0170. CWE: CWE-200. CVSS: 2.0999999046325684. IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows local users to obtain sensitive information by reading cached data.
Query: Sigma rule for Detects execution of WSASS, a tool used to dump LSASS memory on Windows systems by leveraging WER's (Windows Error Repor
Matching passage: Sigma rule: Detects execution of WSASS, a tool used to dump LSASS memory on Windows systems by leveraging WER's (Windows Error Repor. Logsource: windows / process_creation. Rule: title: HackTool - WSASS Execution id: 589ac73f-8e12-409c-964e-31a2f5775ae2 status: experimental description: 'Detects execution of WSASS, a tool used to dump LSASS memory on Windows systems by leveraging WER''s (Windows Error Reporting) WerFaultSecure.EXE to bypass PPL (Protected Process Light) protections. ' references: - https://github.com/TwoSevenOneT/WSASS - https://www.zerosalarium.com/2025/09/Dumping-LSASS-With-WER-On-Modern-Windows-11.html author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-23 modified: 2026-01-09 tags: - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \wsass.exe selection_hash: Hashes|contains: IMPHASH=32F5095C9BBDCACF28FD4060EB4DFC42 selection_cli: CommandLine|re: (?i)\.exe[\"\']?\s+[^\"]{0,64}werfaultsecure\.exe[\"\']?\s+\d{2,10} condition: 1 of selection_* falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_hktl_wsass/info.yml
Near-miss passage: Sigma rule: This rule will collect the data needed to start looking into possible kerberoasting activity. Further analysis or comput. Logsource: windows / security. Rule: title: Kerberoasting Activity - Initial Query id: d04ae2b8-ad54-4de0-bd87-4bc1da66aa59 status: test description: 'This rule will collect the data needed to start looking into possible kerberoasting activity. Further analysis or computation within the query is needed focusing on requests from one specific host/IP towards multiple service names within a time period of 5 seconds. You can then set a threshold for the number of requests and time between the requests to turn this into an alert. ' references: - https://www.trustedsec.com/blog/art_of_kerberoast/ - https://adsecurity.org/?p=3513 author: '@kostastsale' date: 2022-01-21 modified: 2025-10-19 tags: - attack.credential-access - attack.t1558.003 logsource: product: windows service: security detection: selection: EventID: 4769 Status: '0x0' TicketEncryptionType: '0x17' filter_main_krbtgt: ServiceName|endswith: - krbtgt - $ filter_main_machine_accounts: TargetUserName|contains: $@ condition: selection and not 1 of filter_main_* falsepositives: - Legacy applications. level: medium
Query: vulnerability: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, A
Matching passage: CVE-2015-7637. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7636, CVE-2015-7638, CVE-2015-7639, CVE-2015-7640, CVE-2015-7641, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644.
Near-miss passage: CVE-2015-0207. CWE: UNKNOWN. CVSS: 5.0. The dtls1_listen function in d1_lib.c in OpenSSL 1.0.2 before 1.0.2a does not properly isolate the state information of independent data streams, which allows remote attackers to cause a denial of service (application crash) via crafted DTLS traffic, as demonstrated by DTLS 1.0 traffic to a DTLS 1.2 server.
Query: Suspicious Keylogging execution detected on endpoint
Matching passage: T1056.001 Keylogging. Tactics: collection, credential access. Description: Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.(Citation: Talos Kimsuky Nov 2021) Keylogging is the most prevalent type of input capture, with many different ways of intercepting keystrokes.(Citation: Adventures of a Keystroke) Some methods include: * Hooking API callbacks used for processing keystrokes. Unlike [Credential API Hooking](https://attack.mitre.org/techniques/T1056/004), this focuses solely on API functions intended for processing keystroke data. * Reading raw keystroke data from the hardware buffer. * Windows Registry modifications. * Custom drivers. * [Modify System Image](https://attack.mitre.org/techniques/T1601) may provide adversaries with hooks into the operating system of network devices to read raw keystrokes for login sessions.(Citation: Cisco Blog Legacy Device Attacks)
Near-miss passage: T1056.003 Web Portal Capture. Tactics: collection, credential access. Description: Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service. This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through [External Remote Services](https://attack.mitre.org/techniques/T1133) and [Valid Accounts](https://attack.mitre.org/techniques/T1078) or as part of the initial compromise by exploitation of the externally facing web service.(Citation: Volexity Virtual Private Keylogging)
Query: Sigma YAML for windows / process_access
Matching passage: Sigma rule: Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace. Logsource: windows / process_access. Rule: title: Credential Dumping Attempt Via WerFault id: e5b33f7d-eb93-48b6-9851-09e1e610b6d7 status: test description: Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up. references: - https://github.com/helpsystems/nanodump/commit/578116faea3d278d53d70ea932e2bbfe42569507 author: Florian Roth (Nextron Systems) date: 2012-06-27 modified: 2023-11-29 tags: - attack.credential-access - attack.t1003.001 - attack.s0002 logsource: category: process_access product: windows detection: selection: SourceImage|endswith: \WerFault.exe TargetImage|endswith: \lsass.exe GrantedAccess: '0x1FFFFF' condition: selection falsepositives: - Actual failures in lsass.exe that trigger a crash dump (unlikely) - Unknown cases in which WerFault accesses lsass.exe level: high
Near-miss passage: Sigma rule: Detects handles requested to SAM registry hive. Logsource: windows / security. Rule: title: SAM Registry Hive Handle Request id: f8748f2c-89dc-4d95-afb0-5a2dfdbad332 status: test description: Detects handles requested to SAM registry hive references: - https://threathunterplaybook.com/hunts/windows/190725-SAMRegistryHiveHandleRequest/notebook.html author: Roberto Rodriguez @Cyb3rWard0g date: 2019-08-12 modified: 2021-11-27 tags: - attack.discovery - attack.t1012 - attack.credential-access - attack.t1552.002 logsource: product: windows service: security detection: selection: EventID: 4656 ObjectType: Key ObjectName|endswith: \SAM condition: selection falsepositives: - Unknown level: high
Query: detection engineering for Browser Session Hijacking
Matching passage: T1185 Browser Session Hijacking. Tactics: collection. Description: Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.(Citation: Wikipedia Man in the Browser) A specific example is when an adversary injects software into a browser that allows them to inherit cookies, HTTP sessions, and SSL client certificates of a user then use the browser as a way to pivot into an authenticated intranet.(Citation: Cobalt Strike Browser Pivot)(Citation: ICEBRG Chrome Extensions) Executing browser-based behaviors such as pivoting may require specific process permissions, such as <code>SeDebugPrivilege</code> and/or high-integrity/administrator rights. Another example involves pivoting browser traffic from the adversary's browser through the user's browser by setting up a proxy which will redirect web traffic. This does not alter the user's traffic in any way, and the proxy connection can be severed as soon as the browser is closed. The adversary assumes the security context of whichever browser process the proxy is injected into. Browsers typically create a new process for each tab that is opened and permissions and certificates are separated accordingly. With these permissions, an adversary could potentially browse to any resource on an intranet, such as [Sharepoint](https://attack.mitre.org/techniques/T1213/002) or webmail, that is accessible through the browser and which the browser has sufficient permissions. Browser pivoting may also bypass security provided by 2-factor authentication.(Citation: cobaltstrike manual)
Near-miss passage: T1119 Automated Collection. Tactics: collection. Description: Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this technique could include use of a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) to search for and copy information fitting set criteria such as file type, location, or name at specific time intervals. In cloud-based environments, adversaries may also use cloud APIs, data pipelines, command line interfaces, or extract, transform, and load (ETL) services to automatically collect data.(Citation: Mandiant UNC3944 SMS Phishing 2023) This functionality could also be built into remote access tools. This technique may incorporate use of other techniques such as [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) and [Lateral Tool Transfer](https://attack.mitre.org/techniques/T1570) to identify and move files, as well as [Cloud Service Dashboard](https://attack.mitre.org/techniques/T1538) and [Cloud Storage Object Discovery](https://attack.mitre.org/techniques/T1619) to identify resources in cloud environments.
Query: CVE similar to CVE-2015-5272
Matching passage: CVE-2015-5272. CWE: CWE-264. CVSS: 4.300000190734863. The Forum module in Moodle 2.7.x before 2.7.10 allows remote authenticated users to post to arbitrary groups by leveraging the teacher role, as demonstrated by a post directed to "all participants."
Near-miss passage: CVE-2015-0798. CWE: CWE-264. CVSS: 5.0. The Reader mode feature in Mozilla Firefox before 37.0.1 on Android, and Desktop Firefox pre-release, does not properly handle privileged URLs, which makes it easier for remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging the ability to bypass the Same Origin Policy.
Query: Suspicious Automated Exfiltration execution detected on endpoint
Matching passage: T1020 Automated Exfiltration. Tactics: exfiltration. Description: Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.(Citation: ESET Gamaredon June 2020) When automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as [Exfiltration Over C2 Channel](https://attack.mitre.org/techniques/T1041) and [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048).
Near-miss passage: T1020.001 Traffic Duplication. Tactics: exfiltration. Description: Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure. Traffic mirroring is a native feature for some devices, often used for network analysis. For example, devices may be configured to forward network traffic to one or more destinations for analysis by a network analyzer or other monitoring device. (Citation: Cisco Traffic Mirroring)(Citation: Juniper Traffic Mirroring) Adversaries may abuse traffic mirroring to mirror or redirect network traffic through other infrastructure they control. Malicious modifications to network devices to enable traffic redirection may be possible through [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) or [Patch System Image](https://attack.mitre.org/techniques/T1601/001).(Citation: US-CERT-TA18-106A)(Citation: Cisco Blog Legacy Device Attacks) Many cloud-based environments also support traffic mirroring. For example, AWS Traffic Mirroring, GCP Packet Mirroring, and Azure vTap allow users to define specified instances to collect traffic from and specified targets to send collected traffic to.(Citation: AWS Traffic Mirroring)(Citation: GCP Packet Mirroring)(Citation: Azure Virtual Network TAP) Adversaries may use traffic duplication in conjunction with [Network Sniffing](https://attack.mitre.org/techniques/T1040), [Input Capture](https://attack.mitre.org/techniques/T1056), or [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) depending on the goals and objectives of the adversary.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects calls to "SyncInvoke" that is part of the "CL_Invocation.ps1" script to proxy execution using "System.Diagnostic. Logsource: windows / process_creation. Rule: title: Potential Process Execution Proxy Via CL_Invocation.ps1 id: a0459f02-ac51-4c09-b511-b8c9203fc429 status: test description: Detects calls to "SyncInvoke" that is part of the "CL_Invocation.ps1" script to proxy execution using "System.Diagnostics.Process" references: - https://lolbas-project.github.io/lolbas/Scripts/Cl_invocation/ - https://twitter.com/bohops/status/948061991012327424 author: Nasreddine Bencherchali (Nextron Systems), oscd.community, Natalia Shornikova date: 2020-10-14 modified: 2023-08-17 tags: - attack.stealth - attack.t1216 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: 'SyncInvoke ' condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission gr. Logsource: windows / ps_script. Rule: title: AD Groups Or Users Enumeration Using PowerShell - ScriptBlock id: 88f0884b-331d-403d-a3a1-b668cf035603 status: test description: 'Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.002/T1069.002.md author: frack113 date: 2021-12-15 modified: 2022-12-25 tags: - attack.discovery - attack.t1069.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: test_2: ScriptBlockText|contains: get-ADPrincipalGroupMembership test_7: ScriptBlockText|contains|all: - get-aduser - '-f ' - '-pr ' - DoesNotRequirePreAuth condition: 1 of test_* falsepositives: - Unknown level: low
Query: describe CVE-2015-7401
Matching passage: CVE-2015-7401. CWE: CWE-200. CVSS: 4.300000190734863. IBM Curam Social Program Management 6.1.x before 6.1.1.1 allows remote authenticated users to bypass intended access restrictions and obtain sensitive document information by guessing the document id. IBM X-Force ID: 107106.
Near-miss passage: CVE-2015-7195. CWE: CWE-200. CVSS: 5.0. The URL parsing implementation in Mozilla Firefox before 42.0 improperly recognizes escaped characters in hostnames within Location headers, which allows remote attackers to obtain sensitive information via vectors involving a redirect.
Query: exploit SQL injection vulnerability in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6-MP4 allows remote authenticated users to execute arbitrary SQL commands via unspecified v
Matching passage: CVE-2015-8153. CWE: CWE-89. CVSS: 8.800000190734863. SQL injection vulnerability in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6-MP4 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-0919. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in the administrative backend in Sefrengo before 1.6.1 allow remote administrators to execute arbitrary SQL commands via the (1) idcat or (2) idclient parameter to backend/main.php.
Query: write Sigma for Detects execution of the IEExec utility to download and execute files
Matching passage: Sigma rule: Detects execution of the IEExec utility to download and execute files. Logsource: windows / process_creation. Rule: title: File Download And Execution Via IEExec.EXE id: 9801abb8-e297-4dbf-9fbd-57dde0e830ad status: test description: Detects execution of the IEExec utility to download and execute files references: - https://lolbas-project.github.io/lolbas/Binaries/Ieexec/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-05-16 modified: 2023-11-09 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \IEExec.exe - OriginalFileName: IEExec.exe selection_cli: CommandLine|contains: - http:// - https:// condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects instances where a MySQL service on an OpenCanary node has had a login attempt.. Logsource: opencanary / application. Rule: title: OpenCanary - MySQL Login Attempt id: e7d79a1b-25ed-4956-bd56-bd344fa8fd06 status: test description: Detects instances where a MySQL service on an OpenCanary node has had a login attempt. references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.credential-access - attack.collection - attack.t1003 - attack.t1213 logsource: category: application product: opencanary detection: selection: logtype: 8001 condition: selection falsepositives: - Unlikely level: high
Query: write Sigma for Detects Windows shells and scripting applications that write files to suspicious folders
Matching passage: Sigma rule: Detects Windows shells and scripting applications that write files to suspicious folders. Logsource: windows / file_event. Rule: title: Windows Shell/Scripting Application File Write to Suspicious Folder id: 1277f594-a7d1-4f28-a2d3-73af5cbeab43 status: test description: Detects Windows shells and scripting applications that write files to suspicious folders references: - Internal Research author: Florian Roth (Nextron Systems) date: 2021-11-20 modified: 2023-03-29 tags: - attack.execution - attack.t1059 logsource: category: file_event product: windows detection: selection_1: Image|endswith: - \bash.exe - \cmd.exe - \cscript.exe - \msbuild.exe - \powershell.exe - \pwsh.exe - \sh.exe - \wscript.exe TargetFilename|startswith: - C:\PerfLogs\ - C:\Users\Public\ selection_2: Image|endswith: - \certutil.exe - \forfiles.exe - \mshta.exe - \schtasks.exe - \scriptrunner.exe - \wmic.exe TargetFilename|contains: - C:\PerfLogs\ - C:\Users\Public\ - C:\Windows\Temp\ condition: 1 of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects modification of dMSA link attributes (msDS-ManagedAccountPrecededByLink) via PowerShell scripts. This command li. Logsource: windows / ps_script. Rule: title: DMSA Link Attributes Modified id: 9b111d8e-92e0-4153-88bc-daefc1333aba related: - id: 6c9eb492-e477-4df9-b0f4-571fc9db29cd type: similar status: experimental description: 'Detects modification of dMSA link attributes (msDS-ManagedAccountPrecededByLink) via PowerShell scripts. This command line pattern could be an indicator an attempt to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025. ' references: - https://www.akamai.com/blog/security-research/abusing-bad-successor-for-privilege-escalation-in-active-directory author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-05-24 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078.002 - attack.t1098 logsource: category: ps_script product: windows detection: selection: ScriptBlockText|contains|all: - .Put("msDS-ManagedAccountPrecededByLink - CN= condition: selection falsepositives: - Legitimate administrative tasks modifying these attributes. level: low