alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: patch priority for CVE-2015-3257
Matching passage: CVE-2015-3257. CWE: CWE-79. CVSS: 6.099999904632568. Zend/Diactoros/Uri::filterPath in zend-diactoros before 1.0.4 does not properly sanitize path input, which allows remote attackers to perform cross-site scripting (XSS) or open redirect attacks.
Near-miss passage: CVE-2015-1039. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in user/login.phtml in ZF-Commons ZfcUser before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter.
Query: alert when Detects instances where a MySQL service on an OpenCanary node has had a login attempt.
Matching passage: Sigma rule: Detects instances where a MySQL service on an OpenCanary node has had a login attempt.. Logsource: opencanary / application. Rule: title: OpenCanary - MySQL Login Attempt id: e7d79a1b-25ed-4956-bd56-bd344fa8fd06 status: test description: Detects instances where a MySQL service on an OpenCanary node has had a login attempt. references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.credential-access - attack.collection - attack.t1003 - attack.t1213 logsource: category: application product: opencanary detection: selection: logtype: 8001 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the execution of the LocalPotato POC based on basic PE metadata information and default CLI examples. Logsource: windows / process_creation. Rule: title: HackTool - LocalPotato Execution id: 6bd75993-9888-4f91-9404-e1e4e4e34b77 status: test description: Detects the execution of the LocalPotato POC based on basic PE metadata information and default CLI examples references: - https://www.localpotato.com/localpotato_html/LocalPotato.html - https://github.com/decoder-it/LocalPotato author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-14 modified: 2024-11-23 tags: - attack.privilege-escalation - cve.2023-21746 - attack.stealth logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \LocalPotato.exe selection_cli: CommandLine|contains|all: - .exe -i C:\ - -o Windows\ selection_hash_plain: Hashes|contains: - IMPHASH=E1742EE971D6549E8D4D81115F88F1FC - IMPHASH=DD82066EFBA94D7556EF582F247C8BB5 condition: 1 of selection_* falsepositives: - Unlikely level: high
Query: alert when Detects suspicious parent process for cmd.exe
Matching passage: Sigma rule: Detects suspicious parent process for cmd.exe. Logsource: windows / process_creation. Rule: title: Unusual Parent Process For Cmd.EXE id: 4b991083-3d0e-44ce-8fc4-b254025d8d4b status: test description: Detects suspicious parent process for cmd.exe references: - https://www.elastic.co/guide/en/security/current/unusual-parent-process-for-cmd.exe.html author: Tim Rauch, Elastic (idea) date: 2022-09-21 modified: 2023-12-05 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection: Image|endswith: \cmd.exe ParentImage|endswith: - \csrss.exe - \ctfmon.exe - \dllhost.exe - \epad.exe - \FlashPlayerUpdateService.exe - \GoogleUpdate.exe - \jucheck.exe - \jusched.exe - \LogonUI.exe - \lsass.exe - \regsvr32.exe - \SearchIndexer.exe - \SearchProtocolHost.exe - \SIHClient.exe - \sihost.exe - \slui.exe - \spoolsv.exe - \sppsvc.exe - \taskhostw.exe - \unsecapp.exe - \WerFault.exe - \wermgr.exe - \wlanext.exe - \WUDFHost.exe condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the reporting of NTLMv1 being used between a client and server. NTLMv1 is insecure as the underlying encryption. Logsource: windows / system. Rule: title: NTLMv1 Logon Between Client and Server id: e9d4ab66-a532-4ef7-a502-66a9e4a34f5d status: test description: Detects the reporting of NTLMv1 being used between a client and server. NTLMv1 is insecure as the underlying encryption algorithms can be brute-forced by modern hardware. references: - https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows10/22H2/W10_22H2_Pro_20230321_19045.2728/WEPExplorer/LsaSrv.xml author: Tim Shelton, Nasreddine Bencherchali (Nextron Systems) date: 2022-04-26 modified: 2023-06-06 tags: - attack.lateral-movement - attack.t1550.002 logsource: product: windows service: system detection: selection: Provider_Name: LsaSrv EventID: - 6038 - 6039 condition: selection falsepositives: - Environments that use NTLMv1 level: medium
Query: describe CVE-2015-4188
Matching passage: CVE-2015-4188. CWE: CWE-89. CVSS: 5.0. SQL injection vulnerability in the Manager interface in Cisco Prime Collaboration 10.5(1) allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug IDs CSCuu29910, CSCuu29928, and CSCuu59104.
Near-miss passage: CVE-2015-9446. CWE: CWE-89. CVSS: 8.800000190734863. The unite-gallery-lite plugin before 1.5 for WordPress has SQL injection via data[galleryID] to wp-admin/admin-ajax.php.
Query: detection rule: Detects the "IDiagnosticProfileUAC" UAC bypass technique
Matching passage: Sigma rule: Detects the "IDiagnosticProfileUAC" UAC bypass technique. Logsource: windows / process_creation. Rule: title: UAC Bypass Using IDiagnostic Profile id: 4cbef972-f347-4170-b62a-8253f6168e6d status: test description: Detects the "IDiagnosticProfileUAC" UAC bypass technique references: - https://github.com/Wh04m1001/IDiagnosticProfileUAC author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-03 modified: 2024-12-01 tags: - attack.execution - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \DllHost.exe ParentCommandLine|contains: ' /Processid:{12C21EA7-2EB8-4B55-9249-AC243DA8C666}' IntegrityLevel: - High - System - S-1-16-16384 - S-1-16-12288 condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Indicates that there are abnormal characteristics in the token such as an unusual token lifetime or a token that is play. Logsource: azure / riskdetection. Rule: title: Anomalous Token id: 6555754e-5e7f-4a67-ad1c-4041c413a007 status: test description: Indicates that there are abnormal characteristics in the token such as an unusual token lifetime or a token that is played from an unfamiliar location. references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#anomalous-token - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow' date: 2023-08-07 tags: - attack.t1528 - attack.credential-access logsource: product: azure service: riskdetection detection: selection: riskEventType: anomalousToken condition: selection falsepositives: - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user. level: high
Query: risk of The __driver_rfc4106_decrypt function in arch/x86/crypto/aesni-intel_glue.c in the Linux kernel before 3.19.3 does not properly determine the memory locations used for encrypted da
Matching passage: CVE-2015-3331. CWE: CWE-119. CVSS: 9.300000190734863. The __driver_rfc4106_decrypt function in arch/x86/crypto/aesni-intel_glue.c in the Linux kernel before 3.19.3 does not properly determine the memory locations used for encrypted data, which allows context-dependent attackers to cause a denial of service (buffer overflow and system crash) or possibly execute arbitrary code by triggering a crypto API call, as demonstrated by use of a libkcapi test program with an AF_ALG(aead) socket.
Near-miss passage: CVE-2015-8645. CWE: CWE-119. CVSS: 8.800000190734863. Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8459, CVE-2015-8460, and CVE-2015-8636.
Query: detection rule: Detects commandline operations on shell history files
Matching passage: Sigma rule: Detects commandline operations on shell history files. Logsource: linux / auditd. Rule: title: Suspicious History File Operations - Linux id: eae8ce9f-bde9-47a6-8e79-f20d18419910 status: test description: Detects commandline operations on shell history files references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md author: Mikhail Larin, oscd.community date: 2020-10-17 modified: 2022-11-28 tags: - attack.credential-access - attack.t1552.003 logsource: product: linux service: auditd detection: execve: type: EXECVE history: - .bash_history - .zsh_history - .zhistory - .history - .sh_history - fish_history condition: execve and history falsepositives: - Legitimate administrative activity - Legitimate software, cleaning hist file level: medium
Near-miss passage: Sigma rule: Detects the use of Kali Linux through Windows Subsystem for Linux. Logsource: windows / process_creation. Rule: title: WSL Kali-Linux Usage id: 6f1a11aa-4b8a-4b7f-9e13-4d3e4ff0e0d4 status: experimental description: Detects the use of Kali Linux through Windows Subsystem for Linux references: - https://medium.com/@redfanatic7/running-kali-linux-on-windows-51ad95166e6e - https://learn.microsoft.com/en-us/windows/wsl/install author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-10-10 tags: - attack.stealth - attack.t1202 logsource: category: process_creation product: windows detection: selection_img_appdata: - Image|contains|all: - :\Users\ - \AppData\Local\packages\KaliLinux - Image|contains|all: - :\Users\ - \AppData\Local\Microsoft\WindowsApps\kali.exe selection_img_windowsapps: Image|contains: :\Program Files\WindowsApps\KaliLinux. Image|endswith: \kali.exe selection_kali_wsl_parent: ParentImage|endswith: - \wsl.exe - \wslhost.exe selection_kali_wsl_child: - Image|contains: - \kali.exe - \KaliLinux - CommandLine|contains: - Kali.exe - Kali-linux - kalilinux filter_main_install_uninstall: CommandLine|contains: - ' -i ' - ' --install ' - ' --unregister ' condition: 1 of selection_img_* or all of selection_kali_* and not 1 of filter_main_* falsepositives: - Legitimate installation or usage of Kali Linux WSL by administrators or security teams level: high
Query: detection rule: Detects the execution of a shell as sub process of "rsync" without the expected command line flag "-e" being used, which
Matching passage: Sigma rule: Detects the execution of a shell as sub process of "rsync" without the expected command line flag "-e" being used, which. Logsource: linux / process_creation. Rule: title: Suspicious Invocation of Shell via Rsync id: 297241f3-8108-4b3a-8c15-2dda9f844594 status: experimental description: 'Detects the execution of a shell as sub process of "rsync" without the expected command line flag "-e" being used, which could be an indication of exploitation as described in CVE-2024-12084. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation. ' references: - https://sysdig.com/blog/detecting-and-mitigating-cve-2024-12084-rsync-remote-code-execution/ - https://gist.github.com/Neo23x0/a20436375a1e26524931dd8ea1a3af10 author: Florian Roth date: 2025-01-18 tags: - attack.execution - attack.t1059 - attack.t1203 logsource: category: process_creation product: linux detection: selection: ParentImage|endswith: - /rsync - /rsyncd Image|endswith: - /ash - /bash - /csh - /dash - /ksh - /sh - /tcsh - /zsh filter_main_expected: CommandLine|contains: ' -e ' condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a suspicious process command line that uses whoami as first parameter (as e.g. used by EfsPotato). Logsource: windows / process_creation. Rule: title: WhoAmI as Parameter id: e9142d84-fbe0-401d-ac50-3e519fb00c89 status: test description: Detects a suspicious process command line that uses whoami as first parameter (as e.g. used by EfsPotato) references: - https://twitter.com/blackarrowsec/status/1463805700602224645?s=12 author: Florian Roth (Nextron Systems) date: 2021-11-29 modified: 2022-12-25 tags: - attack.discovery - attack.t1033 - car.2016-03-001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: .exe whoami condition: selection falsepositives: - Unknown level: high
Query: vulnerability: Cisco IOS XE before 3.7.5S on ASR 1000 devices does not properly handle route adjacencies, which allows remote attackers to cause a denial of service (device hang) via crafted IP p
Matching passage: CVE-2015-0685. CWE: CWE-20. CVSS: 7.800000190734863. Cisco IOS XE before 3.7.5S on ASR 1000 devices does not properly handle route adjacencies, which allows remote attackers to cause a denial of service (device hang) via crafted IP packets, aka Bug ID CSCub31873.
Near-miss passage: CVE-2015-1647. CWE: CWE-20. CVSS: 2.0999999046325684. Virtual Machine Manager (VMM) in Hyper-V in Microsoft Windows 8.1 and Windows Server 2012 R2 allows guest OS users to cause a denial of service (VMM functionality loss) via a crafted application, aka "Windows Hyper-V DoS Vulnerability."
Query: Sigma rule for Detects the use of Windows Credential Editor (WCE), a popular post-exploitation tool used to extract plaintext passwords
Matching passage: Sigma rule: Detects the use of Windows Credential Editor (WCE), a popular post-exploitation tool used to extract plaintext passwords. Logsource: windows / process_creation. Rule: title: HackTool - Windows Credential Editor (WCE) Execution id: 7aa7009a-28b9-4344-8c1f-159489a390df status: test description: 'Detects the use of Windows Credential Editor (WCE), a popular post-exploitation tool used to extract plaintext passwords, hash, PIN code and Kerberos tickets from memory. It is often used by threat actors for credential dumping and lateral movement within compromised networks. ' references: - https://www.ampliasecurity.com/research/windows-credentials-editor/ author: Florian Roth (Nextron Systems) date: 2019-12-31 modified: 2025-10-21 tags: - attack.credential-access - attack.t1003.001 - attack.s0005 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: - \WCE.exe - \WCE64.exe selection_hash: Hashes|contains: - IMPHASH=136F0A8572C058A96436C82E541E4C41 - IMPHASH=589657C64DDE88533186C39F82FA1F50 - IMPHASH=6BFE09EFCB4FFDE061EBDBAFC4DB84CF - IMPHASH=7D490037BF450877E6D0287BDCFF8D2E - IMPHASH=8AB93B061287C79F3088C5BC7E7D97ED - IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F - IMPHASH=BA434A7A729EEC20E136CA4C32D6C740 - IMPHASH=BD1D1547DA13C0FCB6C15E86217D5EB8 - IMPHASH=E96A73C7BF33A464C510EDE582318BF2 condition: 1 of selection_* falsepositives: - Unknown level: critical
Near-miss passage: Sigma rule: Detects the malicious use of a control panel item. Logsource: windows / process_creation. Rule: title: Control Panel Items id: 0ba863e6-def5-4e50-9cea-4dd8c7dc46a4 status: test description: Detects the malicious use of a control panel item references: - https://ired.team/offensive-security/code-execution/code-execution-through-control-panel-add-ins author: Kyaw Min Thein, Furkan Caliskan (@caliskanfurkan_) date: 2020-06-22 modified: 2023-10-11 tags: - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1218.002 - attack.persistence - attack.t1546 logsource: product: windows category: process_creation detection: selection_reg_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_reg_cli: CommandLine|contains|all: - add - CurrentVersion\Control Panel\CPLs selection_cpl: CommandLine|endswith: .cpl filter_cpl_sys: CommandLine|contains: - \System32\ - '%System%' - '|C:\Windows\system32|' filter_cpl_igfx: CommandLine|contains|all: - 'regsvr32 ' - ' /s ' - igfxCPL.cpl condition: all of selection_reg_* or (selection_cpl and not 1 of filter_cpl_*) falsepositives: - Unknown level: high
Query: exploit Unspecified vulnerability in the Oracle Report Manager component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confiden
Matching passage: CVE-2015-4886. CWE: UNKNOWN. CVSS: 6.400000095367432. Unspecified vulnerability in the Oracle Report Manager component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Reports Security. NOTE: the previous information is from the October 2015 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability, which allows remote attackers to read arbitrary files, cause a denial of service, or conduct SMB Relay attacks via a crafted DTD in an XML request involving the OA_HTML/copxml servlet.
Near-miss passage: CVE-2015-0497. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the PeopleSoft Enterprise Portal Interaction Hub component in Oracle PeopleSoft Products 9.1.00 allows remote attackers to affect integrity via unknown vectors related to Enterprise Portal.
Query: risk of Race condition in the ssl3_get_new_session_ticket function in ssl/s3_clnt.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b, when used 
Matching passage: CVE-2015-1791. CWE: CWE-362. CVSS: 6.800000190734863. Race condition in the ssl3_get_new_session_ticket function in ssl/s3_clnt.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b, when used for a multi-threaded client, allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact by providing a NewSessionTicket during an attempt to reuse a ticket that had been obtained earlier.
Near-miss passage: CVE-2015-8839. CWE: CWE-362. CVSS: 5.099999904632568. Multiple race conditions in the ext4 filesystem implementation in the Linux kernel before 4.5 allow local users to cause a denial of service (disk corruption) by writing to a page that is associated with a different user's file after unsynchronized hole punching and page-fault handling.
Query: ATT&CK technique for Stored Data Manipulation
Matching passage: T1565.001 Stored Data Manipulation. Tactics: impact. Description: Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating stored data, adversaries may attempt to affect a business process, organizational understanding, and decision making. Stored data could include a variety of file formats, such as Office files, databases, stored emails, and custom file formats. The type of modification and the impact it will have depends on the type of data as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
Near-miss passage: T1565.002 Transmitted Data Manipulation. Tactics: impact. Description: Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating transmitted data, adversaries may attempt to affect a business process, organizational understanding, and decision making. Manipulation may be possible over a network connection or between system processes where there is an opportunity deploy a tool that will intercept and change information. The type of modification and the impact it will have depends on the target transmission mechanism as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
Query: exploit Multiple cross-site scripting (XSS) vulnerabilities in SAP HANA 73 (1.00.73.00.389160) and HANA Developer Edition 80 (1.00.80.00.391861) allow remote attackers to inject arbitrary 
Matching passage: CVE-2015-2072. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in SAP HANA 73 (1.00.73.00.389160) and HANA Developer Edition 80 (1.00.80.00.391861) allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) ide/core/plugins/editor/templates/trace/hanaTraceDetailService.xsjs or (2) xs/ide/editor/templates/trace/hanaTraceDetailService.xsjs, aka SAP Note 2069676.
Near-miss passage: CVE-2015-1911. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Sterling Order Management 8.5 before HF113, Sterling Selling and Fulfillment Foundation 9.0.0 before FP92, and Sterling Field Sales (SFS) 9.0 before HF7 in IBM Sterling Selling and Fulfillment Suite allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Query: CVE similar to CVE-2015-3692
Matching passage: CVE-2015-3692. CWE: CWE-284. CVSS: 6.800000190734863. Apple Mac EFI before 2015-001, as used in OS X before 10.10.4 and other products, does not enforce a locking protection mechanism upon being woken from sleep, which allows local users to conduct EFI flash attacks by leveraging root privileges.
Near-miss passage: CVE-2015-3062. CWE: CWE-284. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified vectors, a different vulnerability than CVE-2015-3060, CVE-2015-3061, CVE-2015-3063, CVE-2015-3064, CVE-2015-3065, CVE-2015-3066, CVE-2015-3067, CVE-2015-3068, CVE-2015-3069, CVE-2015-3071, CVE-2015-3072, CVE-2015-3073, and CVE-2015-3074.
Query: vulnerability: Unspecified vulnerability in the PeopleSoft Enterprise Portal Interaction Hub component in Oracle PeopleSoft Products 9.1.00 allows remote attackers to affect integrity via unknown
Matching passage: CVE-2015-0497. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the PeopleSoft Enterprise Portal Interaction Hub component in Oracle PeopleSoft Products 9.1.00 allows remote attackers to affect integrity via unknown vectors related to Enterprise Portal.
Near-miss passage: CVE-2015-4838. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.4.0, 12.1.2.0.0, and 12.1.3.0.0 allows remote authenticated users to affect confidentiality via vectors related to ADF Faces.