alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: CVE similar to CVE-2015-4535
Matching passage: CVE-2015-4535. CWE: CWE-264. CVSS: 7.5. Java Method Server (JMS) in EMC Documentum Content Server before 6.7SP1 P32, 6.7SP2 before P25, 7.0 before P19, 7.1 before P16, and 7.2 before P02, when __debug_trace__ is configured, allows remote authenticated users to gain super-user privileges by leveraging the ability to read a log file containing a login ticket.
Near-miss passage: CVE-2015-7051. CWE: CWE-264. CVSS: 9.300000190734863. MobileStorageMounter in Apple iOS before 9.2 and tvOS before 9.1 mishandles the timing of trust-cache loading, which allows attackers to execute arbitrary code in a privileged context via a crafted app.
Query: CVE similar to CVE-2015-0306
Matching passage: CVE-2015-0306. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0303.
Near-miss passage: CVE-2015-4441. CWE: UNKNOWN. CVSS: 6.800000190734863. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-4435, CVE-2015-4438, CVE-2015-4445, CVE-2015-4447, CVE-2015-4451, CVE-2015-4452, CVE-2015-5085, and CVE-2015-5086.
Query: CVE similar to CVE-2015-2818
Matching passage: CVE-2015-2818. CWE: UNKNOWN. CVSS: 5.0. XML external entity (XXE) vulnerability in SAP Mobile Platform 3 allows remote attackers to send requests to intranet servers via crafted XML, aka SAP Security Note 2125513.
Near-miss passage: CVE-2015-1243. CWE: UNKNOWN. CVSS: 7.5. Use-after-free vulnerability in the MutationObserver::disconnect function in core/dom/MutationObserver.cpp in the DOM implementation in Blink, as used in Google Chrome before 42.0.2311.135, allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering an attempt to unregister a MutationObserver object that is not currently registered.
Query: rule covering Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class over the network
Matching passage: Sigma rule: Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class over the network. Logsource: windows / file_event. Rule: title: Potential DCOM InternetExplorer.Application DLL Hijack id: 2f7979ae-f82b-45af-ac1d-2b10e93b0baa related: - id: e554f142-5cf3-4e55-ace9-a1b59e0def65 type: obsolete - id: f354eba5-623b-450f-b073-0b5b2773b6aa type: similar status: test description: Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class over the network references: - https://threathunterplaybook.com/hunts/windows/201009-RemoteDCOMIErtUtilDLLHijack/notebook.html author: Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR), wagga date: 2020-10-12 modified: 2022-12-18 tags: - attack.lateral-movement - attack.t1021.002 - attack.t1021.003 logsource: product: windows category: file_event detection: selection: Image: System TargetFilename|endswith: \Internet Explorer\iertutil.dll condition: selection falsepositives: - Unknown level: critical
Near-miss passage: Sigma rule: Detects the use of Ngrok, a utility used for port forwarding and tunneling, often used by threat actors to make local pr. Logsource: windows / process_creation. Rule: title: PUA - Ngrok Execution id: ee37eb7c-a4e7-4cd5-8fa4-efa27f1c3f31 status: test description: 'Detects the use of Ngrok, a utility used for port forwarding and tunneling, often used by threat actors to make local protected services publicly available. Involved domains are bin.equinox.io for download and *.ngrok.io for connections. ' references: - https://ngrok.com/docs - https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html - https://stackoverflow.com/questions/42442320/ssh-tunnel-to-ngrok-and-initiate-rdp - https://www.virustotal.com/gui/file/58d21840d915aaf4040ceb89522396124c82f325282f805d1085527e1e2ccfa1/detection - https://cybleinc.com/2021/02/15/ngrok-platform-abused-by-hackers-to-deliver-a-new-wave-of-phishing-attacks/ - https://twitter.com/xorJosh/status/1598646907802451969 - https://www.softwaretestinghelp.com/how-to-use-ngrok/ author: Florian Roth (Nextron Systems) date: 2021-05-14 modified: 2023-02-21 tags: - attack.command-and-control - attack.t1572 logsource: category: process_creation product: windows detection: selection1: CommandLine|contains: - ' tcp 139' - ' tcp 445' - ' tcp 3389' - ' tcp 5985' - ' tcp 5986' selection2: CommandLine|contains|all: - ' start ' - --all - --config - .yml selection3: Image|endswith: ngrok.exe CommandLine|contains: - ' tcp ' - ' http ' - ' authtoken ' selection4: CommandLine|contains: - '.exe authtoken ' - .exe start --all condition: 1 of selection* falsepositives: - Another tool that uses the command line switches of Ngrok - Ngrok http 3978 (https://learn.microsoft.com/en-us/azure/bot-service/bot-service-debug-channel-ngrok?view=azure-bot-service-4.0) level: high
Query: write Sigma for Detects the use of the "apt" and "apt-get" commands to execute a shell or proxy commands. Such behavior may be associate
Matching passage: Sigma rule: Detects the use of the "apt" and "apt-get" commands to execute a shell or proxy commands. Such behavior may be associate. Logsource: linux / process_creation. Rule: title: Shell Invocation via Apt - Linux id: bb382fd5-b454-47ea-a264-1828e4c766d6 status: test description: 'Detects the use of the "apt" and "apt-get" commands to execute a shell or proxy commands. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments. ' references: - https://gtfobins.github.io/gtfobins/apt/ - https://gtfobins.github.io/gtfobins/apt-get/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-28 modified: 2024-09-02 tags: - attack.discovery - attack.t1083 logsource: category: process_creation product: linux detection: selection: Image|endswith: - /apt - /apt-get CommandLine|contains: APT::Update::Pre-Invoke::= condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Enable Dynamic Data Exchange protocol (DDE) in all supported editions of Microsoft Word or Excel.. Logsource: windows / registry_set. Rule: title: Enable Microsoft Dynamic Data Exchange id: 63647769-326d-4dde-a419-b925cc0caf42 status: test description: Enable Dynamic Data Exchange protocol (DDE) in all supported editions of Microsoft Word or Excel. references: - https://msrc.microsoft.com/update-guide/vulnerability/ADV170021 author: frack113 date: 2022-02-26 modified: 2023-08-17 tags: - attack.execution - attack.t1559.002 logsource: category: registry_set product: windows detection: selection_word: TargetObject|endswith: \Word\Security\AllowDDE Details: - DWORD (0x00000001) - DWORD (0x00000002) selection_excel: TargetObject|endswith: - \Excel\Security\DisableDDEServerLaunch - \Excel\Security\DisableDDEServerLookup Details: DWORD (0x00000000) condition: 1 of selection_* falsepositives: - Unknown level: medium
Query: SOC alert related to Network Security Appliances
Matching passage: T1590.006 Network Security Appliances. Tactics: reconnaissance. Description: Adversaries may gather information about the victim's network security appliances that can be used during targeting. Information about network security appliances may include a variety of details, such as the existence and specifics of deployed firewalls, content filters, and proxies/bastion hosts. Adversaries may also target information about victim network-based intrusion detection systems (NIDS) or other appliances related to defensive cybersecurity operations. Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598).(Citation: Nmap Firewalls NIDS) Information about network security appliances may also be exposed to adversaries via online or other accessible data sets (ex: [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133)).
Near-miss passage: T1590.003 Network Trust Dependencies. Tactics: reconnaissance. Description: Adversaries may gather information about the victim's network trust dependencies that can be used during targeting. Information about network trusts may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, etc.) that have connected (and potentially elevated) network access. Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about network trusts may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: Pentesting AD Forests) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
Query: describe CVE-2015-5725
Matching passage: CVE-2015-5725. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in the offset method in the Active Record class in CodeIgniter before 2.2.4 allows remote attackers to execute arbitrary SQL commands via vectors involving the offset variable.
Near-miss passage: CVE-2015-5617. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in pub/m_pending_news/delete_pending_news.jsp in Enorth Webpublisher CMS allows remote attackers to execute arbitrary SQL commands via the cbNewsId parameter.
Query: defense impairment using Network Provider DLL
Matching passage: T1556.008 Network Provider DLL. Tactics: defense impairment, persistence, credential access. Description: Adversaries may register malicious network provider dynamic link libraries (DLLs) to capture cleartext user credentials during the authentication process. Network provider DLLs allow Windows to interface with specific network protocols and can also support add-on credential management functions.(Citation: Network Provider API) During the logon process, Winlogon (the interactive logon module) sends credentials to the local `mpnotify.exe` process via RPC. The `mpnotify.exe` process then shares the credentials in cleartext with registered credential managers when notifying that a logon event is happening.(Citation: NPPSPY - Huntress)(Citation: NPPSPY Video)(Citation: NPLogonNotify) Adversaries can configure a malicious network provider DLL to receive credentials from `mpnotify.exe`.(Citation: NPPSPY) Once installed as a credential manager (via the Registry), a malicious DLL can receive and save credentials each time a user logs onto a Windows workstation or domain via the `NPLogonNotify()` function.(Citation: NPLogonNotify) Adversaries may target planting malicious network provider DLLs on systems known to have increased logon activity and/or administrator logon activity, such as servers and domain controllers.(Citation: NPPSPY - Huntress)
Near-miss passage: T1556.009 Conditional Access Policies. Tactics: defense impairment, persistence, credential access. Description: Adversaries may disable or modify conditional access policies to enable persistent access to compromised accounts. Conditional access policies are additional verifications used by identity providers and identity and access management systems to determine whether a user should be granted access to a resource. For example, in Entra ID, Okta, and JumpCloud, users can be denied access to applications based on their IP address, device enrollment status, and use of multi-factor authentication.(Citation: Microsoft Conditional Access)(Citation: JumpCloud Conditional Access Policies)(Citation: Okta Conditional Access Policies) In some cases, identity providers may also support the use of risk-based metrics to deny sign-ins based on a variety of indicators. In AWS and GCP, IAM policies can contain `condition` attributes that verify arbitrary constraints such as the source IP, the date the request was made, and the nature of the resources or regions being requested.(Citation: AWS IAM Conditions)(Citation: GCP IAM Conditions) These measures help to prevent compromised credentials from resulting in unauthorized access to data or resources, as well as limit user permissions to only those required. By modifying conditional access policies, such as adding additional trusted IP ranges, removing [Multi-Factor Authentication](https://attack.mitre.org/techniques/T1556/006) requirements, or allowing additional [Unused/Unsupported Cloud Regions](https://attack.mitre.org/techniques/T1535), adversaries may be able to ensure persistent access to accounts and circumvent defensive measures.
Query: vulnerability: Untrusted search path vulnerability in the client in Remote Desktop Protocol (RDP) through 8.1 in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows local users to gain 
Matching passage: CVE-2015-2473. CWE: UNKNOWN. CVSS: 9.300000190734863. Untrusted search path vulnerability in the client in Remote Desktop Protocol (RDP) through 8.1 in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .rdp file, aka "Remote Desktop Protocol DLL Planting Remote Code Execution Vulnerability."
Near-miss passage: CVE-2015-0314. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0316, CVE-2015-0318, CVE-2015-0321, CVE-2015-0329, and CVE-2015-0330.
Query: Sigma YAML for windows / security
Matching passage: Sigma rule: Detects the creation of a local hidden user account which should not happen for event ID 4720.. Logsource: windows / security. Rule: title: Hidden Local User Creation id: 7b449a5e-1db5-4dd0-a2dc-4e3a67282538 status: test description: Detects the creation of a local hidden user account which should not happen for event ID 4720. references: - https://twitter.com/SBousseaden/status/1387743867663958021 author: Christian Burkard (Nextron Systems) date: 2021-05-03 modified: 2024-01-16 tags: - attack.persistence - attack.t1136.001 logsource: product: windows service: security detection: selection: EventID: 4720 TargetUserName|endswith: $ filter_main_homegroup: TargetUserName: HomeGroupUser$ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects usage of system utilities (only grep for now) to discover security software discovery. Logsource: macos / process_creation. Rule: title: Security Software Discovery - MacOs id: 0ed75b9c-c73b-424d-9e7d-496cd565fbe0 status: test description: Detects usage of system utilities (only grep for now) to discover security software discovery references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518.001/T1518.001.md author: Daniil Yugoslavskiy, oscd.community date: 2020-10-19 modified: 2022-11-27 tags: - attack.discovery - attack.t1518.001 logsource: category: process_creation product: macos detection: image: Image: /usr/bin/grep selection_cli_1: CommandLine|contains: - nessusd - santad - CbDefense - falcond - td-agent - packetbeat - filebeat - auditbeat - osqueryd - BlockBlock - LuLu selection_cli_2: CommandLine|contains|all: - Little - Snitch condition: image and 1 of selection_cli_* falsepositives: - Legitimate activities level: medium
Query: CVE similar to CVE-2015-9311
Matching passage: CVE-2015-9311. CWE: CWE-79. CVSS: 6.099999904632568. The newstatpress plugin before 1.0.6 for WordPress has reflected XSS.
Near-miss passage: CVE-2015-1879. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Google Doc Embedder plugin before 2.5.19 for WordPress allows remote attackers to inject arbitrary web script or HTML via the profile parameter in an edit action in the gde-settings page to wp-admin/options-general.php.
Query: risk of actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows remote attackers to cause a denial of ser
Matching passage: CVE-2015-7581. CWE: CWE-399. CVSS: 7.5. actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows remote attackers to cause a denial of service (superfluous caching and memory consumption) by leveraging an application's use of a wildcard controller route.
Near-miss passage: CVE-2015-5470. CWE: CWE-399. CVSS: 7.800000190734863. The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3 and Authoritative (Auth) Server before 3.3.3 and 3.4.x before 3.4.5 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a long name that refers to itself. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1868.
Query: exploit Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M have a default password of admin for the admin account, w
Matching passage: CVE-2015-2915. CWE: CWE-255. CVSS: 7.300000190734863. Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M have a default password of admin for the admin account, which allows remote attackers to obtain web-management access by leveraging the ability to authenticate from the intranet.
Near-miss passage: CVE-2015-8626. CWE: CWE-255. CVSS: 9.800000190734863. The User::randomPassword function in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 generates passwords smaller than $wgMinimalPasswordLength, which makes it easier for remote attackers to obtain access via a brute-force attack.
Query: exploit LINE@ for Android version 1.0.0 and LINE@ for iOS version 1.0.0 are vulnerable to MITM (man-in-the-middle) attack since the application allows non-SSL/TLS communications. As a resu
Matching passage: CVE-2015-2968. CWE: CWE-924. CVSS: 5.900000095367432. LINE@ for Android version 1.0.0 and LINE@ for iOS version 1.0.0 are vulnerable to MITM (man-in-the-middle) attack since the application allows non-SSL/TLS communications. As a result, any API may be invoked from a script injected by a MITM (man-in-the-middle) attacker.
Near-miss passage: CVE-2015-0897. CWE: CWE-924. CVSS: 5.900000095367432. LINE for Android version 5.0.2 and earlier and LINE for iOS version 5.0.0 and earlier are vulnerable to MITM (man-in-the-middle) attack since the application allows non-SSL/TLS communications. As a result, any API may be invoked from a script injected by a MITM (man-in-the-middle) attacker.
Query: CVE similar to CVE-2015-9389
Matching passage: CVE-2015-9389. CWE: CWE-79. CVSS: 5.400000095367432. The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via a quiz name.
Near-miss passage: CVE-2015-2046. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in MantisBT 1.2.13 and later before 1.2.20.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the execution of a renamed "client32.exe" (NetSupport RAT) via Imphash, Product and OriginalFileName strings. Logsource: windows / process_creation. Rule: title: Renamed NetSupport RAT Execution id: 0afbd410-de03-4078-8491-f132303cb67d status: test description: Detects the execution of a renamed "client32.exe" (NetSupport RAT) via Imphash, Product and OriginalFileName strings references: - https://redcanary.com/blog/misbehaving-rats/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-19 modified: 2024-11-23 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: - Product|contains: NetSupport Remote Control - OriginalFileName|contains: client32.exe - Hashes|contains: IMPHASH=A9D50692E95B79723F3E76FCF70D023E filter: Image|endswith: \client32.exe condition: selection and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology fo. Logsource: windows / system. Rule: title: ISATAP Router Address Was Set id: d22df9cd-2aee-4089-93c7-9dc4eae77f2c status: experimental description: 'Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology for IPv6 transition, unexpected or unauthorized ISATAP router configurations could indicate a potential IPv6 DNS Takeover attack using tools like mitm6. In such attacks, adversaries advertise themselves as DHCPv6 servers and set malicious ISATAP routers to intercept traffic. This detection should be correlated with network baselines and known legitimate ISATAP deployments in your environment. ' references: - https://www.blackhillsinfosec.com/mitm6-strikes-again-the-dark-side-of-ipv6/ - https://redfoxsec.com/blog/ipv6-dns-takeover/ - https://www.securityhq.com/blog/malicious-isatap-tunneling-unearthed-on-windows-server/ - https://medium.com/@ninnesoturan/detecting-ipv6-dns-takeover-a54a6a88be1f author: hamid date: 2025-10-19 tags: - attack.impact - attack.credential-access - attack.collection - attack.initial-access - attack.privilege-escalation - attack.execution - attack.t1557 - attack.t1565.002 logsource: product: windows service: system detection: selection: EventID: 4100 Provider_Name: Microsoft-Windows-Iphlpsvc filter_main_localhost: IsatapRouter: - 127.0.0.1 - ::1 filter_optional_null: IsatapRouter: null condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate ISATAP router configuration in enterprise environments - IPv6 transition projects and network infrastructure changes - Network administrators configuring dual-stack networking - Automatic ISATAP configuration in some Windows deployments level: medium