alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: patch priority for CVE-2015-2807
Matching passage: CVE-2015-2807. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in js/window.php in the Navis DocumentCloud plugin before 0.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter.
Near-miss passage: CVE-2015-0168. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Query: CVE similar to CVE-2015-7259
Matching passage: CVE-2015-7259. CWE: CWE-255. CVSS: 8.800000190734863. ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow user accounts to have multiple valid username and password pairs, which allows remote authenticated users to login to a target account via any of its username and password pairs.
Near-miss passage: CVE-2015-8673. CWE: CWE-255. CVSS: 6.800000190734863. Huawei TE30, TE40, TE50, and TE60 multimedia video conferencing endpoints with software before V100R001C10SPC100 do not require entry of the old password when changing the password for the Debug account, which allows physically proximate attackers to change the password by leveraging an unattended workstation.
Query: detect Detects the addition of office test registry that allows a user to specify an arbitrary DLL that will be executed every in logs
Matching passage: Sigma rule: Detects the addition of office test registry that allows a user to specify an arbitrary DLL that will be executed every. Logsource: windows / registry_event. Rule: title: Office Application Startup - Office Test id: 3d27f6dd-1c74-4687-b4fa-ca849d128d1c status: test description: Detects the addition of office test registry that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started references: - https://unit42.paloaltonetworks.com/unit42-technical-walkthrough-office-test-persistence-method-used-in-recent-sofacy-attacks/ author: omkar72 date: 2020-10-25 modified: 2023-11-08 tags: - attack.persistence - attack.t1137.002 logsource: category: registry_event product: windows detection: selection: TargetObject|contains: \Software\Microsoft\Office test\Special\Perf condition: selection falsepositives: - Unlikely level: medium
Near-miss passage: Sigma rule: Detects the execution of "dctask64.exe", a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This. Logsource: windows / process_creation. Rule: title: ManageEngine Endpoint Central Dctask64.EXE Potential Abuse id: 6345b048-8441-43a7-9bed-541133633d7a status: test description: 'Detects the execution of "dctask64.exe", a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This binary can be abused for DLL injection, arbitrary command and process execution. ' references: - https://twitter.com/gN3mes1s/status/1222088214581825540 - https://twitter.com/gN3mes1s/status/1222095963789111296 - https://twitter.com/gN3mes1s/status/1222095371175911424 author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2020-01-28 modified: 2025-01-22 tags: - attack.privilege-escalation - attack.stealth - attack.t1055.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \dctask64.exe - Hashes|contains: - IMPHASH=6834B1B94E49701D77CCB3C0895E1AFD - IMPHASH=1BB6F93B129F398C7C4A76BB97450BBA - IMPHASH=FAA2AC19875FADE461C8D89DCF2710A3 - IMPHASH=F1039CED4B91572AB7847D26032E6BBF selection_cli: CommandLine|contains: - ' executecmd64 ' - ' invokeexe ' - ' injectDll ' condition: all of selection_* falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-0464
Matching passage: CVE-2015-0464. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, and 6.3.6 allows remote attackers to affect confidentiality via unknown vectors related to Security.
Near-miss passage: CVE-2015-0468. CWE: UNKNOWN. CVSS: 6.0. Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 11.1.0.7, 11.2.0.3, and 12.1.0.1 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.
Query: rule covering Detects application popup reporting a failure of the Sysmon service
Matching passage: Sigma rule: Detects application popup reporting a failure of the Sysmon service. Logsource: windows / system. Rule: title: Sysmon Application Crashed id: 4d7f1827-1637-4def-8d8a-fd254f9454df status: test description: Detects application popup reporting a failure of the Sysmon service references: - https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows10/1803/W10_1803_Pro_19700101_17134.1/WEPExplorer/Application%20Popup.xml#L36 author: Tim Shelton date: 2022-04-26 modified: 2024-01-17 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: system detection: selection: Provider_Name: Application Popup EventID: 26 Caption: - sysmon64.exe - Application Error - sysmon.exe - Application Error condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: focuses on trivial artifacts observed in variants of prevalent offensive ps1 payloads, including Cobalt Strike Beacon, P. Logsource: windows / ps_module. Rule: title: Bad Opsec Powershell Code Artifacts id: 8d31a8ce-46b5-4dd6-bdc3-680931f1db86 related: - id: 73e733cc-1ace-3212-a107-ff2523cc9fc3 type: derived status: test description: 'focuses on trivial artifacts observed in variants of prevalent offensive ps1 payloads, including Cobalt Strike Beacon, PoshC2, Powerview, Letmein, Empire, Powersploit, and other attack payloads that often undergo minimal changes by attackers due to bad opsec. ' references: - https://newtonpaul.com/analysing-fileless-malware-cobalt-strike-beacon/ - https://labs.sentinelone.com/top-tier-russian-organized-cybercrime-group-unveils-fileless-stealthy-powertrick-backdoor-for-high-value-targets/ - https://www.mdeditor.tw/pl/pgRt author: ok @securonix invrep_de, oscd.community date: 2020-10-09 modified: 2022-12-25 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_4103: Payload|contains: - $DoIt - harmj0y - mattifestation - _RastaMouse - tifkin_ - '0xdeadbeef' condition: selection_4103 falsepositives: - Moderate-to-low; Despite the shorter length/lower entropy for some of these, because of high specificity, fp appears to be fairly limited in many environments. level: critical
Query: discovery using File and Directory Discovery
Matching passage: T1083 File and Directory Discovery. Tactics: discovery. Description: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Many command shell utilities can be used to obtain this information. Examples include <code>dir</code>, <code>tree</code>, <code>ls</code>, <code>find</code>, and <code>locate</code>.(Citation: Windows Commands JPCERT) Custom tools may also be used to gather file and directory information and interact with the [Native API](https://attack.mitre.org/techniques/T1106). Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather file and directory information (e.g. <code>dir</code>, <code>show flash</code>, and/or <code>nvram</code>).(Citation: US-CERT-TA18-106A) Some files and directories may require elevated or specific user permissions to access.
Near-miss passage: T1087.003 Email Account. Tactics: discovery. Description: Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).(Citation: Microsoft Exchange Address Lists) In on-premises Exchange and Exchange Online, the <code>Get-GlobalAddressList</code> PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.(Citation: Microsoft getglobaladdresslist)(Citation: Black Hills Attacking Exchange MailSniper, 2016) In Google Workspace, the GAL is shared with Microsoft Outlook users through the Google Workspace Sync for Microsoft Outlook (GWSMO) service. Additionally, the Google Workspace Directory allows for users to get a listing of other users within the organization.(Citation: Google Workspace Global Access List)
Query: exploit OpenGL in Apple iOS before 9.2, OS X before 10.11.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a cr
Matching passage: CVE-2015-7065. CWE: CWE-119. CVSS: 6.800000190734863. OpenGL in Apple iOS before 9.2, OS X before 10.11.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Near-miss passage: CVE-2015-5917. CWE: CWE-119. CVSS: 5.0. The glob implementation in tnftpd (formerly lukemftpd), as used in Apple OS X before 10.11, allows remote attackers to cause a denial of service (memory consumption and daemon outage) via a STAT command containing a crafted pattern, as demonstrated by multiple instances of the {..,..,..}/* substring.
Query: describe CVE-2015-6020
Matching passage: CVE-2015-6020. CWE: CWE-264. CVSS: 8.0. ZyXEL PMG5318-B20A devices with firmware 1.00AANC0b5 allow remote authenticated users to obtain administrative privileges by leveraging access to the user account.
Near-miss passage: CVE-2015-2152. CWE: CWE-264. CVSS: 1.899999976158142. Xen 4.5.x and earlier enables certain default backends when emulating a VGA device for an x86 HVM guest qemu even when the configuration disables them, which allows local guest users to obtain access to the VGA console by (1) setting the DISPLAY environment variable, when compiled with SDL support, or connecting to the VNC server on (2) ::1 or (3) 127.0.0.1, when not compiled with SDL support.
Query: risk of The XML parser in Cisco TelePresence Management Suite (TMS) 14.3(.2) and earlier does not properly handle external entities, which allows remote authenticated users to cause a deni
Matching passage: CVE-2015-0620. CWE: CWE-20. CVSS: 4.0. The XML parser in Cisco TelePresence Management Suite (TMS) 14.3(.2) and earlier does not properly handle external entities, which allows remote authenticated users to cause a denial of service via POST requests, aka Bug ID CSCus51494.
Near-miss passage: CVE-2015-7931. CWE: CWE-20. CVSS: 8.699999809265137. The Java client in Adcon Telemetry A840 Telemetry Gateway Base Station does not authenticate the station device, which allows man-in-the-middle attackers to spoof devices and obtain sensitive information by reading cleartext packet data, related to the lack of SSL support.
Query: describe CVE-2015-5262
Matching passage: CVE-2015-5262. CWE: CWE-399. CVSS: 4.300000190734863. http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.
Near-miss passage: CVE-2015-0743. CWE: CWE-399. CVSS: 5.0. Cisco Headend System Release allows remote attackers to cause a denial of service (DHCP and TFTP outage) via a flood of crafted UDP traffic, aka Bug ID CSCus04097.
Query: alert when Detects a login attempt in Google Workspace flagged as a potential attack by a government-backed threat actor
Matching passage: Sigma rule: Detects a login attempt in Google Workspace flagged as a potential attack by a government-backed threat actor. Logsource: gcp / google_workspace.login. Rule: title: Google Workspace Government Attack Warning id: eafe6f2b-cfec-4612-aec2-49563c33a087 status: experimental description: Detects a login attempt in Google Workspace flagged as a potential attack by a government-backed threat actor references: - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging - https://cloud.google.com/logging/docs/audit/understanding-audit-logs - https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#gov_attack_warning author: Tom Kluter date: 2026-04-28 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.impact - attack.stealth - attack.t1078 logsource: product: gcp service: google_workspace.login detection: selection: protoPayload.serviceName: login.googleapis.com protoPayload.metadata.event.eventName: gov_attack_warning condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary contro. Logsource: windows / ps_script. Rule: title: Root Certificate Installed - PowerShell id: 42821614-9264-4761-acfc-5772c3286f76 status: test description: Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md author: oscd.community, @redcanary, Zach Stanford @svch0st date: 2020-10-10 modified: 2022-12-02 tags: - attack.defense-impairment - attack.t1553.004 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection1: ScriptBlockText|contains|all: - Move-Item - Cert:\LocalMachine\Root selection2: ScriptBlockText|contains|all: - Import-Certificate - Cert:\LocalMachine\Root condition: 1 of selection* falsepositives: - Help Desk or IT may need to manually add a corporate Root CA on occasion. Need to test if GPO push doesn't trigger FP level: medium
Query: actor TTPs: Exfiltration Over Alternative Protocol
Matching passage: T1048 Exfiltration Over Alternative Protocol. Tactics: exfiltration. Description: Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel. Adversaries may also opt to encrypt and/or obfuscate these alternate channels. [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048) can be done using various common operating system utilities such as [Net](https://attack.mitre.org/software/S0039)/SMB or FTP.(Citation: Palo Alto OilRig Oct 2016) On macOS and Linux <code>curl</code> may be used to invoke protocols such as HTTP/S or FTP/S to exfiltrate data from a system.(Citation: 20 macOS Common Tools and Techniques) Many IaaS and SaaS platforms (such as Microsoft Exchange, Microsoft SharePoint, GitHub, and AWS S3) support the direct download of files, emails, source code, and other sensitive information via the web console or [Cloud API](https://attack.mitre.org/techniques/T1059/009).
Near-miss passage: T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol. Tactics: exfiltration. Description: Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.(Citation: copy_cmd_cisco) Adversaries may opt to obfuscate this data, without the use of encryption, within network protocols that are natively unencrypted (such as HTTP, FTP, or DNS). This may include custom or publicly available encoding/compression algorithms (such as base64) as well as embedding data within protocol headers and fields.
Query: CVE similar to CVE-2015-8057
Matching passage: CVE-2015-8057. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Near-miss passage: CVE-2015-4860. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI, a different vulnerability than CVE-2015-4883.
Query: patch priority for CVE-2015-3745
Matching passage: CVE-2015-3745. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Near-miss passage: CVE-2015-6764. CWE: CWE-119. CVSS: 9.800000190734863. The BasicJsonStringifier::SerializeJSArray function in json-stringifier.h in the JSON stringifier in Google V8, as used in Google Chrome before 47.0.2526.73, improperly loads array elements, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via crafted JavaScript code.
Query: Sigma YAML for macos / process_creation
Matching passage: Sigma rule: Detects the addition of a new file or path exclusion to MacOS Time Machine via the "tmutil" utility. An adversary could. Logsource: macos / process_creation. Rule: title: New File Exclusion Added To Time Machine Via Tmutil - MacOS id: 9acf45ed-3a26-4062-bf08-56857613eb52 status: test description: 'Detects the addition of a new file or path exclusion to MacOS Time Machine via the "tmutil" utility. An adversary could exclude a path from Time Machine backups to prevent certain files from being backed up. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-12---disable-time-machine - https://www.loobins.io/binaries/tmutil/ author: Pratinav Chandra date: 2024-05-29 tags: - attack.impact - attack.t1490 logsource: category: process_creation product: macos detection: selection_img: - Image|endswith: /tmutil - CommandLine|contains: tmutil selection_cmd: CommandLine|contains: addexclusion condition: all of selection_* falsepositives: - Legitimate administrator activity level: medium
Near-miss passage: Sigma rule: Detects changes to the Internet Explorer "DisableFirstRunCustomize" value, which prevents Internet Explorer from running. Logsource: windows / registry_set. Rule: title: Internet Explorer DisableFirstRunCustomize Enabled id: ab567429-1dfb-4674-b6d2-979fd2f9d125 status: test description: 'Detects changes to the Internet Explorer "DisableFirstRunCustomize" value, which prevents Internet Explorer from running the first run wizard the first time a user starts the browser after installing Internet Explorer or Windows. ' references: - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/devil-bait/NCSC-MAR-Devil-Bait.pdf - https://unit42.paloaltonetworks.com/operation-ke3chang-resurfaces-with-new-tidepool-malware/ - https://admx.help/?Category=InternetExplorer&Policy=Microsoft.Policies.InternetExplorer::NoFirstRunCustomise author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-16 modified: 2025-10-07 tags: - attack.defense-impairment logsource: product: windows category: registry_set detection: selection: TargetObject|endswith: \Microsoft\Internet Explorer\Main\DisableFirstRunCustomize Details: - DWORD (0x00000001) - DWORD (0x00000002) filter_main_generic: Image: - C:\Windows\explorer.exe - C:\Windows\System32\ie4uinit.exe filter_optional_avira: Image|contains|all: - \Temp\ - \.cr\avira_ Details|contains: DWORD (0x00000001) filter_optional_foxit: Image: - C:\Program Files (x86)\Foxit Software\Foxit PDF Reader\FoxitPDFReader.exe - C:\Program Files\Foxit Software\Foxit PDF Reader\FoxitPDFReader.exe Details|contains: DWORD (0x00000001) condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - As this is controlled by group policy as well as user settings. Some false positives may occur. level: medium
Query: exploit HP Operations Manager i Management Pack 1.x before 1.01 for SAP allows local users to execute OS commands by leveraging SAP administrative privileges.
Matching passage: CVE-2015-2107. CWE: CWE-284. CVSS: 6.800000190734863. HP Operations Manager i Management Pack 1.x before 1.01 for SAP allows local users to execute OS commands by leveraging SAP administrative privileges.
Near-miss passage: CVE-2015-2841. CWE: CWE-284. CVSS: 5.0. Citrix NetScaler AppFirewall, as used in NetScaler 10.5, allows remote attackers to bypass intended firewall restrictions via a crafted Content-Type header, as demonstrated by the application/octet-stream and text/xml Content-Types.
Query: exploit Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, 
Matching passage: CVE-2015-8864. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2016-4068.
Near-miss passage: CVE-2015-0345. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 16 and 11 before Update 5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: describe CVE-2015-5919
Matching passage: CVE-2015-5919. CWE: CWE-119. CVSS: 7.199999809265137. GasGauge in Apple watchOS before 2 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5918.
Near-miss passage: CVE-2015-9262. CWE: CWE-119. CVSS: 9.800000190734863. _XcursorThemeInherits in library.c in libXcursor before 1.1.15 allows remote attackers to cause denial of service or potentially code execution via a one-byte heap overflow.