alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-3804
Matching passage: CVE-2015-3804. CWE: CWE-119. CVSS: 7.5. FontParser in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted font file, a different vulnerability than CVE-2015-5756 and CVE-2015-5775.
Near-miss passage: CVE-2015-5783. CWE: CWE-119. CVSS: 9.300000190734863. IOGraphics in Apple OS X before 10.10.5 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2015-3770.
Query: patch priority for CVE-2015-1389
Matching passage: CVE-2015-1389. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.5 allows remote attackers to inject arbitrary web script or HTML via the username parameter to tips/tipsLoginSubmit.action.
Near-miss passage: CVE-2015-9285. CWE: CWE-79. CVSS: 6.099999904632568. esoTalk 1.0.0g4 has XSS via the PATH_INFO to the conversations/ URI.
Query: risk of Unspecified vulnerability in IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitrary commands with root p
Matching passage: CVE-2015-2016. CWE: UNKNOWN. CVSS: 9.0. Unspecified vulnerability in IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitrary commands with root privileges via unknown vectors.
Near-miss passage: CVE-2015-2473. CWE: UNKNOWN. CVSS: 9.300000190734863. Untrusted search path vulnerability in the client in Remote Desktop Protocol (RDP) through 8.1 in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .rdp file, aka "Remote Desktop Protocol DLL Planting Remote Code Execution Vulnerability."
Query: vulnerability: Cross-site scripting (XSS) vulnerability in the Simple Subscription module before 6.x-1.1 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administ
Matching passage: CVE-2015-4367. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Simple Subscription module before 6.x-1.1 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer blocks" permission to inject arbitrary web script or HTML via vectors related to block content.
Near-miss passage: CVE-2015-1864. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in the administration pages in Kallithea before 0.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) first name or (2) last name user details, or the (3) repository, (4) repository group, or (5) user group description.
Query: patch priority for CVE-2015-4383
Matching passage: CVE-2015-4383. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Decisions module for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that remove individual voters via unspecified vectors.
Near-miss passage: CVE-2015-3370. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Node Invite module before 6.x-2.5 for Drupal allows remote attackers to hijack the authentication of users with the "node_invite_can_manage_invite" permission for requests that re-enable node invitations via unspecified vectors.
Query: detect Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for in logs
Matching passage: Sigma rule: Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for. Logsource: windows / process_creation. Rule: title: Msiexec Quiet Installation id: 79a87aa6-e4bd-42fc-a5bb-5e6fbdcd62f5 status: test description: 'Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi) ' references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md - https://twitter.com/_st0pp3r_/status/1583914244344799235 author: frack113 date: 2022-01-16 modified: 2026-07-28 tags: - attack.stealth - attack.t1218.007 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \msiexec.exe - OriginalFileName: msiexec.exe selection_cli: CommandLine|contains|windash: - -i - -package - -a - -j selection_quiet: CommandLine|contains|windash: -q filter_main_system_temp: ParentImage|startswith: C:\Windows\Temp\ filter_main_ccm: ParentImage: C:\Windows\CCM\Ccm32BitLauncher.exe IntegrityLevel: - System - S-1-16-16384 filter_optional_user_temp: ParentImage|startswith: C:\Users\ ParentImage|contains: \AppData\Local\Temp\ filter_optional_wsl: ParentImage|endswith: C:\Windows\System32\wsl.exe Image|endswith: C:\Windows\System32\msiexec.exe condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - WindowsApps installing updates via the quiet flag level: medium
Near-miss passage: Sigma rule: Detect adversaries enumerate sensitive files. Logsource: windows / ps_script. Rule: title: Powershell Sensitive File Discovery id: 7d416556-6502-45b2-9bad-9d2f05f38997 related: - id: d23f2ba5-9da0-4463-8908-8ee47f614bb9 type: derived status: test description: Detect adversaries enumerate sensitive files references: - https://twitter.com/malmoeb/status/1570814999370801158 author: frack113 date: 2022-09-16 tags: - attack.discovery - attack.t1083 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_action: ScriptBlockText|contains: - ls - get-childitem - gci selection_recurse: ScriptBlockText|contains: -recurse selection_file: ScriptBlockText|contains: - .pass - .kdbx - .kdb condition: all of selection_* falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-6009
Matching passage: CVE-2015-6009. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in Web Reference Database (aka refbase) through 0.9.6 allow remote attackers to execute arbitrary SQL commands via (1) the where parameter to rss.php or (2) the sqlQuery parameter to search.php, a different issue than CVE-2015-7382.
Near-miss passage: CVE-2015-5023. CWE: CWE-89. CVSS: 5.400000095367432. SQL injection vulnerability in IBM Curam Social Program Management 6.1 before 6.1.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Query: CVE similar to CVE-2015-4676
Matching passage: CVE-2015-4676. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in ticket.php in TickFa 1.x allows remote authenticated users to execute arbitrary SQL commands via the tid parameter in a read action.
Near-miss passage: CVE-2015-6331. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the web framework in Cisco Prime Collaboration Assurance 10.5(1) allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCus39887.
Query: common weakness: Obscured Security-relevant Information by Alternate Name
Matching passage: CWE-224 Obscured Security-relevant Information by Alternate Name. The product records security-relevant information according to an alternate name of the affected entity, instead of the canonical name.
Near-miss passage: CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere. The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.
Query: alert when Detects a "dllhost" process spawning with no commandline arguments which is very rare to happen and could indicate proce
Matching passage: Sigma rule: Detects a "dllhost" process spawning with no commandline arguments which is very rare to happen and could indicate proce. Logsource: windows / process_creation. Rule: title: Dllhost.EXE Execution Anomaly id: e7888eb1-13b0-4616-bd99-4bc0c2b054b9 status: test description: Detects a "dllhost" process spawning with no commandline arguments which is very rare to happen and could indicate process injection activity or malware mimicking similar system processes. references: - https://redcanary.com/blog/child-processes/ - https://nasbench.medium.com/what-is-the-dllhost-exe-process-actually-running-ef9fe4c19c08 - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/goofy-guineapig/NCSC-MAR-Goofy-Guineapig.pdf author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-27 modified: 2023-05-15 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: category: process_creation product: windows detection: selection: Image|endswith: \dllhost.exe CommandLine: - dllhost.exe - dllhost filter_main_null: CommandLine: null condition: selection and not 1 of filter_main_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects usage of Gpg4win to encrypt files. Logsource: windows / process_creation. Rule: title: File Encryption Using Gpg4win id: 550bbb84-ce5d-4e61-84ad-e590f0024dcd status: test description: Detects usage of Gpg4win to encrypt files references: - https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html - https://www.gpg4win.de/documentation.html - https://news.sophos.com/en-us/2022/01/19/zloader-installs-remote-access-backdoors-and-delivers-cobalt-strike/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-09 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_metadata: - Image|endswith: - \gpg.exe - \gpg2.exe - Description: GnuPG’s OpenPGP tool selection_cli: CommandLine|contains|all: - ' -c ' - passphrase condition: all of selection_* falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-7062
Matching passage: CVE-2015-7062. CWE: CWE-264. CVSS: 4.599999904632568. Apple OS X before 10.11.2 and tvOS before 9.1 allow local users to bypass intended configuration-profile installation restrictions via unspecified vectors.
Near-miss passage: CVE-2015-3858. CWE: CWE-264. CVSS: 9.300000190734863. The checkDestination function in internal/telephony/SMSDispatcher.java in Android before 5.1.1 LMY48M relies on an obsolete permission name for an authorization check, which allows attackers to bypass an intended user-confirmation requirement for SMS short-code messaging via a crafted application, aka internal bug 22314646.
Query: vulnerability: Microsoft SQL Server 2008 SP3 and SP4, 2008 R2 SP2 and SP3, 2012 SP1 and SP2, and 2014, when transactional replication is configured, does not prevent use of uninitialized memory i
Matching passage: CVE-2015-1762. CWE: CWE-74. CVSS: 7.099999904632568. Microsoft SQL Server 2008 SP3 and SP4, 2008 R2 SP2 and SP3, 2012 SP1 and SP2, and 2014, when transactional replication is configured, does not prevent use of uninitialized memory in unspecified function calls, which allows remote authenticated users to execute arbitrary code by leveraging certain permissions and making a crafted query, as demonstrated by the VIEW SERVER STATE permission, aka "SQL Server Remote Code Execution Vulnerability."
Near-miss passage: CVE-2015-5841. CWE: CWE-74. CVSS: 5.0. The CFNetwork Proxies component in Apple iOS before 9 does not properly handle a Set-Cookie header within a response to an HTTP CONNECT request, which allows remote proxy servers to conduct cookie-injection attacks via a crafted response.
Query: vulnerability: SQL injection vulnerability in "yeager/y.php/tab_USERLIST" in Yeager CMS 1.2.1 allows local users to execute arbitrary SQL commands via the "pagedir_orderby" parameter.
Matching passage: CVE-2015-7569. CWE: CWE-89. CVSS: 8.800000190734863. SQL injection vulnerability in "yeager/y.php/tab_USERLIST" in Yeager CMS 1.2.1 allows local users to execute arbitrary SQL commands via the "pagedir_orderby" parameter.
Near-miss passage: CVE-2015-5148. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in LivelyCart 1.2.0 allows remote attackers to execute arbitrary SQL commands via the search_query parameter to product/search.
Query: SOC runbook when seeing SIEM correlation: stealth activity consistent with PubPrn
Matching passage: Playbook for T1216.001 PubPrn. 1) Validate alert telemetry against T1216.001. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may use PubPrn to proxy execution of malicious remote files. PubPrn.vbs is a [Visual Basic](https://attack.mitre.org/techniques/T1059/005) script that publishes a printer to Active Directory Domain Services. The script may be signed by Microsoft and is commonly executed through the [Windows Command Shell](https://attack.mitre.org/techniques/T1059/003) via <code>Cscript.exe</code>. For
Near-miss passage: Playbook for T1216 System Script Proxy Execution. Different response path focused on stealth.
Query: CWE for Deadlock
Matching passage: CWE-833 Deadlock. The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock.
Near-miss passage: CWE-333 Improper Handling of Insufficient Entropy in TRNG. True random number generators (TRNG) generally have a limited source of entropy and therefore can fail or block.
Query: detection rule: Detects potential network sniffing via use of network tools such as "tshark", "windump". Network sniffing refers to usin
Matching passage: Sigma rule: Detects potential network sniffing via use of network tools such as "tshark", "windump". Network sniffing refers to usin. Logsource: windows / process_creation. Rule: title: Potential Network Sniffing Activity Using Network Tools id: ba1f7802-adc7-48b4-9ecb-81e227fddfd5 status: test description: 'Detects potential network sniffing via use of network tools such as "tshark", "windump". Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1040/T1040.md author: Timur Zinniatullin, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2019-10-21 modified: 2023-02-20 tags: - attack.credential-access - attack.discovery - attack.t1040 logsource: category: process_creation product: windows detection: selection_tshark: Image|endswith: \tshark.exe CommandLine|contains: -i selection_windump: Image|endswith: \windump.exe condition: 1 of selection_* falsepositives: - Legitimate administration activity to troubleshoot network issues level: medium
Near-miss passage: Sigma rule: Detects scheduled task creation events that include suspicious actions, and is run once at 00:00. Logsource: windows / process_creation. Rule: title: Uncommon One Time Only Scheduled Task At 00:00 id: 970823b7-273b-460a-8afc-3a6811998529 status: test description: Detects scheduled task creation events that include suspicious actions, and is run once at 00:00 references: - https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbyte author: pH-T (Nextron Systems) date: 2022-07-15 modified: 2023-02-03 tags: - attack.execution - attack.persistence - attack.privilege-escalation - attack.t1053.005 logsource: category: process_creation product: windows detection: selection_img: - Image|contains: \schtasks.exe - OriginalFileName: schtasks.exe selection_cli: CommandLine|contains: - wscript - vbscript - cscript - 'wmic ' - wmic.exe - regsvr32.exe - powershell - \AppData\ selection_time: CommandLine|contains|all: - once - 00:00 condition: all of selection_* falsepositives: - Software installation level: high
Query: adversary uses Screensaver
Matching passage: T1546.002 Screensaver. Tactics: privilege escalation, persistence. Description: Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.(Citation: Wikipedia Screensaver) The Windows screensaver application scrnsave.scr is located in <code>C:\Windows\System32\</code>, and <code>C:\Windows\sysWOW64\</code> on 64-bit Windows systems, along with screensavers included with base Windows installations. The following screensaver settings are stored in the Registry (<code>HKCU\Control Panel\Desktop\</code>) and could be manipulated to achieve persistence: * <code>SCRNSAVE.exe</code> - set to malicious PE path * <code>ScreenSaveActive</code> - set to '1' to enable the screensaver * <code>ScreenSaverIsSecure</code> - set to '0' to not require a password to unlock * <code>ScreenSaveTimeout</code> - sets user inactivity timeout before screensaver is executed Adversaries can use screensaver settings to maintain persistence by setting the screensaver to run malware after a certain timeframe of user inactivity.(Citation: ESET Gazer Aug 2017)
Near-miss passage: T1546.009 AppCert DLLs. Tactics: privilege escalation, persistence. Description: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the <code>AppCertDLLs</code> Registry key under <code>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\</code> are loaded into every process that calls the ubiquitously used application programming interface (API) functions <code>CreateProcess</code>, <code>CreateProcessAsUser</code>, <code>CreateProcessWithLoginW</code>, <code>CreateProcessWithTokenW</code>, or <code>WinExec</code>. (Citation: Elastic Process Injection July 2017) Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), this value can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. Malicious AppCert DLLs may also provide persistence by continuously being triggered by API activity.
Query: rule covering Detects when a Security Compliance Center reported a user who exceeded sending limits of the service policies and becaus
Matching passage: Sigma rule: Detects when a Security Compliance Center reported a user who exceeded sending limits of the service policies and becaus. Logsource: m365 / threat_management. Rule: title: Microsoft 365 - User Restricted from Sending Email id: ff246f56-7f24-402a-baca-b86540e3925c status: test description: Detects when a Security Compliance Center reported a user who exceeded sending limits of the service policies and because of this has been restricted from sending email. references: - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference author: austinsonger date: 2021-08-19 modified: 2022-10-09 tags: - attack.initial-access - attack.t1199 logsource: service: threat_management product: m365 detection: selection: eventSource: SecurityComplianceCenter eventName: User restricted from sending email status: success condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects instances where an HTTP service on an OpenCanary node has received a GET request.. Logsource: opencanary / application. Rule: title: OpenCanary - HTTP GET Request id: af6c3078-84cd-4c68-8842-08b76bd81b13 status: test description: Detects instances where an HTTP service on an OpenCanary node has received a GET request. references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.initial-access - attack.t1190 logsource: category: application product: opencanary detection: selection: logtype: 3000 condition: selection falsepositives: - Unlikely level: high
Query: CVE similar to CVE-2015-5663
Matching passage: CVE-2015-5663. CWE: CWE-264. CVSS: 7.400000095367432. The file-execution functionality in WinRAR before 5.30 beta 5 allows local users to gain privileges via a Trojan horse file with a name similar to an extensionless filename that was selected by the user.
Near-miss passage: CVE-2015-7596. CWE: CWE-264. CVSS: 7.800000190734863. SafeNet Authentication Service End User Software Tools for Windows uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module.
Query: detection rule: Detects potential suspicious winget package installation from a suspicious source.
Matching passage: Sigma rule: Detects potential suspicious winget package installation from a suspicious source.. Logsource: windows / create_stream_hash. Rule: title: Potential Suspicious Winget Package Installation id: a3f5c081-e75b-43a0-9f5b-51f26fe5dba2 status: test description: Detects potential suspicious winget package installation from a suspicious source. references: - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-18 tags: - attack.persistence - attack.stealth logsource: product: windows category: create_stream_hash detection: selection: Contents|startswith: '[ZoneTransfer] ZoneId=3' Contents|contains: - ://1 - ://2 - ://3 - ://4 - ://5 - ://6 - ://7 - ://8 - ://9 TargetFilename|endswith: :Zone.Identifier TargetFilename|contains: \AppData\Local\Temp\WinGet\ condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when a user has potentially entered their password into the username field, which will cause the password to be. Logsource: okta / okta. Rule: title: Potential Okta Password in AlternateID Field id: 91b76b84-8589-47aa-9605-c837583b82a9 status: test description: 'Detects when a user has potentially entered their password into the username field, which will cause the password to be retained in log files. ' references: - https://developer.okta.com/docs/reference/api/system-log/ - https://www.mitiga.io/blog/how-okta-passwords-can-be-compromised-uncovering-a-risk-to-user-data - https://help.okta.com/en-us/Content/Topics/users-groups-profiles/usgp-create-character-restriction.htm author: kelnage date: 2023-04-03 modified: 2026-04-27 tags: - attack.credential-access - attack.t1552 logsource: product: okta service: okta detection: selection: legacyEventType: core.user_auth.login_failed filter_main: actor.alternateId|re: (^0oa.*|[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,10}) condition: selection and not filter_main falsepositives: - Unlikely level: high