alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-5929
Matching passage: CVE-2015-5929. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-1, APPLE-SA-2015-10-21-3, and APPLE-SA-2015-10-21-5.
Near-miss passage: CVE-2015-1897. CWE: CWE-119. CVSS: 7.199999809265137. Stack-based buffer overflow in the FastBackMount process in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.11.1 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-1898.
Query: vulnerability: Heap-based buffer overflow in the verify_vbr_checksum function in exfatfsck in exfat-utils before 1.2.1 allows remote attackers to cause a denial of service (infinite loop) or poss
Matching passage: CVE-2015-8026. CWE: CWE-119. CVSS: 7.800000190734863. Heap-based buffer overflow in the verify_vbr_checksum function in exfatfsck in exfat-utils before 1.2.1 allows remote attackers to cause a denial of service (infinite loop) or possibly execute arbitrary code via a crafted filesystem.
Near-miss passage: CVE-2015-2520. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel for Mac 2011 and 2016, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Query: write Sigma for Detects attempts to discover the files with setuid/setgid capability on them. That would allow adversary to escalate the
Matching passage: Sigma rule: Detects attempts to discover the files with setuid/setgid capability on them. That would allow adversary to escalate the. Logsource: linux / auditd. Rule: title: Linux Capabilities Discovery id: fe10751f-1995-40a5-aaa2-c97ccb4123fe status: test description: Detects attempts to discover the files with setuid/setgid capability on them. That would allow adversary to escalate their privileges. references: - https://man7.org/linux/man-pages/man8/getcap.8.html - https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/ - https://mn3m.info/posts/suid-vs-capabilities/ - https://int0x33.medium.com/day-44-linux-capabilities-privilege-escalation-via-openssl-with-selinux-enabled-and-enforced-74d2bec02099 author: Pawel Mazur date: 2021-11-28 modified: 2022-12-25 tags: - attack.discovery - attack.privilege-escalation - attack.t1083 - attack.t1548 logsource: product: linux service: auditd detection: selection: type: EXECVE a0: getcap a1: -r a2: / condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal activity. Logsource: proxy. Rule: title: PwnDrp Access id: 2b1ee7e4-89b6-4739-b7bb-b811b6607e5e status: test description: Detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal activity references: - https://breakdev.org/pwndrop/ author: Florian Roth (Nextron Systems) date: 2020-04-15 modified: 2021-11-27 tags: - attack.command-and-control - attack.t1071.001 - attack.t1102.001 - attack.t1102.003 logsource: category: proxy detection: selection: c-uri|contains: /pwndrop/ condition: selection falsepositives: - Unknown level: critical
Query: CVE similar to CVE-2015-4759
Matching passage: CVE-2015-4759. CWE: UNKNOWN. CVSS: 6.800000190734863. Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Data Quality based on Trillium, a different vulnerability than CVE-2015-0443, CVE-2015-0444, CVE-2015-0445, CVE-2015-0446, CVE-2015-2634, CVE-2015-2635, CVE-2015-2636, and CVE-2015-4758.
Near-miss passage: CVE-2015-0338. CWE: UNKNOWN. CVSS: 10.0. Integer overflow in Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code via unspecified vectors.
Query: patch priority for CVE-2015-6327
Matching passage: CVE-2015-6327. CWE: CWE-399. CVSS: 7.800000190734863. The IKEv1 implementation in Cisco Adaptive Security Appliance (ASA) software 7.2 and 8.2 before 8.2(5.58), 8.3 and 8.4 before 8.4(7.29), 8.5 through 8.7 before 8.7(1.17), 9.0 before 9.0(4.37), 9.1 before 9.1(6.8), 9.2 before 9.2(4), and 9.3 before 9.3(3) allows remote attackers to cause a denial of service (device reload) via crafted ISAKMP UDP packets, aka Bug ID CSCus94026.
Near-miss passage: CVE-2015-2013. CWE: CWE-399. CVSS: 5.0. IBM WebSphere MQ 7.0.1 before 7.0.1.13 allows remote attackers to cause a denial of service (channel-agent abend and process outage) via a crafted selection string in an MQI call.
Query: patch priority for CVE-2015-5893
Matching passage: CVE-2015-5893. CWE: CWE-200. CVSS: 2.0999999046325684. SMBClient in SMB in Apple OS X before 10.11 allows local users to obtain sensitive kernel memory-layout information via unspecified vectors.
Near-miss passage: CVE-2015-4980. CWE: CWE-200. CVSS: 4.0. Unspecified vulnerability in IBM WebSphere Commerce 7.0.0.6 through 7.0.0.9 allows remote authenticated users to obtain sensitive personal information via unknown vectors.
Query: CVE similar to CVE-2015-7818
Matching passage: CVE-2015-7818. CWE: CWE-264. CVSS: 7.199999809265137. The administration-panel web service in IBM System Networking Switch Center (SNSC) before 7.3.1.5 and Lenovo Switch Center before 8.1.2.0 allows local users to execute arbitrary JSP code with SYSTEM privileges by using the Apache Axis AdminService deployment method to install a .jsp file.
Near-miss passage: CVE-2015-6755. CWE: CWE-264. CVSS: 7.5. The ContainerNode::parserInsertBefore function in core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 46.0.2490.71, proceeds with a DOM tree insertion in certain cases where a parent node no longer contains a child node, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code.
Query: describe CVE-2015-8026
Matching passage: CVE-2015-8026. CWE: CWE-119. CVSS: 7.800000190734863. Heap-based buffer overflow in the verify_vbr_checksum function in exfatfsck in exfat-utils before 1.2.1 allows remote attackers to cause a denial of service (infinite loop) or possibly execute arbitrary code via a crafted filesystem.
Near-miss passage: CVE-2015-2520. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel for Mac 2011 and 2016, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Query: alert when Detects suspicious UltraVNC command line flag combination that indicate a auto reconnect upon execution, e.g. startup (a
Matching passage: Sigma rule: Detects suspicious UltraVNC command line flag combination that indicate a auto reconnect upon execution, e.g. startup (a. Logsource: windows / process_creation. Rule: title: Suspicious UltraVNC Execution id: 871b9555-69ca-4993-99d3-35a59f9f3599 status: test description: Detects suspicious UltraVNC command line flag combination that indicate a auto reconnect upon execution, e.g. startup (as seen being used by Gamaredon threat group) references: - https://web.archive.org/web/20220224045756/https://www.ria.ee/sites/default/files/content-editors/kuberturve/tale_of_gamaredon_infection.pdf - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine - https://unit42.paloaltonetworks.com/unit-42-title-gamaredon-group-toolset-evolution - https://uvnc.com/docs/uvnc-viewer/52-ultravnc-viewer-commandline-parameters.html author: Bhabesh Raj date: 2022-03-04 modified: 2022-03-09 tags: - attack.lateral-movement - attack.g0047 - attack.t1021.005 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - '-autoreconnect ' - '-connect ' - '-id:' condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Executes arbitrary PowerShell code using SyncAppvPublishingServer.exe.. Logsource: windows / process_creation. Rule: title: SyncAppvPublishingServer Execute Arbitrary PowerShell Code id: fbd7c32d-db2a-4418-b92c-566eb8911133 related: - id: fde7929d-8beb-4a4c-b922-be9974671667 type: obsolete status: test description: Executes arbitrary PowerShell code using SyncAppvPublishingServer.exe. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md - https://lolbas-project.github.io/lolbas/Binaries/Syncappvpublishingserver/ author: frack113 date: 2021-07-12 modified: 2022-10-04 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \SyncAppvPublishingServer.exe - OriginalFileName: syncappvpublishingserver.exe selection_cli: CommandLine|contains: '"n; ' condition: all of selection_* falsepositives: - App-V clients level: medium
Query: Sigma rule for Detect the use of "<" to read and potentially execute a file via cmd.exe
Matching passage: Sigma rule: Detect the use of "<" to read and potentially execute a file via cmd.exe. Logsource: windows / process_creation. Rule: title: Read Contents From Stdin Via Cmd.EXE id: 241e802a-b65e-484f-88cd-c2dc10f9206d related: - id: 00a4bacd-6db4-46d5-9258-a7d5ebff4003 type: obsolete status: test description: Detect the use of "<" to read and potentially execute a file via cmd.exe references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1059.003/T1059.003.md - https://web.archive.org/web/20220306121156/https://www.x86matthew.com/view_post?id=ntdll_pipe author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-03-07 tags: - attack.execution - attack.t1059.003 logsource: category: process_creation product: windows detection: selection_cmd: - OriginalFileName: Cmd.Exe - Image|endswith: \cmd.exe selection_cli: CommandLine|contains: < condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects potential abuse of the "manage-bde.wsf" script as a LOLBIN to proxy execution. Logsource: windows / process_creation. Rule: title: Potential Manage-bde.wsf Abuse To Proxy Execution id: c363385c-f75d-4753-a108-c1a8e28bdbda status: test description: Detects potential abuse of the "manage-bde.wsf" script as a LOLBIN to proxy execution references: - https://lolbas-project.github.io/lolbas/Scripts/Manage-bde/ - https://gist.github.com/bohops/735edb7494fe1bd1010d67823842b712 - https://twitter.com/bohops/status/980659399495741441 - https://twitter.com/JohnLaTwC/status/1223292479270600706 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1216/T1216.md author: oscd.community, Natalia Shornikova, Nasreddine Bencherchali (Nextron Systems) date: 2020-10-13 modified: 2023-02-03 tags: - attack.stealth - attack.t1216 logsource: category: process_creation product: windows detection: selection_wscript_img: - Image|endswith: \wscript.exe - OriginalFileName: wscript.exe selection_wscript_cli: CommandLine|contains: manage-bde.wsf selection_parent: ParentImage|endswith: - \cscript.exe - \wscript.exe ParentCommandLine|contains: manage-bde.wsf selection_filter_cmd: Image|endswith: \cmd.exe condition: all of selection_wscript_* or (selection_parent and not selection_filter_cmd) falsepositives: - Unlikely level: high
Query: detect Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing. The pattern " in logs
Matching passage: Sigma rule: Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing. The pattern ". Logsource: windows / dns_query. Rule: title: Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing id: e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c related: - id: b07e58cf-cacc-4135-8473-ccb2eba63dd2 type: similar - id: 5588576c-5898-4fac-bcdd-7475a60e8f43 type: similar status: experimental description: 'Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts. It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073. ' references: - https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025 - https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-06-20 tags: - attack.collection - attack.credential-access - attack.persistence - attack.privilege-escalation - attack.t1557.001 - attack.t1187 logsource: product: windows category: dns_query detection: selection: QueryName|contains|all: - UWhRCA - BAAAA condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects changes and updates to the user risk and MFA registration policy. Attackers can modified the policies to Bypass. Logsource: azure / auditlogs. Rule: title: User Risk and MFA Registration Policy Updated id: d4c7758e-9417-4f2e-9109-6125d66dabef status: test description: 'Detects changes and updates to the user risk and MFA registration policy. Attackers can modified the policies to Bypass MFA, weaken security thresholds, facilitate further attacks, maintain persistence. ' references: - https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-configure-mfa-policy - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities author: Harjot Singh (@cyb3rjy0t) date: 2024-08-13 tags: - attack.persistence logsource: product: azure service: auditlogs detection: selection: LoggedByService: AAD Management UX Category: Policy OperationName: Update User Risk and MFA Registration Policy condition: selection falsepositives: - Known updates by administrators. level: high
Query: CVE similar to CVE-2015-4659
Matching passage: CVE-2015-4659. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in ClickHeat 1.14 and earlier allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a config action to index.php.
Near-miss passage: CVE-2015-0700. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Dashboard page in the monitoring-and-report section in Cisco Secure Access Control Server Solution Engine before 5.5(0.46.5) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuj62924.
Query: telemetry for T1219
Matching passage: T1219 Remote Access Tools. Tactics: command and control. Description: An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy) Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access. Remote access tools may be installed and used post-compromise as an alternate communications channel for redundant access or to establish an interactive remote desktop session with the target system. It may also be used as a malware component to establish a reverse connection or back-connect to a service or adversary-controlled system. Installation of many remote access tools may also include persistence (e.g., the software's installation routine creates a [Windows Service](https://attack.mitre.org/techniques/T1543/003)). Remote access modules/features may also exist as part of otherwise existing software (e.g., Google Chrome’s Remote Desktop).(Citation: Google Chrome Remote Desktop)(Citation: Chrome Remote Desktop)
Near-miss passage: T1219.002 Remote Desktop Software. Tactics: command and control. Description: An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks. Desktop support software provides a graphical interface for remotely controlling another computer, transmitting the display output, keyboard input, and mouse control between devices using various protocols. Desktop support software, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy) Remote access modules/features may also exist as part of otherwise existing software such as Zoom or Google Chrome’s Remote Desktop.(Citation: Google Chrome Remote Desktop)(Citation: Chrome Remote Desktop)
Query: risk of Cross-site scripting (XSS) vulnerability in the Video module before 7.x-2.11 for Drupal, when using the video WYSIWYG plugin, allows remote authenticated users to inject arbitrary 
Matching passage: CVE-2015-3362. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Video module before 7.x-2.11 for Drupal, when using the video WYSIWYG plugin, allows remote authenticated users to inject arbitrary web script or HTML via a node title.
Near-miss passage: CVE-2015-8807. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the _renderVarInput_number function in horde/framework/Core/lib/Horde/Core/Ui/VarRenderer/Html.php in Horde Groupware before 5.2.12 and Horde Groupware Webmail Edition before 5.2.12 allows remote attackers to inject arbitrary web script or HTML via vectors involving numeric form fields.
Query: describe CVE-2015-1395
Matching passage: CVE-2015-1395. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in GNU patch versions which support Git-style patching before 2.7.3 allows remote attackers to write to arbitrary files with the permissions of the target user via a .. (dot dot) in a diff file name.
Near-miss passage: CVE-2015-2304. CWE: CWE-22. CVSS: 6.400000095367432. Absolute path traversal vulnerability in bsdcpio in libarchive 3.1.2 and earlier allows remote attackers to write to arbitrary files via a full pathname in an archive.
Query: exploit Open redirect vulnerability in EMC Documentum WebTop before 6.8P02, Documentum Administrator before 7.2P01, Documentum Digital Assets Manager through 6.5SP6, Documentum Web Publish
Matching passage: CVE-2015-4529. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in EMC Documentum WebTop before 6.8P02, Documentum Administrator before 7.2P01, Documentum Digital Assets Manager through 6.5SP6, Documentum Web Publishers through 6.5SP7, and Documentum Task Space through 6.7SP2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL.
Near-miss passage: CVE-2015-0868. CWE: UNKNOWN. CVSS: 7.5. Unrestricted file upload vulnerability in Mrs. Shiromuku Perl CGI shiromuku(bu2)BBS before 2.91 allows remote attackers to execute arbitrary code by uploading an executable file.
Query: rule covering Detects when a user enable developer features such as "Developer Mode" or "Application Sideloading". Which allows the us
Matching passage: Sigma rule: Detects when a user enable developer features such as "Developer Mode" or "Application Sideloading". Which allows the us. Logsource: windows / process_creation. Rule: title: Potential Signing Bypass Via Windows Developer Features id: a383dec4-deec-4e6e-913b-ed9249670848 related: - id: b110ebaf-697f-4da1-afd5-b536fa27a2c1 type: similar status: test description: Detects when a user enable developer features such as "Developer Mode" or "Application Sideloading". Which allows the user to install untrusted packages. references: - Internal Research - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-11 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \SystemSettingsAdminFlows.exe - OriginalFileName: SystemSettingsAdminFlows.EXE selection_flag: CommandLine|contains: TurnOnDeveloperFeatures selection_options: CommandLine|contains: - DeveloperUnlock - EnableSideloading condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a when net.exe is called with a password in the command line. Logsource: windows / process_creation. Rule: title: Password Provided In Command Line Of Net.EXE id: d4498716-1d52-438f-8084-4a603157d131 status: test description: Detects a when net.exe is called with a password in the command line references: - Internal Research author: Tim Shelton (HAWK.IO) date: 2021-12-09 modified: 2023-02-21 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation - attack.lateral-movement - attack.stealth - attack.t1021.002 - attack.t1078 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \net.exe - \net1.exe - OriginalFileName: - net.exe - net1.exe selection_cli: CommandLine|contains|all: - ' use ' - :*\\ - /USER:* * filter_main_empty: CommandLine|endswith: ' ' condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: medium
Query: risk of EMC PowerPath Virtual Appliance (aka vApp) before 2.0 has default passwords for the (1) emcupdate and (2) svcuser accounts, which makes it easier for remote attackers to obtain pot
Matching passage: CVE-2015-0529. CWE: CWE-255. CVSS: 5.0. EMC PowerPath Virtual Appliance (aka vApp) before 2.0 has default passwords for the (1) emcupdate and (2) svcuser accounts, which makes it easier for remote attackers to obtain potentially sensitive information via a login session.
Near-miss passage: CVE-2015-1320. CWE: CWE-255. CVSS: 9.800000190734863. The SeaMicro provisioning of Ubuntu MAAS logs credentials, including username and password, for the management interface. This issue affects Ubuntu MAAS versions prior to 1.9.2.
Query: common weakness: Exposure of Version-Control Repository to an Unauthorized Control Sphere
Matching passage: CWE-527 Exposure of Version-Control Repository to an Unauthorized Control Sphere. The product stores a CVS, git, or other repository in a directory, archive, or other resource that is stored, transferred, or otherwise made accessible to unauthorized actors.
Near-miss passage: CWE-348 Use of Less Trusted Source. The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.