alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: CVE similar to CVE-2015-4397
Matching passage: CVE-2015-4397. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Node Template module for Drupal allows remote attackers to hijack the authentication of users with the "access node template" permission for requests that delete node templates via unspecified vectors.
Near-miss passage: CVE-2015-4364. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in includes/campaignmonitor_lists.admin.inc in the Campaign Monitor module 7.x-1.0 for Drupal allow remote attackers to hijack the authentication of users for requests that (1) enable list subscriptions via a request to admin/config/services/campaignmonitor/lists/%/enable or (2) disable list subscriptions via a request to admin/config/services/campaignmonitor/lists/%/disable. NOTE: this refers to an issue in an independently developed Drupal module, and NOT an issue in the Campaign Monitor software itself (described on the campaignmonitor.com web site).
Query: describe CVE-2015-6848
Matching passage: CVE-2015-6848. CWE: CWE-284. CVSS: 8.5. EMC Isilon OneFS 7.1.x before 7.1.1.5, 7.2.0.x before 7.2.0.3, and 7.2.1.x before 7.2.1.1, when the RFC 2307 feature is configured but SFU is not universally present, allows remote authenticated AD users to obtain root privileges via unspecified vectors.
Near-miss passage: CVE-2015-1854. CWE: CWE-284. CVSS: 7.5. 389 Directory Server before 1.3.3.10 allows attackers to bypass intended access restrictions and modify directory entries via a crafted ldapmodrdn call.
Query: risk of The copy_from_lzss_window function in archive_read_support_format_rar.c in libarchive 3.2.0 and earlier allows remote attackers to cause a denial of service (out-of-bounds heap rea
Matching passage: CVE-2015-8934. CWE: CWE-125. CVSS: 5.5. The copy_from_lzss_window function in archive_read_support_format_rar.c in libarchive 3.2.0 and earlier allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted rar file.
Near-miss passage: CVE-2015-8763. CWE: CWE-125. CVSS: 8.100000381469727. The EAP-PWD module in FreeRADIUS 3.0 through 3.0.8 allows remote attackers to have unspecified impact via a crafted (1) commit or (2) confirm message, which triggers an out-of-bounds read.
Query: containment actions for Persistence mechanism resembling Trusted Relationship
Matching passage: Playbook for T1199 Trusted Relationship. 1) Validate alert telemetry against T1199. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: initial access. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network. Organizations often grant elevated access to second or third-party external providers in order to allow them to manag
Near-miss passage: Playbook for T1195.002 Compromise Software Supply Chain. Different response path focused on initial access.
Query: risk of Cross-site scripting (XSS) vulnerability in IBM Content Navigator 2.0.2 before 2.0.2-ICN-FP007 and 2.0.3 before 2.0.3-ICN-FP003, as used in Content Manager, FileNet Content Manager
Matching passage: CVE-2015-1888. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Content Navigator 2.0.2 before 2.0.2-ICN-FP007 and 2.0.3 before 2.0.3-ICN-FP003, as used in Content Manager, FileNet Content Manager, Content Foundation, Content Manager OnDemand, and other products, allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-1402. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Content Rating extension 1.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: exploit Cisco Headend System Release allows remote attackers to cause a denial of service (DHCP and TFTP outage) via a flood of crafted UDP traffic, aka Bug ID CSCus04097.
Matching passage: CVE-2015-0743. CWE: CWE-399. CVSS: 5.0. Cisco Headend System Release allows remote attackers to cause a denial of service (DHCP and TFTP outage) via a flood of crafted UDP traffic, aka Bug ID CSCus04097.
Near-miss passage: CVE-2015-5162. CWE: CWE-399. CVSS: 7.5. The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service (memory and disk consumption) via a crafted disk image.
Query: vulnerability: Directory traversal vulnerability on Huawei HG532e, HG532n, and HG532s devices allows remote attackers to read arbitrary files via a .. (dot dot) in an icon/ URI.
Matching passage: CVE-2015-7254. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability on Huawei HG532e, HG532n, and HG532s devices allows remote attackers to read arbitrary files via a .. (dot dot) in an icon/ URI.
Near-miss passage: CVE-2015-5638. CWE: CWE-22. CVSS: 4.300000190734863. Directory traversal vulnerability in H2O before 1.4.5 and 1.5.x before 1.5.0-beta2, when the file.dir directive is enabled, allows remote attackers to read arbitrary files via a crafted URL.
Query: exploit Cisco Nexus 9000 Application Centric Infrastructure (ACI) Mode switches with software before 11.0(1c) allow remote attackers to cause a denial of service (device reload) via an IPv
Matching passage: CVE-2015-6398. CWE: CWE-399. CVSS: 7.5. Cisco Nexus 9000 Application Centric Infrastructure (ACI) Mode switches with software before 11.0(1c) allow remote attackers to cause a denial of service (device reload) via an IPv4 ICMP packet with the IP Record Route option, aka Bug ID CSCuq57512.
Near-miss passage: CVE-2015-6422. CWE: CWE-399. CVSS: 4.0. The self-service application in Cisco Unified Communications Domain Manager (CUCDM) 10.6(1) allows remote authenticated users to cause a denial of service (subapplication outage) via malformed requests, aka Bug ID CSCuu10981.
Query: CVE similar to CVE-2015-5591
Matching passage: CVE-2015-5591. CWE: CWE-89. CVSS: 7.199999809265137. SQL injection vulnerability in Zenphoto before 1.4.9 allow remote administrators to execute arbitrary SQL commands.
Near-miss passage: CVE-2015-1576. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in u5CMS before 3.9.4 allow remote attackers to execute arbitrary SQL commands via the name parameter to (1) copy2.php, (2) localize.php, (3) metai.php, (4) nc.php, (5) new2.php, or (6) rename2.php in u5admin/; (7) c parameter to u5admin/editor.php; (8) typ parameter to u5admin/meta2.php; or (9) newname parameter to u5admin/rename2.php.
Query: vulnerability: The all-in-one-wp-security-and-firewall plugin before 3.9.5 for WordPress has XSS in add_query_arg and remove_query_arg function instances.
Matching passage: CVE-2015-9294. CWE: CWE-79. CVSS: 6.099999904632568. The all-in-one-wp-security-and-firewall plugin before 3.9.5 for WordPress has XSS in add_query_arg and remove_query_arg function instances.
Near-miss passage: CVE-2015-9377. CWE: CWE-79. CVSS: 6.099999904632568. iThemes Builder Theme Depot before 5.0.30 for WordPress has XSS via add_query_arg() and remove_query_arg().
Query: Sigma YAML for windows / ps_script
Matching passage: Sigma rule: Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numer. Logsource: windows / ps_script. Rule: title: Deletion of Volume Shadow Copies via WMI with PowerShell - PS Script id: c1337eb8-921a-4b59-855b-4ba188ddcc42 related: - id: e17121b4-ef2a-4418-8a59-12fb1631fa9e type: derived - id: 21ff4ca9-f13a-41ad-b828-0077b2af2e40 type: similar status: test description: Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell - https://www.elastic.co/guide/en/security/current/volume-shadow-copy-deletion-via-powershell.html author: Tim Rauch, frack113 date: 2022-09-20 modified: 2022-12-02 tags: - attack.impact - attack.t1490 logsource: category: ps_script product: windows detection: selection_get: ScriptBlockText|contains: - Get-WmiObject - gwmi - Get-CimInstance - gcim selection_shadowcopy: ScriptBlockText|contains: Win32_ShadowCopy selection_delete: ScriptBlockText|contains: - .Delete() - Remove-WmiObject - rwmi - Remove-CimInstance - rcim condition: all of selection* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects execution of inline Python code via the "-c" in order to call the "system" function from the "os" library, and s. Logsource: linux / process_creation. Rule: title: Inline Python Execution - Spawn Shell Via OS System Library id: 2d2f44ff-4611-4778-a8fc-323a0e9850cc status: test description: 'Detects execution of inline Python code via the "-c" in order to call the "system" function from the "os" library, and spawn a shell. ' references: - https://gtfobins.github.io/gtfobins/python/#shell author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) date: 2024-09-02 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: linux detection: selection_img: - Image|endswith: - /python - /python2 - /python3 - Image|contains: - /python2. - /python3. selection_cli: CommandLine|contains|all: - ' -c ' - os.system( CommandLine|contains: - /bin/bash - /bin/dash - /bin/fish - /bin/sh - /bin/zsh condition: all of selection_* falsepositives: - Unknown level: high
Query: vulnerability: Use-after-free vulnerability in Microsoft Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, and Excel Services on SharePoint Se
Matching passage: CVE-2015-2555. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in Microsoft Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, and Excel Services on SharePoint Server 2010 SP2 and 2013 SP1 allows remote attackers to execute arbitrary code via a crafted calculatedColumnFormula object in an Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-2296. CWE: UNKNOWN. CVSS: 6.800000190734863. The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.
Query: describe CVE-2015-4064
Matching passage: CVE-2015-4064. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in modules/module.ab-testing.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the post parameter in an edit delete-variation action to wp-admin/post.php.
Near-miss passage: CVE-2015-1513. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in SIPhone Enterprise PBX allows remote attackers to execute arbitrary SQL commands via the Username.
Query: write Sigma for The Fax service attempts to load ualapi.dll, which is non-existent. An attacker can then (side)load their own malicious
Matching passage: Sigma rule: The Fax service attempts to load ualapi.dll, which is non-existent. An attacker can then (side)load their own malicious. Logsource: windows / image_load. Rule: title: Fax Service DLL Search Order Hijack id: 828af599-4c53-4ed2-ba4a-a9f835c434ea status: test description: The Fax service attempts to load ualapi.dll, which is non-existent. An attacker can then (side)load their own malicious DLL using this service. references: - https://windows-internals.com/faxing-your-way-to-system/ author: NVISO date: 2020-05-04 modified: 2022-06-02 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: Image|endswith: \fxssvc.exe ImageLoaded|endswith: ualapi.dll filter: ImageLoaded|startswith: C:\Windows\WinSxS\ condition: selection and not filter falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects dropping of dll files in system32 that may be used to retrieve user credentials from LSASS. Logsource: windows / process_creation. Rule: title: Dropping Of Password Filter DLL id: b7966f4a-b333-455b-8370-8ca53c229762 status: test description: Detects dropping of dll files in system32 that may be used to retrieve user credentials from LSASS references: - https://pentestlab.blog/2020/02/10/credential-access-password-filter-dll/ - https://github.com/3gstudent/PasswordFilter/tree/master/PasswordFilter author: Sreeman date: 2020-10-29 modified: 2022-10-09 tags: - attack.persistence - attack.credential-access - attack.defense-impairment - attack.t1556.002 logsource: category: process_creation product: windows detection: selection_cmdline: CommandLine|contains|all: - HKLM\SYSTEM\CurrentControlSet\Control\Lsa - scecli\0* - reg add condition: selection_cmdline falsepositives: - Unknown level: medium
Query: Sigma rule for Detects the creation of diagcab file, which could be caused by some legitimate installer or is a sign of exploitation (r
Matching passage: Sigma rule: Detects the creation of diagcab file, which could be caused by some legitimate installer or is a sign of exploitation (r. Logsource: windows / file_event. Rule: title: Creation of a Diagcab id: 3d0ed417-3d94-4963-a562-4a92c940656a status: test description: Detects the creation of diagcab file, which could be caused by some legitimate installer or is a sign of exploitation (review the filename and its location) references: - https://threadreaderapp.com/thread/1533879688141086720.html author: frack113 date: 2022-06-08 tags: - attack.resource-development logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: .diagcab condition: selection falsepositives: - Legitimate microsoft diagcab level: medium
Near-miss passage: Sigma rule: Detects execution of php using the "-r" flag. This is could be used as a way to launch a reverse shell or execute live p. Logsource: windows / process_creation. Rule: title: Php Inline Command Execution id: d81871ef-5738-47ab-9797-7a9c90cd4bfb status: test description: Detects execution of php using the "-r" flag. This is could be used as a way to launch a reverse shell or execute live php code. references: - https://www.php.net/manual/en/features.commandline.php - https://www.revshells.com/ - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-02 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \php.exe - OriginalFileName: php.exe selection_cli: CommandLine|contains: ' -r' condition: all of selection_* falsepositives: - Unknown level: medium
Query: Sigma YAML for windows / security
Matching passage: Sigma rule: One of the Windows Eventlogs has been cleared. e.g. caused by "wevtutil cl" command execution. Logsource: windows / security. Rule: title: Security Eventlog Cleared id: d99b79d2-0a6f-4f46-ad8b-260b6e17f982 related: - id: f2f01843-e7b8-4f95-a35a-d23584476423 type: obsolete - id: a122ac13-daf8-4175-83a2-72c387be339d type: obsolete status: test description: One of the Windows Eventlogs has been cleared. e.g. caused by "wevtutil cl" command execution references: - https://twitter.com/deviouspolack/status/832535435960209408 - https://www.hybrid-analysis.com/sample/027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745?environmentId=100 - https://github.com/Azure/Azure-Sentinel/blob/f99542b94afe0ad2f19a82cc08262e7ac8e1428e/Detections/SecurityEvent/SecurityEventLogCleared.yaml author: Florian Roth (Nextron Systems) date: 2017-01-10 modified: 2022-02-24 tags: - attack.defense-impairment - attack.t1685.005 - car.2016-04-002 logsource: product: windows service: security detection: selection_517: EventID: 517 Provider_Name: Security selection_1102: EventID: 1102 Provider_Name: Microsoft-Windows-Eventlog condition: 1 of selection_* falsepositives: - Rollout of log collection agents (the setup routine often includes a reset of the local Eventlog) - System provisioning (system reset before the golden image creation) level: high
Near-miss passage: Sigma rule: Detects the image load of VSS DLL by uncommon executables. Logsource: windows / image_load. Rule: title: Potentially Suspicious Volume Shadow Copy Vsstrace.dll Load id: 48bfd177-7cf2-412b-ad77-baf923489e82 related: - id: 333cdbe8-27bb-4246-bf82-b41a0dca4b70 type: similar - id: 37774c23-25a1-4adb-bb6d-8bb9fd59c0f8 type: similar status: test description: Detects the image load of VSS DLL by uncommon executables references: - https://github.com/ORCx41/DeleteShadowCopies author: frack113 date: 2023-02-17 modified: 2025-12-03 tags: - attack.impact - attack.t1490 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \vsstrace.dll filter_main_windows: - Image: - C:\Windows\explorer.exe - C:\Windows\ImmersiveControlPanel\SystemSettings.exe - Image|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\Temp\{ - C:\Windows\WinSxS\ - C:\ProgramData\Package Cache\{ filter_main_program_files: Image|startswith: - C:\Program Files\ - C:\Program Files (x86)\ filter_optional_recovery: Image|startswith: C:\$WinREAgent\Scratch\ filter_main_null_image: Image: null filter_optional_avira: Image|contains|all: - \temp\is- - \avira_system_speedup.tmp condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Query: incident response steps for Suspicious Template Injection execution detected on endpoint
Matching passage: Playbook for T1221 Template Injection. 1) Validate alert telemetry against T1221. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may create or modify references in user document templates to conceal malicious code or force authentication attempts. For example, Microsoft’s Office Open XML (OOXML) specification defines an XML-based format for Office documents (.docx, xlsx, .pptx) to replace older binary formats (.doc, .xls, .ppt). OOXML files are packed together ZIP archives compromised of various XML files, refer
Near-miss passage: Playbook for T1149 LC_MAIN Hijacking. Different response path focused on stealth.
Query: explain CWE-1122
Matching passage: CWE-1122 Excessive Halstead Complexity. The code is structured in a way that a Halstead complexity measure exceeds a desirable maximum.
Near-miss passage: CWE-1279 Cryptographic Operations are run Before Supporting Units are Ready. Performing cryptographic operations without ensuring that the supporting inputs are ready to supply valid data may compromise the cryptographic result.
Query: Sigma rule for Detects Windows Pcap driver installation based on a list of associated .sys files.
Matching passage: Sigma rule: Detects Windows Pcap driver installation based on a list of associated .sys files.. Logsource: windows / security. Rule: title: Windows Pcap Drivers id: 7b687634-ab20-11ea-bb37-0242ac130002 status: test description: Detects Windows Pcap driver installation based on a list of associated .sys files. references: - https://ragged-lab.blogspot.com/2020/06/capturing-pcap-driver-installations.html#more author: Cian Heasley date: 2020-06-10 modified: 2023-04-14 tags: - attack.discovery - attack.credential-access - attack.t1040 logsource: product: windows service: security definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697 detection: selection: EventID: 4697 ServiceFileName|contains: - pcap - npcap - npf - nm3 - ndiscap - nmnt - windivert - USBPcap - pktmon condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects when a new admin is created.. Logsource: azure / auditlogs. Rule: title: Privileged Account Creation id: f7b5b004-dece-46e4-a4a5-f6fd0e1c6947 status: test description: Detects when a new admin is created. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#changes-to-privileged-accounts author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Tim Shelton date: 2022-08-11 modified: 2022-08-16 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation - attack.stealth - attack.t1078.004 logsource: product: azure service: auditlogs detection: selection: properties.message|contains|all: - Add user - Add member to role Status: Success condition: selection falsepositives: - A legitimate new admin account being created level: medium
Query: rule covering Detects execution of "curl.exe" with the "--insecure" flag.
Matching passage: Sigma rule: Detects execution of "curl.exe" with the "--insecure" flag.. Logsource: windows / process_creation. Rule: title: Insecure Transfer Via Curl.EXE id: cb9cc1d1-e84e-4bdc-b7ad-c31b1b7908ec status: test description: Detects execution of "curl.exe" with the "--insecure" flag. references: - https://curl.se/docs/manpage.html author: X__Junior (Nextron Systems) date: 2023-06-30 tags: - attack.execution logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \curl.exe - OriginalFileName: curl.exe selection_cli: - CommandLine|re: \s-k\s - CommandLine|contains: --insecure condition: all of selection_* falsepositives: - Access to badly maintained internal or development systems level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_insecure_connection/info.yml
Near-miss passage: Sigma rule: Detects tampering with the "ChannelAccess" registry key in order to change access to Windows event channel.. Logsource: windows / registry_set. Rule: title: Change Winevt Channel Access Permission Via Registry id: 7d9263bd-dc47-4a58-bc92-5474abab390c status: test description: Detects tampering with the "ChannelAccess" registry key in order to change access to Windows event channel. references: - https://app.any.run/tasks/77b2e328-8f36-46b2-b2e2-8a80398217ab/ - https://learn.microsoft.com/en-us/windows/win32/api/winevt/ - https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/ author: frack113 date: 2022-09-17 modified: 2024-03-25 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Microsoft\Windows\CurrentVersion\WINEVT\Channels\ TargetObject|endswith: \ChannelAccess Details|contains: - (A;;0x1;;;LA) - (A;;0x1;;;SY) - (A;;0x5;;;BA) filter_main_trustedinstaller: Image: C:\Windows\servicing\TrustedInstaller.exe filter_main_tiworker: Image|startswith: C:\Windows\WinSxS\ Image|endswith: \TiWorker.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: secure coding against Inaccurate Source Code Comments
Matching passage: CWE-1116 Inaccurate Source Code Comments. The source code contains comments that do not accurately describe or explain aspects of the portion of the code with which the comment is associated.
Near-miss passage: CWE-363 Race Condition Enabling Link Following. The product checks the status of a file or directory before accessing it, which produces a race condition in which the file can be replaced with a link before the access is performed, causing the product to access the wrong file.