alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: CVE similar to CVE-2015-4302
Matching passage: CVE-2015-4302. CWE: CWE-284. CVSS: 6.400000095367432. The web interface in Cisco FireSIGHT Management Center 5.3.1.4 allows remote attackers to delete arbitrary system policies via modified parameters in a POST request, aka Bug ID CSCuu25390.
Near-miss passage: CVE-2015-0820. CWE: CWE-284. CVSS: 2.5999999046325684. Mozilla Firefox before 36.0 does not properly restrict transitions of JavaScript objects from a non-extensible state to an extensible state, which allows remote attackers to bypass a Caja Compiler sandbox protection mechanism or a Secure EcmaScript sandbox protection mechanism via a crafted web site.
Query: Sigma rule for Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation
Matching passage: Sigma rule: Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation. Logsource: windows / process_creation. Rule: title: Powershell Token Obfuscation - Process Creation id: deb9b646-a508-44ee-b7c9-d8965921c6b6 related: - id: f3a98ce4-6164-4dd4-867c-4d83de7eca51 type: similar status: test description: Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation references: - https://github.com/danielbohannon/Invoke-Obfuscation author: frack113 date: 2022-12-27 modified: 2026-03-16 tags: - attack.stealth - attack.t1027.009 logsource: category: process_creation product: windows detection: selection: - CommandLine|re: \w+`(?:\w+|-|.)`[\w+|\s] - CommandLine|re: '"(?:\{\d\})+"\s*-f' - CommandLine|re: (?i)\$\{`?e`?n`?v`?:`?p`?a`?t`?h`?\} filter_main_envpath: CommandLine|contains: ${env:path} condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Indicates anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in th. Logsource: azure / riskdetection. Rule: title: Suspicious Browser Activity id: 944f6adb-7a99-4c69-80c1-b712579e93e6 status: test description: Indicates anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#suspicious-browser - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-03 tags: - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation - attack.initial-access logsource: product: azure service: riskdetection detection: selection: riskEventType: suspiciousBrowser condition: selection falsepositives: - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user. level: high
Query: risk of SQL injection vulnerability in DLGuard 4.5 allows remote attackers to execute arbitrary SQL commands via the c parameter to index.php.
Matching passage: CVE-2015-2066. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in DLGuard 4.5 allows remote attackers to execute arbitrary SQL commands via the c parameter to index.php.
Near-miss passage: CVE-2015-9325. CWE: CWE-89. CVSS: 9.800000190734863. The visitors-online plugin before 0.4 for WordPress has SQL injection.
Query: Outbound C2 pattern associated with Cloud Secrets Management Stores
Matching passage: T1555.006 Cloud Secrets Management Stores. Tactics: credential access. Description: Adversaries may acquire credentials from cloud-native secret management solutions such as AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, and Terraform Vault. Secrets managers support the secure centralized management of passwords, API keys, and other credential material. Where secrets managers are in use, cloud services can dynamically acquire credentials via API requests rather than accessing secrets insecurely stored in plain text files or environment variables. If an adversary is able to gain sufficient privileges in a cloud environment – for example, by obtaining the credentials of high-privileged [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004) or compromising a service that has permission to retrieve secrets – they may be able to request secrets from the secrets manager. This can be accomplished via commands such as `get-secret-value` in AWS, `gcloud secrets describe` in GCP, and `az key vault secret show` in Azure.(Citation: Permiso Scattered Spider 2023)(Citation: Sysdig ScarletEel 2.0 2023)(Citation: AWS Secrets Manager)(Citation: Google Cloud Secrets)(Citation: Microsoft Azure Key Vault) **Note:** this technique is distinct from [Cloud Instance Metadata API](https://attack.mitre.org/techniques/T1552/005) in that the credentials are being directly requested from the cloud secrets manager, rather than through the medium of the instance metadata API.
Near-miss passage: T1555.002 Securityd Memory. Tactics: credential access. Description: An adversary with root access may gather credentials by reading `securityd`’s memory. `securityd` is a service/daemon responsible for implementing security protocols such as encryption and authorization.(Citation: Apple Dev SecurityD) A privileged adversary may be able to scan through `securityd`'s memory to find the correct sequence of keys to decrypt the user’s logon keychain. This may provide the adversary with various plaintext passwords, such as those for users, WiFi, mail, browsers, certificates, secure notes, etc.(Citation: OS X Keychain)(Citation: OSX Keydnap malware) In OS X prior to El Capitan, users with root access can read plaintext keychain passwords of logged-in users because Apple’s keychain implementation allows these credentials to be cached so that users are not repeatedly prompted for passwords.(Citation: OS X Keychain)(Citation: External to DA, the OS X Way) Apple’s `securityd` utility takes the user’s logon password, encrypts it with PBKDF2, and stores this master key in memory. Apple also uses a set of keys and algorithms to encrypt the user’s password, but once the master key is found, an adversary need only iterate over the other values to unlock the final password.(Citation: OS X Keychain)
Query: alert when Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.
Matching passage: Sigma rule: Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.. Logsource: windows / applocker. Rule: title: AppLocker Prevented Application or Script from Running id: 401e5d00-b944-11ea-8f9a-00163ecd60ae status: test description: 'Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running. ' references: - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker - https://nxlog.co/documentation/nxlog-user-guide/applocker.html author: Pushkarev Dmitry date: 2020-06-28 modified: 2025-12-03 tags: - attack.execution - attack.t1204.002 - attack.t1059.001 - attack.t1059.003 - attack.t1059.005 - attack.t1059.006 - attack.t1059.007 logsource: product: windows service: applocker detection: selection: EventID: - 8004 - 8007 - 8022 - 8025 condition: selection falsepositives: - Unlikely, since this event notifies about blocked application execution. Tune your applocker rules to avoid blocking legitimate applications. level: medium
Near-miss passage: Sigma rule: Detects execution of Netcat. Adversaries may use a non-application layer protocol for communication between host and C2. Logsource: windows / process_creation. Rule: title: PUA - Netcat Suspicious Execution id: e31033fc-33f0-4020-9a16-faf9b31cbf08 status: test description: Detects execution of Netcat. Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network references: - https://nmap.org/ncat/ - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1095/T1095.md - https://www.revshells.com/ author: frack113, Florian Roth (Nextron Systems) date: 2021-07-21 modified: 2023-02-08 tags: - attack.command-and-control - attack.t1095 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: - \nc.exe - \ncat.exe - \netcat.exe selection_cmdline: CommandLine|contains: - ' -lvp ' - ' -lvnp' - ' -l -v -p ' - ' -lv -p ' - ' -l --proxy-type http ' - ' -vnl --exec ' - ' -vnl -e ' - ' --lua-exec ' - ' --sh-exec ' condition: 1 of selection_* falsepositives: - Legitimate ncat use level: high
Query: explain CWE-353
Matching passage: CWE-353 Missing Support for Integrity Check. The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.
Near-miss passage: CWE-319 Cleartext Transmission of Sensitive Information. The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
Query: exploit SysAid Help Desk before 15.2 allows remote attackers to obtain sensitive information via an invalid value in the accountid parameter to getAgentLogFile, as demonstrated by a large 
Matching passage: CVE-2015-2997. CWE: CWE-200. CVSS: 5.0. SysAid Help Desk before 15.2 allows remote attackers to obtain sensitive information via an invalid value in the accountid parameter to getAgentLogFile, as demonstrated by a large directory traversal sequence, which reveals the installation path in an error message.
Near-miss passage: CVE-2015-5382. CWE: CWE-200. CVSS: 6.5. program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the _alt parameter when uploading a vCard.
Query: risk of SQL injection vulnerability in Accentis Content Resource Management System before the October 2015 patch allows remote attackers to execute arbitrary SQL commands via the SIDX para
Matching passage: CVE-2015-3424. CWE: CWE-89. CVSS: 8.800000190734863. SQL injection vulnerability in Accentis Content Resource Management System before the October 2015 patch allows remote attackers to execute arbitrary SQL commands via the SIDX parameter.
Near-miss passage: CVE-2015-10050. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability was found in brandonfire miRNA_Database_by_PHP_MySql. It has been declared as critical. This vulnerability affects the function __construct/select_single_rna/count_rna of the file inc/model.php. The manipulation leads to sql injection. The patch is identified as 307c5d510841e6142ddcbbdbb93d0e8a0dc3fd6a. It is recommended to apply a patch to fix this issue. VDB-218374 is the identifier assigned to this vulnerability.
Query: alert when Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename
Matching passage: Sigma rule: Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename. Logsource: windows / process_creation. Rule: title: PUA - Potential PE Metadata Tamper Using Rcedit id: 0c92f2e6-f08f-4b73-9216-ecb0ca634689 status: test description: Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion. references: - https://security.stackexchange.com/questions/210843/is-it-possible-to-change-original-filename-of-an-exe - https://www.virustotal.com/gui/file/02e8e8c5d430d8b768980f517b62d7792d690982b9ba0f7e04163cbc1a6e7915 - https://github.com/electron/rcedit author: Micah Babinski date: 2022-12-11 modified: 2023-03-05 tags: - attack.stealth - attack.t1036.003 - attack.t1036 - attack.t1027.005 - attack.t1027 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \rcedit-x64.exe - \rcedit-x86.exe - Description: Edit resources of exe - Product: rcedit selection_flags: CommandLine|contains: --set- selection_attributes: CommandLine|contains: - OriginalFileName - CompanyName - FileDescription - ProductName - ProductVersion - LegalCopyright condition: all of selection_* falsepositives: - Legitimate use of the tool by administrators or users to update metadata of a binary level: medium
Near-miss passage: Sigma rule: Detects the use of NirCmd tool for command execution as SYSTEM user. Logsource: windows / process_creation. Rule: title: PUA - NirCmd Execution As LOCAL SYSTEM id: d9047477-0359-48c9-b8c7-792cedcdc9c4 status: test description: Detects the use of NirCmd tool for command execution as SYSTEM user references: - https://www.nirsoft.net/utils/nircmd.html - https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/ - https://www.nirsoft.net/utils/nircmd2.html#using author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-01-24 modified: 2023-02-13 tags: - attack.execution - attack.t1569.002 - attack.s0029 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: ' runassystem ' condition: selection falsepositives: - Legitimate use by administrators level: high
Query: describe CVE-2015-7030
Matching passage: CVE-2015-7030. CWE: CWE-17. CVSS: 7.5. The Swift implementation in Apple Xcode before 7.1 mishandles type conversion, which has unspecified impact and attack vectors.
Near-miss passage: CVE-2015-1157. CWE: CWE-17. CVSS: 7.800000190734863. CoreText in Apple iOS 8.x through 8.3 allows remote attackers to cause a denial of service (reboot and messaging disruption) via crafted Unicode text that is not properly handled during display truncation in the Notifications feature, as demonstrated by Arabic characters in (1) an SMS message or (2) a WhatsApp message.
Query: patch priority for CVE-2015-8888
Matching passage: CVE-2015-8888. CWE: CWE-189. CVSS: 7.800000190734863. Integer overflow in app/aboot/aboot.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5 devices allows attackers to bypass intended access restrictions via a crafted block count and block size of a sparse header, aka Android internal bug 28822465 and Qualcomm internal bug CR813933.
Near-miss passage: CVE-2015-4491. CWE: CWE-189. CVSS: 6.800000190734863. Integer overflow in the make_filter_table function in pixops/pixops.c in gdk-pixbuf before 2.31.5, as used in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Linux, Google Chrome on Linux, and other products, allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow and application crash) via crafted bitmap dimensions that are mishandled during scaling.
Query: detect Detects changes to the AppInstaller (winget) policy. Specifically the activation of the local manifest installation, whi in logs
Matching passage: Sigma rule: Detects changes to the AppInstaller (winget) policy. Specifically the activation of the local manifest installation, whi. Logsource: windows / registry_set. Rule: title: Enable Local Manifest Installation With Winget id: fa277e82-9b78-42dd-b05c-05555c7b6015 status: test description: Detects changes to the AppInstaller (winget) policy. Specifically the activation of the local manifest installation, which allows a user to install new packages via custom manifests. references: - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-17 modified: 2023-08-17 tags: - attack.persistence - attack.stealth logsource: product: windows category: registry_set detection: selection: TargetObject|endswith: \AppInstaller\EnableLocalManifestFiles Details: DWORD (0x00000001) condition: selection falsepositives: - Administrators or developers might enable this for testing purposes or to install custom private packages level: medium
Near-miss passage: Sigma rule: Detects unauthorized access attempts to a resource.. Logsource: bitbucket / audit. Rule: title: Bitbucket Unauthorized Access To A Resource id: 7215374a-de4f-4b33-8ba5-70804c9251d3 status: test description: Detects unauthorized access attempts to a resource. references: - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html author: Muhammad Faisal (@faisalusuf) date: 2024-02-25 tags: - attack.resource-development - attack.t1586 logsource: product: bitbucket service: audit definition: 'Requirements: "Advance" log level is required to receive these audit events.' detection: selection: auditType.category: Security auditType.action: Unauthorized access to a resource condition: selection falsepositives: - Access attempts to non-existent repositories or due to outdated plugins. Usually "Anonymous" user is reported in the "author.name" field in most cases. level: critical
Query: describe CVE-2015-6313
Matching passage: CVE-2015-6313. CWE: CWE-399. CVSS: 7.5. Cisco TelePresence Server 4.1(2.29) through 4.2(4.17) on 7010; Mobility Services Engine (MSE) 8710; Multiparty Media 310, 320, and 820; and Virtual Machine (VM) devices allows remote attackers to cause a denial of service (memory consumption or device reload) via crafted HTTP requests that are not followed by an unspecified negotiation, aka Bug ID CSCuv47565.
Near-miss passage: CVE-2015-2170. CWE: CWE-399. CVSS: 5.0. The upx decoder in ClamAV before 0.98.7 allows remote attackers to cause a denial of service (crash) via a crafted file.
Query: describe CVE-2015-0918
Matching passage: CVE-2015-0918. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the administrative backend in Sefrengo before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the searchterm parameter to backend/main.php.
Near-miss passage: CVE-2015-10101. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability classified as problematic was found in Google Analytics Top Content Widget Plugin up to 1.5.6 on WordPress. Affected by this vulnerability is an unknown functionality of the file class-tgm-plugin-activation.php. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.5.7 is able to address this issue. The identifier of the patch is 25bb1dea113716200a6f0f3135801d84a7a65540. It is recommended to upgrade the affected component. The identifier VDB-226117 was assigned to this vulnerability.
Query: vulnerability: Open redirect vulnerability in Joomla! CMS 3.0.0 through 3.4.1.
Matching passage: CVE-2015-5608. CWE: CWE-601. CVSS: 6.099999904632568. Open redirect vulnerability in Joomla! CMS 3.0.0 through 3.4.1.
Near-miss passage: CVE-2015-0697. CWE: CWE-601. CVSS: 5.800000190734863. Open redirect vulnerability in the login page in Cisco TC Software before 6.3-26 and 7.x before 7.3.0 on Cisco TelePresence Collaboration Desk and Room Endpoints devices allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, aka Bug ID CSCuq94980.
Query: write Sigma for Detects the removal of folders from the "ProtectedFolders" list of of exploit guard. This could indicate an attacker try
Matching passage: Sigma rule: Detects the removal of folders from the "ProtectedFolders" list of of exploit guard. This could indicate an attacker try. Logsource: windows / registry_delete. Rule: title: Folder Removed From Exploit Guard ProtectedFolders List - Registry id: 272e55a4-9e6b-4211-acb6-78f51f0b1b40 status: test description: Detects the removal of folders from the "ProtectedFolders" list of of exploit guard. This could indicate an attacker trying to launch an encryption process or trying to manipulate data inside of the protected folder references: - https://www.microsoft.com/security/blog/2017/10/23/windows-defender-exploit-guard-reduce-the-attack-surface-against-next-generation-malware/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-05 modified: 2023-02-08 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_delete product: windows detection: selection: EventType: DeleteValue TargetObject|contains: SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\ProtectedFolders condition: selection falsepositives: - Legitimate administrators removing applications (should always be investigated) level: high
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via COMPRESS OBFUSCATION. Logsource: windows / system. Rule: title: Invoke-Obfuscation COMPRESS OBFUSCATION - System id: 175997c5-803c-4b08-8bb0-70b099f47595 status: test description: Detects Obfuscated Powershell via COMPRESS OBFUSCATION references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Timur Zinniatullin, oscd.community date: 2020-10-18 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ImagePath|contains|all: - new-object - text.encoding]::ascii - readtoend ImagePath|contains: - :system.io.compression.deflatestream - system.io.streamreader condition: selection falsepositives: - Unknown level: medium
Query: Sigma rule for Detects the volume shadow copy service initialization and processing via esentutl. Registry keys such as HKLM\\System\\C
Matching passage: Sigma rule: Detects the volume shadow copy service initialization and processing via esentutl. Registry keys such as HKLM\\System\\C. Logsource: windows / registry_event. Rule: title: Esentutl Volume Shadow Copy Service Keys id: 5aad0995-46ab-41bd-a9ff-724f41114971 status: test description: Detects the volume shadow copy service initialization and processing via esentutl. Registry keys such as HKLM\\System\\CurrentControlSet\\Services\\VSS\\Diag\\VolSnap\\Volume are captured. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md#atomic-test-3---esentutlexe-sam-copy author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-10-20 modified: 2022-12-25 tags: - attack.credential-access - attack.t1003.002 logsource: category: registry_event product: windows detection: selection: TargetObject|contains: System\CurrentControlSet\Services\VSS Image|endswith: esentutl.exe filter: TargetObject|contains: System\CurrentControlSet\Services\VSS\Start condition: selection and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects potentially suspicious file downloads directly from IP addresses using Wget.exe. Logsource: windows / process_creation. Rule: title: Suspicious File Download From IP Via Wget.EXE id: 17f0c0a8-8bd5-4ee0-8c5f-a342c0199f35 status: test description: Detects potentially suspicious file downloads directly from IP addresses using Wget.exe references: - https://www.gnu.org/software/wget/manual/wget.html author: Nasreddine Bencherchali (Nextron Systems) date: 2023-07-27 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \wget.exe - OriginalFileName: wget.exe selection_ip: CommandLine|re: ://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3} selection_http: CommandLine|contains: http selection_flag: - CommandLine|re: \s-O\s - CommandLine|contains: --output-document selection_ext: CommandLine|endswith: - .ps1 - .ps1' - .ps1" - .dat - .dat' - .dat" - .msi - .msi' - .msi" - .bat - .bat' - .bat" - .exe - .exe' - .exe" - .vbs - .vbs' - .vbs" - .vbe - .vbe' - .vbe" - .hta - .hta' - .hta" - .dll - .dll' - .dll" - .psm1 - .psm1' - .psm1" condition: all of selection_* falsepositives: - Unknown level: high