alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-1792
Matching passage: CVE-2015-1792. CWE: CWE-399. CVSS: 5.0. The do_free_upto function in crypto/cms/cms_smime.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (infinite loop) via vectors that trigger a NULL value of a BIO data structure, as demonstrated by an unrecognized X.660 OID for a hash function.
Near-miss passage: CVE-2015-6332. CWE: CWE-399. CVSS: 5.0. Cisco Prime Infrastructure 2.2 allows remote attackers to cause a denial of service (daemon hang) by sending many SSL renegotiation requests, aka Bug ID CSCuv56830.
Query: Sigma rule for Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exf
Matching passage: Sigma rule: Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exf. Logsource: linux / network_connection. Rule: title: Communication To Ngrok Tunneling Service - Linux id: 19bf6fdb-7721-4f3d-867f-53467f6a5db6 status: test description: Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors references: - https://twitter.com/hakluke/status/1587733971814977537/photo/1 - https://ngrok.com/docs/secure-tunnels/tunnels/ssh-reverse-tunnel-agent author: Florian Roth (Nextron Systems) date: 2022-11-03 tags: - attack.exfiltration - attack.command-and-control - attack.t1567 - attack.t1568.002 - attack.t1572 - attack.t1090 - attack.t1102 - attack.s0508 logsource: product: linux category: network_connection detection: selection: DestinationHostname|contains: - tunnel.us.ngrok.com - tunnel.eu.ngrok.com - tunnel.ap.ngrok.com - tunnel.au.ngrok.com - tunnel.sa.ngrok.com - tunnel.jp.ngrok.com - tunnel.in.ngrok.com condition: selection falsepositives: - Legitimate use of ngrok level: high
Near-miss passage: Sigma rule: Detects the execution of "sysctl" with specific arguments that have been used by threat actors and malware. It provides. Logsource: macos / process_creation. Rule: title: System Information Discovery Via Sysctl - MacOS id: 6ff08e55-ea53-4f27-94a1-eff92e6d9d5c status: test description: 'Detects the execution of "sysctl" with specific arguments that have been used by threat actors and malware. It provides system hardware information. This process is primarily used to detect and avoid virtualization and analysis environments. ' references: - https://www.loobins.io/binaries/sysctl/# - https://evasions.checkpoint.com/techniques/macos.html - https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/ - https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/ - https://objective-see.org/blog/blog_0x1E.html - https://www.virustotal.com/gui/file/1c547a064494a35d6b5e6b459de183ab2720a22725e082bed6f6629211f7abc1/behavior - https://www.virustotal.com/gui/file/b4b1fc65f87b3dcfa35e2dbe8e0a34ad9d8a400bec332025c0a2e200671038aa/behavior author: Pratinav Chandra date: 2024-05-27 tags: - attack.stealth - attack.t1497.001 - attack.discovery - attack.t1082 logsource: product: macos category: process_creation detection: selection_img: - Image|endswith: /sysctl - CommandLine|contains: sysctl selection_cmd: CommandLine|contains: - hw. - kern. - machdep. condition: all of selection_* falsepositives: - Legitimate administrative activities level: medium
Query: detect Detects potential commandline obfuscation using unicode characters. Adversaries may attempt to make an executable or fil in logs
Matching passage: Sigma rule: Detects potential commandline obfuscation using unicode characters. Adversaries may attempt to make an executable or fil. Logsource: windows / process_creation. Rule: title: Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image id: 584bca0f-3608-4402-80fd-4075ff6072e3 related: - id: e0552b19-5a83-4222-b141-b36184bb8d79 type: similar - id: ad691d92-15f2-4181-9aa4-723c74f9ddc3 type: similar - id: 2c0d2d7b-30d6-4d14-9751-7b9113042ab9 type: obsolete status: test description: 'Detects potential commandline obfuscation using unicode characters. Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. ' references: - https://www.wietzebeukema.nl/blog/windows-command-line-obfuscation - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027/T1027.md#atomic-test-6---dlp-evasion-via-sensitive-data-in-vba-macro-over-http author: frack113, Florian Roth (Nextron Systems), Josh Nickels date: 2024-09-02 modified: 2025-05-30 tags: - attack.stealth - attack.t1027 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: - \cmd.exe - \cscript.exe - \powershell.exe - \powershell_ise.exe - \pwsh.exe - \wscript.exe OriginalFileName: - Cmd.EXE - cscript.exe - PowerShell.EXE - PowerShell_ISE.EXE - pwsh.dll - wscript.exe selection_special_chars: CommandLine|contains: - ˣ - ˪ - ˢ - ∕ - ⁄ - ― - — - - ¯ - ® - ¶ - ⠀ condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects block events for files that are disallowed by code integrity for protected processes. Logsource: windows / codeintegrity-operational. Rule: title: CodeIntegrity - Disallowed File For Protected Processes Has Been Blocked id: 5daf11c3-022b-4969-adb9-365e6c078c7c status: test description: Detects block events for files that are disallowed by code integrity for protected processes references: - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-06 tags: - attack.privilege-escalation logsource: product: windows service: codeintegrity-operational detection: selection: EventID: 3104 condition: selection falsepositives: - Unlikely level: high
Query: patch priority for CVE-2015-1498
Matching passage: CVE-2015-1498. CWE: CWE-264. CVSS: 10.0. Persistent Systems Radia Client Automation does not properly restrict access to certain request, which allows remote attackers to (1) enumerate user accounts via a getUsers request, (2) assign a role to a user account via an addAssigneesToRole request, (3) remove a role from a user account via a removeAssigneesFromRole request, or (4) have other unspecified impact.
Near-miss passage: CVE-2015-7496. CWE: CWE-264. CVSS: 7.199999809265137. GNOME Display Manager (gdm) before 3.18.2 allows physically proximate attackers to bypass the lock screen by holding the Escape key.
Query: EDR alert: possible DNS/Passive DNS (T1596.001)
Matching passage: T1596.001 DNS/Passive DNS. Tactics: reconnaissance. Description: Adversaries may search DNS data for information about victims that can be used during targeting. DNS information may include a variety of details, including registered name servers as well as records that outline addressing for a target’s subdomains, mail servers, and other hosts. Adversaries may search DNS data to gather actionable information. Threat actors can query nameservers for a target organization directly, or search through centralized repositories of logged DNS query responses (known as passive DNS).(Citation: DNS Dumpster)(Citation: Circl Passive DNS) Adversaries may also seek and target DNS misconfigurations/leaks that reveal information about internal networks. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
Near-miss passage: T1596 Search Open Technical Databases. Tactics: reconnaissance. Description: Adversaries may search freely available technical databases for information about victims that can be used during targeting. Information about victims may be available in online databases and repositories, such as registrations of domains/certificates as well as public collections of network data/artifacts gathered from traffic and/or scans.(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: Circl Passive DNS)(Citation: Medium SSL Cert)(Citation: SSLShopper Lookup)(Citation: DigitalShadows CDN)(Citation: Shodan) Adversaries may search in different open databases depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
Query: threat report mentioning Search Victim-Owned Websites
Matching passage: T1594 Search Victim-Owned Websites. Tactics: reconnaissance. Description: Adversaries may search websites owned by the victim for information that can be used during targeting. Victim-owned websites may contain a variety of details, including names of departments/divisions, physical locations, and data about key employees such as names, roles, and contact info (ex: [Email Addresses](https://attack.mitre.org/techniques/T1589/002)). These sites may also have details highlighting business operations and relationships.(Citation: Comparitech Leak) Adversaries may search victim-owned websites to gather actionable information. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Trusted Relationship](https://attack.mitre.org/techniques/T1199) or [Phishing](https://attack.mitre.org/techniques/T1566)). In addition to manually browsing the website, adversaries may attempt to identify hidden directories or files that could contain additional sensitive information or vulnerable functionality. They may do this through automated activities such as [Wordlist Scanning](https://attack.mitre.org/techniques/T1595/003), as well as by leveraging files such as sitemap.xml and robots.txt.(Citation: Perez Sitemap XML 2023)(Citation: Register Robots TXT 2015)
Near-miss passage: T1596.001 DNS/Passive DNS. Tactics: reconnaissance. Description: Adversaries may search DNS data for information about victims that can be used during targeting. DNS information may include a variety of details, including registered name servers as well as records that outline addressing for a target’s subdomains, mail servers, and other hosts. Adversaries may search DNS data to gather actionable information. Threat actors can query nameservers for a target organization directly, or search through centralized repositories of logged DNS query responses (known as passive DNS).(Citation: DNS Dumpster)(Citation: Circl Passive DNS) Adversaries may also seek and target DNS misconfigurations/leaks that reveal information about internal networks. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
Query: rule covering Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent. RMM tools suc
Matching passage: Sigma rule: Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent. RMM tools suc. Logsource: macos / process_creation. Rule: title: Remote Access Tool - Renamed MeshAgent Execution - MacOS id: bd3b5eaa-439d-4a42-8f35-a49f5c8a2582 related: - id: b471f462-eb0d-4832-be35-28d94bdb4780 type: similar - id: 22c45af6-f590-4d44-bab3-b5b2d2a2b6d9 type: derived status: experimental description: 'Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent. RMM tools such as MeshAgent are commonly utilized by IT administrators for legitimate remote support and system management. However, malicious actors may exploit these tools by renaming them to bypass detection mechanisms, enabling unauthorized access and control over compromised systems. ' references: - https://www.huntress.com/blog/know-thy-enemy-a-novel-november-case-on-persistent-remote-access - https://thecyberexpress.com/ukraine-hit-by-meshagent-malware-campaign/ - https://wazuh.com/blog/how-to-detect-meshagent-with-wazuh/ - https://www.security.com/threat-intelligence/medusa-ransomware-attacks author: Norbert Jaśniewicz (AlphaSOC) date: 2025-05-19 tags: - attack.command-and-control - attack.stealth - attack.t1219.002 - attack.t1036.003 logsource: category: process_creation product: macos detection: selection_meshagent: - CommandLine|contains: --meshServiceName - OriginalFileName|contains: meshagent filter_main_legitimate: Image|endswith: - /meshagent - /meshagent_osx64 condition: selection_meshagent and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects DNS queries for subdomains related to "Put.io" sharing website.. Logsource: windows / dns-client. Rule: title: DNS Query To Put.io - DNS Client id: 8b69fd42-9dad-4674-abef-7fdef43ef92a status: test description: Detects DNS queries for subdomains related to "Put.io" sharing website. references: - https://darkatlas.io/blog/medusa-ransomware-group-opsec-failure author: Omar Khaled (@beacon_exe) date: 2024-08-23 tags: - attack.command-and-control logsource: product: windows service: dns-client definition: 'Requirements: Microsoft-Windows-DNS Client Events/Operational Event Log must be enabled/collected in order to receive the events.' detection: selection: EventID: 3008 QueryName|contains: - api.put.io - upload.put.io condition: selection falsepositives: - Legitimate DNS queries and usage of Put.io level: medium
Query: CVE similar to CVE-2015-3119
Matching passage: CVE-2015-3119. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-3120, CVE-2015-3121, CVE-2015-3122, and CVE-2015-4433.
Near-miss passage: CVE-2015-8049. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in the TextField object implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via a crafted autoSize property value, a different vulnerability than CVE-2015-8048, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: CVE similar to CVE-2015-2379
Matching passage: CVE-2015-2379. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-4060. CWE: CWE-119. CVSS: 10.0. Heap-based buffer overflow in the TermProxy (WLTermProxyService.exe) service in Wavelink ConnectPro allows remote attackers to execute arbitrary code via a large HTTP header.
Query: risk of Coppermine Photo Gallery before 1.5.36 allows remote attackers to enumerate directories via a full path in the folder parameter to minibrowser.php.
Matching passage: CVE-2015-3923. CWE: CWE-200. CVSS: 5.0. Coppermine Photo Gallery before 1.5.36 allows remote attackers to enumerate directories via a full path in the folder parameter to minibrowser.php.
Near-miss passage: CVE-2015-4682. CWE: CWE-200. CVSS: 6.5. Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows remote authenticated users to obtain the installation path via an HTTP POST request to PlcmRmWeb/JConfigManager.
Query: vulnerability: The PFE daemon in Juniper vSRX virtual firewalls with Junos OS before 15.1X49-D20 allows remote attackers to cause a denial of service via an unspecified connection request to the 
Matching passage: CVE-2015-7749. CWE: CWE-20. CVSS: 7.800000190734863. The PFE daemon in Juniper vSRX virtual firewalls with Junos OS before 15.1X49-D20 allows remote attackers to cause a denial of service via an unspecified connection request to the "host-OS."
Near-miss passage: CVE-2015-3876. CWE: CWE-20. CVSS: 9.300000190734863. libstagefright in Android through 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted metadata in a (1) MP3 or (2) MP4 file.
Query: alert when Detects specific techniques often seen used inside of PowerShell scripts to obfscuate Alias creation
Matching passage: Sigma rule: Detects specific techniques often seen used inside of PowerShell scripts to obfscuate Alias creation. Logsource: windows / ps_script. Rule: title: Potential PowerShell Obfuscation Using Character Join id: e8314f79-564d-4f79-bc13-fbc0bf2660d8 related: - id: 96cd126d-f970-49c4-848a-da3a09f55c55 type: derived status: test description: Detects specific techniques often seen used inside of PowerShell scripts to obfscuate Alias creation references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-09 tags: - attack.execution - attack.stealth - attack.t1027 - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - -Alias - ' -Value (-join(' condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects the execution of the BitLocker Access Agent Update Utility (baaupdate.exe) which is not a common parent process. Logsource: windows / process_creation. Rule: title: Suspicious BitLocker Access Agent Update Utility Execution id: 9f38c1db-e2ae-40bf-81d0-5b68f73fb512 related: - id: 6e8fe0a8-ba0b-4a93-8f9e-82657e7a5984 type: similar status: experimental description: 'Detects the execution of the BitLocker Access Agent Update Utility (baaupdate.exe) which is not a common parent process for other processes. Suspicious child processes spawned by baaupdate.exe could indicate an attempt at lateral movement via BitLocker DCOM & COM Hijacking. ' references: - https://github.com/rtecCyberSec/BitlockMove author: andrewdanis, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-10-18 tags: - attack.stealth - attack.t1218 - attack.lateral-movement - attack.t1021.003 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \baaupdate.exe Image|endswith: - \bitsadmin.exe - \cmd.exe - \cscript.exe - \mshta.exe - \powershell_ise.exe - \powershell.exe - \regsvr32.exe - \rundll32.exe - \schtasks.exe - \wmic.exe - \wscript.exe condition: selection falsepositives: - Unknown level: high
Query: risk of Multiple SQL injection vulnerabilities in SysAid Help Desk before 15.2 allow remote administrators to execute arbitrary SQL commands via the (1) groupFilter parameter in an AssetDe
Matching passage: CVE-2015-2999. CWE: CWE-89. CVSS: 6.5. Multiple SQL injection vulnerabilities in SysAid Help Desk before 15.2 allow remote administrators to execute arbitrary SQL commands via the (1) groupFilter parameter in an AssetDetails report to /genericreport, customSQL parameter in a (2) TopAdministratorsByAverageTimer report or an (3) ActiveRequests report to /genericreport, (4) dir parameter to HelpDesk.jsp, or (5) grantSQL parameter to RFCGantt.jsp.
Near-miss passage: CVE-2015-10008. CWE: CWE-89. CVSS: 9.800000190734863. ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in 82Flex WEIPDCRM. It has been classified as critical. This affects an unknown part. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The identifier of the patch is 43bad79392332fa39e31b95268e76fbda9fec3a4. It is recommended to apply a patch to fix this issue. The identifier VDB-217185 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.