alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit Buffer overflow in das_watchdog 0.9.0 allows local users to execute arbitrary code with root privileges via a large string in the XAUTHORITY environment variable.
Matching passage: CVE-2015-2831. CWE: CWE-119. CVSS: 7.199999809265137. Buffer overflow in das_watchdog 0.9.0 allows local users to execute arbitrary code with root privileges via a large string in the XAUTHORITY environment variable.
Near-miss passage: CVE-2015-3680. CWE: CWE-119. CVSS: 6.800000190734863. Apple Type Services (ATS) in Apple OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-3679, CVE-2015-3681, and CVE-2015-3682.
Query: write Sigma for Detects S3 Browser utility creating IAM User or AccessKey.
Matching passage: Sigma rule: Detects S3 Browser utility creating IAM User or AccessKey.. Logsource: aws / cloudtrail. Rule: title: AWS IAM S3Browser User or AccessKey Creation id: db014773-d9d9-4792-91e5-133337c0ffee status: test description: Detects S3 Browser utility creating IAM User or AccessKey. references: - https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor author: daniel.bohannon@permiso.io (@danielhbohannon) date: 2023-05-17 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.initial-access - attack.stealth - attack.t1059.009 - attack.t1078.004 logsource: product: aws service: cloudtrail detection: selection: eventSource: iam.amazonaws.com eventName: - CreateUser - CreateAccessKey userAgent|contains: S3 Browser condition: selection falsepositives: - Valid usage of S3 Browser for IAM User and/or AccessKey creation level: high
Near-miss passage: Sigma rule: This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that ar. Logsource: windows. Rule: title: Mimikatz Use id: 06d71506-7beb-4f22-8888-e2e5e2ca7fd8 status: test description: This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups) references: - https://tools.thehacker.recipes/mimikatz/modules author: Florian Roth (Nextron Systems), David ANDRE (additional keywords) date: 2017-01-10 modified: 2022-01-05 tags: - attack.s0002 - attack.lateral-movement - attack.credential-access - car.2013-07-001 - car.2019-04-004 - attack.t1003.002 - attack.t1003.004 - attack.t1003.001 - attack.t1003.006 logsource: product: windows detection: keywords: - dpapi::masterkey - eo.oe.kiwi - event::clear - event::drop - gentilkiwi.com - kerberos::golden - kerberos::ptc - kerberos::ptt - kerberos::tgt - Kiwi Legit Printer - 'lsadump::' - mimidrv.sys - \mimilib.dll - misc::printnightmare - misc::shadowcopies - misc::skeleton - privilege::backup - privilege::debug - privilege::driver - 'sekurlsa::' filter: EventID: 15 condition: keywords and not filter falsepositives: - Naughty administrators - AV Signature updates - Files with Mimikatz in their filename level: high
Query: risk of Backup in Apple iOS before 8.4.1 allows attackers to bypass intended restrictions on filesystem access via a crafted app that creates a symlink.
Matching passage: CVE-2015-5752. CWE: CWE-59. CVSS: 5.0. Backup in Apple iOS before 8.4.1 allows attackers to bypass intended restrictions on filesystem access via a crafted app that creates a symlink.
Near-miss passage: CVE-2015-1196. CWE: CWE-59. CVSS: 4.300000190734863. GNU patch 2.7.1 allows remote attackers to write to arbitrary files via a symlink attack in a patch file.
Query: Sigma rule for Detects execution of a browser process with a URL argument pointing to a file with a potentially interesting extension.
Matching passage: Sigma rule: Detects execution of a browser process with a URL argument pointing to a file with a potentially interesting extension.. Logsource: windows / process_creation. Rule: title: File Download From Browser Process Via Inline URL id: 94771a71-ba41-4b6e-a757-b531372eaab6 status: test description: Detects execution of a browser process with a URL argument pointing to a file with a potentially interesting extension. This can be abused to download arbitrary files or to hide from the user for example by launching the browser in a minimized state. references: - https://twitter.com/mrd0x/status/1478116126005641220 - https://lolbas-project.github.io/lolbas/Binaries/Msedge/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-01-11 modified: 2025-10-27 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: - \brave.exe - \chrome.exe - \msedge.exe - \opera.exe - \vivaldi.exe selection_http: CommandLine|contains: http selection_extensions: - CommandLine|endswith: - .7z - .dat - .dll - .exe - .hta - .ps1 - .psm1 - .txt - .vbe - .vbs - .zip - CommandLine|contains: - .7z" - .dat" - .dll" - .hta" - .ps1" - .psm1" - .txt" - .vbe" - .vbs" - .zip" condition: all of selection_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_inline_file_download/info.yml
Near-miss passage: Sigma rule: Detects child processes of Microsoft.NodejsTools.PressAnyKey.exe that can be used to execute any other binary. Logsource: windows / process_creation. Rule: title: Visual Studio NodejsTools PressAnyKey Arbitrary Binary Execution id: a20391f8-76fb-437b-abc0-dba2df1952c6 related: - id: 65c3ca2c-525f-4ced-968e-246a713d164f type: similar status: test description: Detects child processes of Microsoft.NodejsTools.PressAnyKey.exe that can be used to execute any other binary references: - https://twitter.com/mrd0x/status/1463526834918854661 - https://gist.github.com/nasbench/a989ce64cefa8081bd50cf6ad8c491b5 author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-01-11 modified: 2023-04-11 tags: - attack.execution - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \Microsoft.NodejsTools.PressAnyKey.exe condition: selection falsepositives: - Legitimate use by developers as part of NodeJS development with Visual Studio Tools level: medium
Query: CVE similar to CVE-2015-4799
Matching passage: CVE-2015-4799. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle WebCenter Sites component in Oracle Fusion Middleware 7.6.2, 11.1.1.6.1, and 11.1.1.8.0 allows remote attackers to affect integrity via unknown vectors related to Security.
Near-miss passage: CVE-2015-8647. CWE: UNKNOWN. CVSS: 8.800000190734863. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8634, CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8648, CVE-2015-8649, and CVE-2015-8650.
Query: describe CVE-2015-3209
Matching passage: CVE-2015-3209. CWE: CWE-787. CVSS: 7.5. Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS set.
Near-miss passage: CVE-2015-5105. CWE: CWE-787. CVSS: 10.0. Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5096 and CVE-2015-5098.
Query: detection rule: Detects execution of "rundll32" with potential obfuscated ordinal calls
Matching passage: Sigma rule: Detects execution of "rundll32" with potential obfuscated ordinal calls. Logsource: windows / process_creation. Rule: title: Potential Obfuscated Ordinal Call Via Rundll32 id: 43fa5350-db63-4b8f-9a01-789a427074e1 status: test description: Detects execution of "rundll32" with potential obfuscated ordinal calls references: - Internal Research - https://www.youtube.com/watch?v=52tAmVLg1KM&t=2070s author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2023-05-17 modified: 2025-02-23 tags: - attack.stealth - attack.t1027.010 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE - CommandLine|contains: rundll32 selection_cli: CommandLine|contains: - '#+' - '#-' - '#0' - '#655' - '#656' condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the creation of a local hidden user account which should not happen for event ID 4720.. Logsource: windows / security. Rule: title: Hidden Local User Creation id: 7b449a5e-1db5-4dd0-a2dc-4e3a67282538 status: test description: Detects the creation of a local hidden user account which should not happen for event ID 4720. references: - https://twitter.com/SBousseaden/status/1387743867663958021 author: Christian Burkard (Nextron Systems) date: 2021-05-03 modified: 2024-01-16 tags: - attack.persistence - attack.t1136.001 logsource: product: windows service: security detection: selection: EventID: 4720 TargetUserName|endswith: $ filter_main_homegroup: TargetUserName: HomeGroupUser$ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: weakness Insertion of Sensitive Information Into Debugging Code
Matching passage: CWE-215 Insertion of Sensitive Information Into Debugging Code. The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.
Near-miss passage: CWE-1066 Missing Serialization Control Element. The product contains a serializable data element that does not have an associated serialization method.
Query: CVE similar to CVE-2015-7847
Matching passage: CVE-2015-7847. CWE: CWE-20. CVSS: 5.5. Huawei MBB (Mobile Broadband) product E3272s with software versions earlier than E3272s-153TCPU-V200R002B491D09SP00C00 has a Denial of Service (DoS) vulnerability. An attacker could send a malicious packet to the Common Gateway Interface (CGI) of a target device and make it fail while setting the port attribute, which causes a DoS attack.
Near-miss passage: CVE-2015-8552. CWE: CWE-20. CVSS: 4.400000095367432. The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain, allows local guest administrators to generate a continuous stream of WARN messages and cause a denial of service (disk consumption) by leveraging a system with access to a passed-through MSI or MSI-X capable physical PCI device and XEN_PCI_OP_enable_msi operations, aka "Linux pciback missing sanity checks."
Query: detect Detects block events for files that are disallowed by code integrity for protected processes in logs
Matching passage: Sigma rule: Detects block events for files that are disallowed by code integrity for protected processes. Logsource: windows / codeintegrity-operational. Rule: title: CodeIntegrity - Disallowed File For Protected Processes Has Been Blocked id: 5daf11c3-022b-4969-adb9-365e6c078c7c status: test description: Detects block events for files that are disallowed by code integrity for protected processes references: - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-06 tags: - attack.privilege-escalation logsource: product: windows service: codeintegrity-operational detection: selection: EventID: 3104 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using Windows Authentication.. Logsource: opencanary / application. Rule: title: OpenCanary - MSSQL Login Attempt Via Windows Authentication id: 6e78f90f-0043-4a01-ac41-f97681613a66 status: test description: 'Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using Windows Authentication. ' references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.credential-access - attack.collection - attack.t1003 - attack.t1213 logsource: category: application product: opencanary detection: selection: logtype: 9002 condition: selection falsepositives: - Unlikely level: high
Query: Sigma YAML for windows / image_load
Matching passage: Sigma rule: Detects loading of "Amsi.dll" by a living of the land process. This could be an indication of a "PowerShell without Powe. Logsource: windows / image_load. Rule: title: Amsi.DLL Loaded Via LOLBIN Process id: 6ec86d9e-912e-4726-91a2-209359b999b9 status: test description: Detects loading of "Amsi.dll" by a living of the land process. This could be an indication of a "PowerShell without PowerShell" attack references: - Internal Research - https://www.paloaltonetworks.com/blog/security-operations/stopping-powershell-without-powershell/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-01 modified: 2025-10-07 tags: - attack.defense-impairment logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \amsi.dll Image|endswith: - \ExtExport.exe - \odbcconf.exe - \rundll32.exe condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the import of '.reg' files from suspicious paths using the 'reg.exe' utility. Logsource: windows / process_creation. Rule: title: Potential Suspicious Registry File Imported Via Reg.EXE id: 62e0298b-e994-4189-bc87-bc699aa62d97 related: - id: 73bba97f-a82d-42ce-b315-9182e76c57b1 type: derived status: test description: Detects the import of '.reg' files from suspicious paths using the 'reg.exe' utility references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/reg-import author: frack113, Nasreddine Bencherchali date: 2022-08-01 modified: 2023-02-05 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_cli: CommandLine|contains: ' import ' selection_paths: CommandLine|contains: - C:\Users\ - '%temp%' - '%tmp%' - '%appdata%' - \AppData\Local\Temp\ - C:\Windows\Temp\ - C:\ProgramData\ condition: all of selection_* falsepositives: - Legitimate import of keys level: medium
Query: describe CVE-2015-3867
Matching passage: CVE-2015-3867. CWE: CWE-119. CVSS: 10.0. libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23213430.
Near-miss passage: CVE-2015-7499. CWE: CWE-119. CVSS: 5.0. Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive process memory information via unspecified vectors.
Query: CVE similar to CVE-2015-2201
Matching passage: CVE-2015-2201. CWE: CWE-78. CVSS: 7.199999809265137. Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows VisualRF remote OS command execution and file disclosure by administrative users.
Near-miss passage: CVE-2015-2979. CWE: CWE-78. CVSS: 7.5. Webservice-DIC yoyaku_v41 allows remote attackers to execute arbitrary OS commands via unspecified vectors.
Query: exploit In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 
Matching passage: CVE-2015-9177. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, in a crypto API function, a buffer over-read can occur.
Near-miss passage: CVE-2015-5567. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to execute arbitrary code or cause a denial of service (stack memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5579.
Query: vulnerability: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, 
Matching passage: CVE-2015-9206. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 617, SD 650/52, SD 808, and SD 810, during XML encoding of a message in the Playready module, a buffer overread may occur if the message passed is large.
Near-miss passage: CVE-2015-6587. CWE: CWE-119. CVSS: 4.0. The vlserver in OpenAFS before 1.6.13 allows remote authenticated users to cause a denial of service (out-of-bounds read and crash) via a crafted regular expression in a VL_ListAttributesN2 RPC.
Query: secure coding against EJB Bad Practices: Use of Sockets
Matching passage: CWE-577 EJB Bad Practices: Use of Sockets. The product violates the Enterprise JavaBeans (EJB) specification by using sockets.
Near-miss passage: CWE-1286 Improper Validation of Syntactic Correctness of Input. The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.
Query: risk of Fortinet FortiManager 5.0 before 5.0.11 and 5.2 before 5.2.2 allow local users to gain privileges via crafted CLI commands.
Matching passage: CVE-2015-3617. CWE: CWE-264. CVSS: 7.800000190734863. Fortinet FortiManager 5.0 before 5.0.11 and 5.2 before 5.2.2 allow local users to gain privileges via crafted CLI commands.
Near-miss passage: CVE-2015-6642. CWE: CWE-264. CVSS: 9.800000190734863. The kernel in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 24157888.
Query: rule covering Detects the presence and execution of Inveigh via dropped artefacts
Matching passage: Sigma rule: Detects the presence and execution of Inveigh via dropped artefacts. Logsource: windows / file_event. Rule: title: HackTool - Inveigh Execution Artefacts id: bb09dd3e-2b78-4819-8e35-a7c1b874e449 status: test description: Detects the presence and execution of Inveigh via dropped artefacts references: - https://github.com/Kevin-Robertson/Inveigh/blob/29d9e3c3a625b3033cdaf4683efaafadcecb9007/Inveigh/Support/Output.cs - https://github.com/Kevin-Robertson/Inveigh/blob/29d9e3c3a625b3033cdaf4683efaafadcecb9007/Inveigh/Support/Control.cs - https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-24 modified: 2024-06-27 tags: - attack.command-and-control - attack.t1219.002 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: - \Inveigh-Log.txt - \Inveigh-Cleartext.txt - \Inveigh-NTLMv1Users.txt - \Inveigh-NTLMv2Users.txt - \Inveigh-NTLMv1.txt - \Inveigh-NTLMv2.txt - \Inveigh-FormInput.txt - \Inveigh.dll - \Inveigh.exe - \Inveigh.ps1 - \Inveigh-Relay.ps1 condition: selection falsepositives: - Unlikely level: critical
Near-miss passage: Sigma rule: Detects execution of ADRecon.ps1 for AD reconnaissance which has been reported to be actively used by FIN7. Logsource: windows / ps_script. Rule: title: PowerShell ADRecon Execution id: bf72941a-cba0-41ea-b18c-9aca3925690d status: test description: Detects execution of ADRecon.ps1 for AD reconnaissance which has been reported to be actively used by FIN7 references: - https://github.com/sense-of-security/ADRecon/blob/11881a24e9c8b207f31b56846809ce1fb189bcc9/ADRecon.ps1 - https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319 author: Bhabesh Raj date: 2021-07-16 modified: 2022-09-06 tags: - attack.discovery - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - Function Get-ADRExcelComOb - Get-ADRGPO - Get-ADRDomainController - ADRecon-Report.xlsx condition: selection falsepositives: - Unknown level: high
Query: exploit AppleThunderboltEDMService in Apple OS X before 10.10.4 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified Thunderbolt commands.
Matching passage: CVE-2015-3678. CWE: CWE-77. CVSS: 7.199999809265137. AppleThunderboltEDMService in Apple OS X before 10.10.4 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified Thunderbolt commands.
Near-miss passage: CVE-2015-6613. CWE: CWE-77. CVSS: 5.099999904632568. Bluetooth in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows attackers to send commands to a debugging port, and consequently gain privileges, via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 24371736.