alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters. in logs
Matching passage: Sigma rule: Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters.. Logsource: windows / file_event. Rule: title: Potential Homoglyph Attack Using Lookalike Characters in Filename id: 4f1707b1-b50b-45b4-b5a2-3978b5a5d0d6 status: test description: 'Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters. This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters. ' references: - https://redcanary.com/threat-detection-report/threats/socgholish/#threat-socgholish - http://www.irongeek.com/homoglyph-attack-generator.php author: Micah Babinski, @micahbabinski date: 2023-05-08 tags: - attack.stealth - attack.t1036 - attack.t1036.003 logsource: category: file_event product: windows detection: selection_upper: TargetFilename|contains: - А - В - Е - К - М - Н - О - Р - С - Т - Х - Ѕ - І - Ј - Ү - Ӏ - Ԍ - Ԛ - Ԝ - Α - Β - Ε - Ζ - Η - Ι - Κ - Μ - Ν - Ο - Ρ - Τ - Υ - Χ selection_lower: TargetFilename|contains: - а - е - о - р - с - х - ѕ - і - ӏ - ј - һ - ԁ - ԛ - ԝ - ο condition: 1 of selection_* falsepositives: - File names with legitimate Cyrillic text. Will likely require tuning (or not be usable) in countries where these alphabets are in use. level: medium
Near-miss passage: Sigma rule: Detects WerFault creating a dump file with a name that indicates that the dump file could be an LSASS process memory, wh. Logsource: windows / file_event. Rule: title: WerFault LSASS Process Memory Dump id: c3e76af5-4ce0-4a14-9c9a-25ceb8fda182 status: test description: Detects WerFault creating a dump file with a name that indicates that the dump file could be an LSASS process memory, which contains user credentials references: - https://github.com/helpsystems/nanodump author: Florian Roth (Nextron Systems) date: 2022-06-27 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows category: file_event detection: selection: Image: C:\WINDOWS\system32\WerFault.exe TargetFilename|contains: - \lsass - lsass.exe condition: selection falsepositives: - Unknown level: high
Query: exploit EMC RSA Web Threat Detection before 5.1 SP1 allows local users to obtain root privileges by leveraging access to a service account and writing commands to a service configuration f
Matching passage: CVE-2015-4548. CWE: CWE-264. CVSS: 7.199999809265137. EMC RSA Web Threat Detection before 5.1 SP1 allows local users to obtain root privileges by leveraging access to a service account and writing commands to a service configuration file.
Near-miss passage: CVE-2015-5301. CWE: CWE-264. CVSS: 5.5. providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.2 and 1.1.x before 1.1.1 does not properly check permissions, which allows remote authenticated users to cause a denial of service by deleting a SAML2 Service Provider (SP).
Query: rule covering Detects usage of SoftPerfect's "netscan.exe". An application for scanning networks. It is actively used in-the-wild by t
Matching passage: Sigma rule: Detects usage of SoftPerfect's "netscan.exe". An application for scanning networks. It is actively used in-the-wild by t. Logsource: windows / process_creation. Rule: title: PUA - SoftPerfect Netscan Execution id: ca387a8e-1c84-4da3-9993-028b45342d30 status: test description: 'Detects usage of SoftPerfect''s "netscan.exe". An application for scanning networks. It is actively used in-the-wild by threat actors to inspect and understand the network architecture of a victim. ' references: - https://www.protect.airbus.com/blog/uncovering-cyber-intruders-netscan/ - https://secjoes-reports.s3.eu-central-1.amazonaws.com/Sockbot%2Bin%2BGoLand.pdf - https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/ - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/yanluowang-ransomware-attacks-continue - https://research.nccgroup.com/2022/07/13/climbing-mount-everest-black-byte-bytes-back/ - https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-hive-ransomware/ - https://www.softperfect.com/products/networkscanner/ author: '@d4ns4n_ (Wuerth-Phoenix)' date: 2024-04-25 tags: - attack.discovery - attack.t1046 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \netscan.exe - Product: Network Scanner - Description: Application for scanning networks condition: selection falsepositives: - Legitimate administrator activity level: medium
Near-miss passage: Sigma rule: Detects usage of Sysinternals PsSuspend which can be abused to suspend critical processes. Logsource: windows / process_creation. Rule: title: Sysinternals PsSuspend Execution id: 48bbc537-b652-4b4e-bd1d-281172df448f related: - id: 4beb6ae0-f85b-41e2-8f18-8668abc8af78 type: similar status: test description: Detects usage of Sysinternals PsSuspend which can be abused to suspend critical processes references: - https://learn.microsoft.com/en-us/sysinternals/downloads/pssuspend - https://twitter.com/0gtweet/status/1638069413717975046 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-03-23 modified: 2026-06-29 tags: - attack.privilege-escalation - attack.discovery - attack.persistence - attack.t1543.003 logsource: category: process_creation product: windows detection: selection: - OriginalFileName: pssuspend.exe - Image|endswith: - \pssuspend.exe - \pssuspend64.exe - \pssuspend64a.exe condition: selection falsepositives: - Unknown level: medium
Query: risk of The aboot implementation in the Qualcomm components in Android before 2016-07-05 on Nexus 6P devices omits the recovery PIN feature, which has unspecified impact and attack vectors
Matching passage: CVE-2015-8889. CWE: CWE-264. CVSS: 7.800000190734863. The aboot implementation in the Qualcomm components in Android before 2016-07-05 on Nexus 6P devices omits the recovery PIN feature, which has unspecified impact and attack vectors, aka Android internal bug 28822677 and Qualcomm internal bug CR804067.
Near-miss passage: CVE-2015-3458. CWE: CWE-264. CVSS: 6.5. The fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 does not restrict the stream wrapper used in a template path, which allows remote administrators to include and execute arbitrary PHP files via the phar:// stream wrapper, related to the setScriptPath function. NOTE: it is not clear whether this issue crosses privilege boundaries, since administrators might already have privileges to include arbitrary files.
Query: exploit lib/moodlelib.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4, when the theme uses the blocks-regions feature, establishes the course st
Matching passage: CVE-2015-2270. CWE: CWE-17. CVSS: 4.300000190734863. lib/moodlelib.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4, when the theme uses the blocks-regions feature, establishes the course state at an incorrect point in the login-validation process, which allows remote attackers to obtain sensitive course information via unspecified vectors.
Near-miss passage: CVE-2015-3183. CWE: CWE-17. CVSS: 5.0. The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension characters in modules/http/http_filters.c.
Query: CVE similar to CVE-2015-3789
Matching passage: CVE-2015-3789. CWE: CWE-119. CVSS: 6.800000190734863. QuickTime 7 in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted file, a different vulnerability than CVE-2015-3765, CVE-2015-3779, CVE-2015-3788, CVE-2015-3790, CVE-2015-3791, CVE-2015-3792, CVE-2015-5751, CVE-2015-5753, and CVE-2015-5779.
Near-miss passage: CVE-2015-5776. CWE: CWE-119. CVSS: 7.5. Libinfo in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by leveraging use of an AF_INET6 socket.
Query: CVE similar to CVE-2015-5072
Matching passage: CVE-2015-5072. CWE: CWE-269. CVSS: 6.5. The BIRT Engine servlet in the AR System Mid Tier component before 9.0 SP1 for BMC Remedy AR System Server allows remote authenticated users to "navigate" to arbitrary local files via the __imageid parameter.
Near-miss passage: CVE-2015-3613. CWE: CWE-269. CVSS: 9.800000190734863. A vulnerability exists in in FortiManager 5.2.1 and earlier and 5.0.10 and earlier in the WebUI FTP backup page
Query: vulnerability: QNAP Signage Station before 2.0.1 allows remote attackers to bypass authentication, and consequently upload files, via a spoofed HTTP request.
Matching passage: CVE-2015-6036. CWE: UNKNOWN. CVSS: 7.5. QNAP Signage Station before 2.0.1 allows remote attackers to bypass authentication, and consequently upload files, via a spoofed HTTP request.
Near-miss passage: CVE-2015-4789. CWE: UNKNOWN. CVSS: 6.900000095367432. Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-2583, CVE-2015-2624, CVE-2015-2626, CVE-2015-2640, CVE-2015-2654, CVE-2015-2656, CVE-2015-4754, CVE-2015-4764, CVE-2015-4775, CVE-2015-4776, CVE-2015-4777, CVE-2015-4778, CVE-2015-4780, CVE-2015-4781, CVE-2015-4782, CVE-2015-4783, CVE-2015-4784, CVE-2015-4785, CVE-2015-4786, CVE-2015-4787, and CVE-2015-4790.
Query: patch priority for CVE-2015-1059
Matching passage: CVE-2015-1059. CWE: CWE-94. CVSS: 6.5. Unrestricted file upload vulnerability in admin/files/add in AdaptCMS 3.0.3 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in /app/webroot/uploads.
Near-miss passage: CVE-2015-2252. CWE: CWE-94. CVSS: 8.800000190734863. Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to execute arbitrary code with root privileges via a crafted UDS patch with shell scripts.
Query: risk of Cross-site scripting (XSS) vulnerability in pfSense before 2.2.3 allows remote attackers to inject arbitrary web script or HTML via the server[] parameter to services_ntpd.php.
Matching passage: CVE-2015-6511. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in pfSense before 2.2.3 allows remote attackers to inject arbitrary web script or HTML via the server[] parameter to services_ntpd.php.
Near-miss passage: CVE-2015-1390. CWE: CWE-79. CVSS: 6.099999904632568. Aruba AirWave before 8.0.7 allows XSS attacks agsinat an administrator.
Query: risk of Lansweeper 4.x through 6.x before 6.0.0.48 allows attackers to execute arbitrary code on the administrator's workstation via a crafted Windows service.
Matching passage: CVE-2015-9264. CWE: CWE-20. CVSS: 9.800000190734863. Lansweeper 4.x through 6.x before 6.0.0.48 allows attackers to execute arbitrary code on the administrator's workstation via a crafted Windows service.
Near-miss passage: CVE-2015-9116. CWE: CWE-20. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 810, SD 820, and SD 820A, in a QTEE syscall handler, an untrusted pointer dereference can occur.
Query: patch priority for CVE-2015-1651
Matching passage: CVE-2015-1651. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in Microsoft Word 2007 SP3, Word Viewer, and Office Compatibility Pack SP3 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Component Use After Free Vulnerability."
Near-miss passage: CVE-2015-5161. CWE: UNKNOWN. CVSS: 6.800000190734863. The Zend_Xml_Security::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded environment, allows remote attackers to bypass security checks and conduct XML external entity (XXE) and XML entity expansion (XEE) attacks via multibyte encoded characters.
Query: risk of Cross-site scripting (XSS) vulnerability in the Smart Trim module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary w
Matching passage: CVE-2015-5489. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Smart Trim module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors involving the field settings form.
Near-miss passage: CVE-2015-0167. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in textAngular-sanitize.js in textAngular before 1.3.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to the editor.
Query: CVE similar to CVE-2015-0076
Matching passage: CVE-2015-0076. CWE: CWE-200. CVSS: 4.300000190734863. The photo-decoder implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly initialize memory for rendering of JXR images, which allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "JPEG XR Parser Information Disclosure Vulnerability."
Near-miss passage: CVE-2015-3754. CWE: CWE-200. CVSS: 4.300000190734863. The private-browsing implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8 does not prevent caching of HTTP authentication credentials, which makes it easier for remote attackers to track users via a crafted web site.
Query: risk of Use-after-free vulnerability in the popUpMenuEx method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.00
Matching passage: CVE-2015-6690. CWE: CWE-416. CVSS: 6.800000190734863. Use-after-free vulnerability in the popUpMenuEx method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via crafted arguments, a different vulnerability than CVE-2015-5586, CVE-2015-6683, CVE-2015-6684, CVE-2015-6687, CVE-2015-6688, CVE-2015-6689, CVE-2015-6691, CVE-2015-7615, CVE-2015-7617, and CVE-2015-7621.
Near-miss passage: CVE-2015-6673. CWE: CWE-416. CVSS: 9.800000190734863. Use-after-free vulnerability in Decoder.cpp in libpgf before 6.15.32.
Query: Sigma rule for Detects potential DLL sideloading of "dbghelp.dll"
Matching passage: Sigma rule: Detects potential DLL sideloading of "dbghelp.dll". Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Of DBGHELP.DLL id: 6414b5cd-b19d-447e-bb5e-9f03940b5784 status: test description: Detects potential DLL sideloading of "dbghelp.dll" references: - https://hijacklibs.net/ author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research) date: 2022-10-25 modified: 2025-10-07 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \dbghelp.dll filter_main_generic: ImageLoaded|startswith: - C:\Program Files (x86)\ - C:\Program Files\ - C:\Windows\SoftwareDistribution\ - C:\Windows\System32\ - C:\Windows\SystemTemp\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ filter_optional_anaconda: ImageLoaded|endswith: - \Anaconda3\Lib\site-packages\vtrace\platforms\windll\amd64\dbghelp.dll - \Anaconda3\Lib\site-packages\vtrace\platforms\windll\i386\dbghelp.dll filter_optional_epicgames: ImageLoaded|endswith: - \Epic Games\Launcher\Engine\Binaries\ThirdParty\DbgHelp\dbghelp.dll - \Epic Games\MagicLegends\x86\dbghelp.dll filter_optional_opera: ImageLoaded|contains: opera\Opera Installer Temp\opera_package ImageLoaded|endswith: \assistant\dbghelp.dll condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate applications loading their own versions of the DLL mentioned in this rule level: medium
Near-miss passage: Sigma rule: Detects when an Elastic Container Service (ECS) Task Definition includes a command to query the credential endpoint. Thi. Logsource: aws / cloudtrail. Rule: title: AWS ECS Task Definition That Queries The Credential Endpoint id: b94bf91e-c2bf-4047-9c43-c6810f43baad status: test description: 'Detects when an Elastic Container Service (ECS) Task Definition includes a command to query the credential endpoint. This can indicate a potential adversary adding a backdoor to establish persistence or escalate privileges. ' references: - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/ecs__backdoor_task_def/main.py - https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_RegisterTaskDefinition.html - https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html author: Darin Smith date: 2022-06-07 modified: 2023-04-24 tags: - attack.persistence - attack.t1525 logsource: product: aws service: cloudtrail detection: selection: eventSource: ecs.amazonaws.com eventName: - DescribeTaskDefinition - RegisterTaskDefinition - RunTask requestParameters.containerDefinitions.command|contains: $AWS_CONTAINER_CREDENTIALS_RELATIVE_URI condition: selection falsepositives: - Task Definition being modified to request credentials from the Task Metadata Service for valid reasons level: medium
Query: risk of Multiple cross-site scripting (XSS) vulnerabilities in (1) templates/admanagement/admanagement.php and (2) templates/adspot/adspot.php in the ResAds plugin before 1.0.2 for WordPre
Matching passage: CVE-2015-7667. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in (1) templates/admanagement/admanagement.php and (2) templates/adspot/adspot.php in the ResAds plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the page parameter.
Near-miss passage: CVE-2015-5667. CWE: CWE-79. CVSS: 2.5999999046325684. Cross-site scripting (XSS) vulnerability in the HTML-Scrubber module before 0.15 for Perl, when the comment feature is enabled, allows remote attackers to inject arbitrary web script or HTML via a crafted comment.
Query: Persistence mechanism resembling Remote Service Session Hijacking
Matching passage: T1563 Remote Service Session Hijacking. Tactics: lateral movement. Description: Adversaries may take control of preexisting sessions with remote services to move laterally in an environment. Users may use valid credentials to log into a service specifically designed to accept remote connections, such as telnet, SSH, and RDP. When a user logs into a service, a session will be established that will allow them to maintain a continuous interaction with that service. Adversaries may commandeer these sessions to carry out actions on remote systems. [Remote Service Session Hijacking](https://attack.mitre.org/techniques/T1563) differs from use of [Remote Services](https://attack.mitre.org/techniques/T1021) because it hijacks an existing session rather than creating a new session using [Valid Accounts](https://attack.mitre.org/techniques/T1078).(Citation: RDP Hijacking Medium)(Citation: Breach Post-mortem SSH Hijack)
Near-miss passage: T1563.001 SSH Hijacking. Tactics: lateral movement. Description: Adversaries may hijack a legitimate user's SSH session to move laterally within an environment. Secure Shell (SSH) is a standard means of remote access on Linux and macOS systems. It allows a user to connect to another system via an encrypted tunnel, commonly authenticating through a password, certificate or the use of an asymmetric encryption key pair. In order to move laterally from a compromised host, adversaries may take advantage of trust relationships established with other systems via public key authentication in active SSH sessions by hijacking an existing connection to another system. This may occur through compromising the SSH agent itself or by having access to the agent's socket. If an adversary is able to obtain root access, then hijacking SSH sessions is likely trivial.(Citation: Slideshare Abusing SSH)(Citation: SSHjack Blackhat)(Citation: Clockwork SSH Agent Hijacking)(Citation: Breach Post-mortem SSH Hijack) [SSH Hijacking](https://attack.mitre.org/techniques/T1563/001) differs from use of [SSH](https://attack.mitre.org/techniques/T1021/004) because it hijacks an existing SSH session rather than creating a new session using [Valid Accounts](https://attack.mitre.org/techniques/T1078).
Query: patch priority for CVE-2015-6477
Matching passage: CVE-2015-6477. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in the Wind Farm Portal application in Nordex Control 2 (NC2) SCADA 16 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-9436. CWE: CWE-79. CVSS: 5.400000095367432. The dynamic-widgets plugin before 1.5.11 for WordPress has XSS via the wp-admin/admin-ajax.php?action=term_tree prefix or widget_id parameter.
Query: describe CVE-2015-4138
Matching passage: CVE-2015-4138. CWE: CWE-200. CVSS: 4.300000190734863. The WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 does not include the HTTPOnly flag in a Set-Cookie header for the administrator's cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, a different vulnerability than CVE-2015-2855.
Near-miss passage: CVE-2015-7255. CWE: CWE-200. CVSS: 7.5. ZTE OX-330P, ZXHN H108N, W300V1.0.0S_ZRD_TR1_D68, HG110, GAN9.8T101A-B, MF28G, ZXHN H108N use non-unique X.509 certificates and SSH host keys, which might allow remote attackers to obtain credentials or other sensitive information via a man-in-the-middle attack, passive decryption attack, or impersonating a legitimate device.
Query: patch priority for CVE-2015-2987
Matching passage: CVE-2015-2987. CWE: CWE-17. CVSS: 2.5999999046325684. Type74 ED before 4.0 misuses 128-bit ECB encryption for small files, which makes it easier for attackers to obtain plaintext data via differential cryptanalysis of a file with an original length smaller than 128 bits.
Near-miss passage: CVE-2015-5912. CWE: CWE-17. CVSS: 5.0. The CFNetwork FTPProtocol component in Apple iOS before 9 allows remote FTP proxy servers to trigger TCP connection attempts to intranet hosts via crafted responses.