alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: patch priority for CVE-2015-0019
Matching passage: CVE-2015-0019. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-4277. CWE: CWE-399. CVSS: 4.900000095367432. The global-configuration implementation on Cisco ASR 9000 devices with software 5.1.3 and 5.3.0 improperly closes vty sessions after a commit/end operation, which allows local users to cause a denial of service (tmp/*config file creation, memory consumption, and device hang) via unspecified vectors, aka Bug ID CSCut93842.
Query: CVE similar to CVE-2015-8773
Matching passage: CVE-2015-8773. CWE: CWE-119. CVSS: 7.5. Stack-based buffer overflow in McPvDrv.sys 4.6.111.0 in McAfee File Lock 5.x in McAfee Total Protection allows attackers to cause a denial of service (system crash) via a long vault GUID in an ioctl call.
Near-miss passage: CVE-2015-6066. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6070, CVE-2015-6071, CVE-2015-6074, CVE-2015-6076, and CVE-2015-6087.
Query: write Sigma for Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has
Matching passage: Sigma rule: Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has. Logsource: windows / security. Rule: title: Password Protected ZIP File Opened id: 00ba9da1-b510-4f6b-b258-8d338836180f status: test description: Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened. references: - https://twitter.com/sbousseaden/status/1523383197513379841 author: Florian Roth (Nextron Systems) date: 2022-05-09 tags: - attack.stealth - attack.t1027 logsource: product: windows service: security detection: selection: EventID: 5379 TargetName|contains: Microsoft_Windows_Shell_ZipFolder:filename filter: TargetName|contains: \Temporary Internet Files\Content.Outlook condition: selection and not filter falsepositives: - Legitimate used of encrypted ZIP files level: medium
Near-miss passage: Sigma rule: Detects exploitation of LNK file command-line length discrepancy, where attackers hide malicious commands beyond the 260. Logsource: windows / process_creation. Rule: title: Suspicious LNK Command-Line Padding with Whitespace Characters id: dd8756e7-a3a0-4768-b47e-8f545d1a751c status: experimental description: 'Detects exploitation of LNK file command-line length discrepancy, where attackers hide malicious commands beyond the 260-character UI limit while the actual command-line argument field supports 4096 characters using whitespace padding (e.g., 0x20, 0x09-0x0D). Adversaries insert non-printable whitespace characters (e.g., Line Feed \x0A, Carriage Return \x0D) to pad the visible section of the LNK file, pushing malicious commands past the UI-visible boundary. The hidden payload, executed at runtime but invisible in Windows Explorer properties, enables stealthy execution and evasion—commonly used for social engineering attacks. This rule flags suspicious use of such padding observed in real-world attacks. ' references: - https://syedhasan010.medium.com/forensics-analysis-of-an-lnk-file-da68a98b8415 - https://thehackernews.com/2025/03/unpatched-windows-zero-day-flaw.html - https://www.trendmicro.com/en_us/research/25/c/windows-shortcut-zero-day-exploit.html author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-03-19 tags: - attack.initial-access - attack.execution - attack.t1204.002 logsource: category: process_creation product: windows detection: selection_img: - ParentImage|endswith: \explorer.exe - ParentCommandLine|contains: .lnk selection_cmd: - CommandLine|contains: - ' ' - \u0009 - \u000A - \u0011 - \u0012 - \u0013 - \u000B - \u000C - \u000D - CommandLine|re: \n\n\n\n\n\n condition: all of selection_* falsepositives: - Unknown level: high
Query: rule covering Alerts on Metasploit host's authentications on the domain.
Matching passage: Sigma rule: Alerts on Metasploit host's authentications on the domain.. Logsource: windows / security. Rule: title: Metasploit SMB Authentication id: 72124974-a68b-4366-b990-d30e0b2a190d status: test description: Alerts on Metasploit host's authentications on the domain. references: - https://github.com/rapid7/metasploit-framework/blob/1416b5776d963f21b7b5b45d19f3e961201e0aed/lib/rex/proto/smb/client.rb author: Chakib Gzenayi (@Chak092), Hosni Mribah date: 2020-05-06 modified: 2024-01-25 tags: - attack.lateral-movement - attack.t1021.002 logsource: product: windows service: security detection: selection1: EventID: - 4625 - 4624 LogonType: 3 AuthenticationPackageName: NTLM WorkstationName|re: ^[A-Za-z0-9]{16}$ selection2: EventID: 4776 Workstation|re: ^[A-Za-z0-9]{16}$ condition: 1 of selection* falsepositives: - Linux hostnames composed of 16 characters. level: high
Near-miss passage: Sigma rule: Detects setting of a new registry value related to BgInfo configuration, which can be abused to execute custom VBScript. Logsource: windows / registry_set. Rule: title: New BgInfo.EXE Custom VBScript Registry Configuration id: 992dd79f-dde8-4bb0-9085-6350ba97cfb3 related: - id: cd277474-5c52-4423-a52b-ac2d7969902f type: similar status: test description: Detects setting of a new registry value related to BgInfo configuration, which can be abused to execute custom VBScript via "BgInfo.exe" references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-16 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Software\Winternals\BGInfo\UserFields\ Details|startswith: '4' condition: selection falsepositives: - Legitimate VBScript level: medium
Query: vulnerability: Mozilla Firefox OS before 2.2 does not require the wifi-manage privilege for reading a Wi-Fi system message, which allows attackers to obtain potentially sensitive information via 
Matching passage: CVE-2015-4494. CWE: CWE-200. CVSS: 4.300000190734863. Mozilla Firefox OS before 2.2 does not require the wifi-manage privilege for reading a Wi-Fi system message, which allows attackers to obtain potentially sensitive information via a crafted app.
Near-miss passage: CVE-2015-0834. CWE: CWE-200. CVSS: 4.300000190734863. The WebRTC subsystem in Mozilla Firefox before 36.0 recognizes turns: and stuns: URIs but accesses the TURN or STUN server without using TLS, which makes it easier for man-in-the-middle attackers to discover credentials by spoofing a server and completing a brute-force attack within a short time window.
Query: describe CVE-2015-7820
Matching passage: CVE-2015-7820. CWE: CWE-362. CVSS: 7.099999904632568. Race condition in the administration-panel web service in IBM System Networking Switch Center (SNSC) before 7.3.1.5 and Lenovo Switch Center before 8.1.2.0 allows remote attackers to obtain privileged-account access, and consequently provide ZipDownload.jsp input containing directory traversal sequences to read arbitrary files, via a request to port 40080 or 40443.
Near-miss passage: CVE-2015-7553. CWE: CWE-362. CVSS: 4.699999809265137. Race condition in the kernel in Red Hat Enterprise Linux 7, kernel-rt and Red Hat Enterprise MRG 2, when the nfnetlink_log module is loaded, allows local users to cause a denial of service (panic) by creating netlink sockets.
Query: vulnerability: Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before
Matching passage: CVE-2015-3083. CWE: CWE-264. CVSS: 6.400000095367432. Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow remote attackers to bypass intended restrictions on filesystem write operations via unspecified vectors, a different vulnerability than CVE-2015-3082 and CVE-2015-3085.
Near-miss passage: CVE-2015-7062. CWE: CWE-264. CVSS: 4.599999904632568. Apple OS X before 10.11.2 and tvOS before 9.1 allow local users to bypass intended configuration-profile installation restrictions via unspecified vectors.
Query: detect Backdooring domain object to grant the rights associated with DCSync to a regular user or machine account using Powervie in logs
Matching passage: Sigma rule: Backdooring domain object to grant the rights associated with DCSync to a regular user or machine account using Powervie. Logsource: windows / security. Rule: title: Powerview Add-DomainObjectAcl DCSync AD Extend Right id: 2c99737c-585d-4431-b61a-c911d86ff32f status: test description: Backdooring domain object to grant the rights associated with DCSync to a regular user or machine account using Powerview\Add-DomainObjectAcl DCSync Extended Right cmdlet, will allow to re-obtain the pwd hashes of any user/computer references: - https://twitter.com/menasec1/status/1111556090137903104 - https://www.specterops.io/assets/resources/an_ace_up_the_sleeve.pdf author: Samir Bousseaden, Roberto Rodriguez @Cyb3rWard0g, oscd.community, Tim Shelton, Maxence Fossat date: 2019-04-03 modified: 2022-08-16 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: product: windows service: security definition: 'Requirements: The "Audit Directory Service Changes" logging policy must be configured in order to receive events. Audit events are generated only for objects with configured system access control lists (SACLs). Audit events are generated only for objects with configured system access control lists (SACLs) and only when accessed in a manner that matches their SACL settings. This policy covers the following events ids - 5136, 5137, 5138, 5139, 5141. Note that the default policy does not cover User objects. For that a custom AuditRule need to be setup (See https://github.com/OTRF/Set-AuditRule)' detection: selection: EventID: 5136 AttributeLDAPDisplayName: ntSecurityDescriptor AttributeValue|contains: - 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 - 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 - 89e95b76-444d-4c62-991a-0facbeda640c filter_main_dns_object_class: ObjectClass: - dnsNode - dnsZoneScope - dnsZone condition: selection and not 1 of filter_main_* falsepositives: - New Domain Controller computer account, check user SIDs within the value attribute of event 5136 and verify if it's a regular user or DC computer account. level: high
Near-miss passage: Sigma rule: Detects the use of "Ilasm.EXE" in order to compile C# intermediate (IL) code to EXE or DLL.. Logsource: windows / process_creation. Rule: title: C# IL Code Compilation Via Ilasm.EXE id: 850d55f9-6eeb-4492-ad69-a72338f65ba4 status: test description: Detects the use of "Ilasm.EXE" in order to compile C# intermediate (IL) code to EXE or DLL. references: - https://lolbas-project.github.io/lolbas/Binaries/Ilasm/ - https://www.echotrail.io/insights/search/ilasm.exe author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2022-05-07 modified: 2022-05-16 tags: - attack.execution - attack.stealth - attack.t1127 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \ilasm.exe - OriginalFileName: ilasm.exe selection_cli: CommandLine|contains: - ' /dll' - ' /exe' condition: all of selection_* falsepositives: - Unknown level: medium
Query: CWE for Inefficient Algorithmic Complexity
Matching passage: CWE-407 Inefficient Algorithmic Complexity. An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
Near-miss passage: CWE-1062 Parent Class with References to Child Class. The code has a parent class that contains references to a child class, its methods, or its members.
Query: risk of The xpinner-lite plugin through 2.2 for WordPress has wp-admin/options-general.php CSRF with resultant XSS.
Matching passage: CVE-2015-9408. CWE: CWE-352. CVSS: 6.5. The xpinner-lite plugin through 2.2 for WordPress has wp-admin/options-general.php CSRF with resultant XSS.
Near-miss passage: CVE-2015-0740. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Cisco Unified Intelligence Center 10.6(1) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCus28826.
Query: vulnerability: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in sumocoders FrameworkUserBundle up to 1.3.x. It has been rated as problematic. Affected by this issue is some unknown fu
Matching passage: CVE-2015-10012. CWE: CWE-209. CVSS: 7.5. ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in sumocoders FrameworkUserBundle up to 1.3.x. It has been rated as problematic. Affected by this issue is some unknown functionality of the file Resources/views/Security/login.html.twig. The manipulation leads to information exposure through error message. Upgrading to version 1.4.0 is able to address this issue. The name of the patch is abe4993390ba9bd7821ab12678270556645f94c8. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217268. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Near-miss passage: CVE-2015-7997. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the Nitro API in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 10.1 Build 133.9, 10.5 before Build 58.11, and 10.5.e before Build 56.1505.e on NetScaler Service Delivery Appliance Service VM (SVM) devices allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: EDR alert: possible Create Cloud Instance (T1578.002)
Matching passage: T1578.002 Create Cloud Instance. Tactics: defense impairment. Description: An adversary may create a new instance or virtual machine (VM) within the compute service of a cloud account to evade defenses. Creating a new instance may allow an adversary to bypass firewall rules and permissions that exist on instances currently residing within an account. An adversary may [Create Snapshot](https://attack.mitre.org/techniques/T1578/001) of one or more volumes in an account, create a new instance, mount the snapshots, and then apply a less restrictive security policy to collect [Data from Local System](https://attack.mitre.org/techniques/T1005) or for [Remote Data Staging](https://attack.mitre.org/techniques/T1074/002).(Citation: Mandiant M-Trends 2020) Creating a new instance may also allow an adversary to carry out malicious activity within an environment without affecting the execution of current running instances.
Near-miss passage: T1578 Modify Cloud Compute Infrastructure. Tactics: defense impairment. Description: An adversary may attempt to modify a cloud account's compute service infrastructure to evade defenses. A modification to the compute service infrastructure can include the creation, deletion, or modification of one or more components such as compute instances, virtual machines, and snapshots. Permissions gained from the modification of infrastructure components may bypass restrictions that prevent access to existing infrastructure. Modifying infrastructure components may also allow an adversary to evade detection and remove evidence of their presence.(Citation: Mandiant M-Trends 2020)
Query: vulnerability: The limit-attempts plugin before 1.1.1 for WordPress has SQL injection during IP address handling.
Matching passage: CVE-2015-9335. CWE: CWE-89. CVSS: 9.800000190734863. The limit-attempts plugin before 1.1.1 for WordPress has SQL injection during IP address handling.
Near-miss passage: CVE-2015-1476. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in xlinkerz ecommerceMajor allow remote attackers to execute arbitrary SQL commands via the (1) productbycat parameter to product.php, or (2) username or (3) password parameter to __admin/index.php.
Query: exploit The Mobile Identity parser in (1) epan/dissectors/packet-ansi_a.c in the ANSI A dissector and (2) epan/dissectors/packet-gsm_a_common.c in the GSM A dissector in Wireshark 1.12.x b
Matching passage: CVE-2015-8728. CWE: CWE-20. CVSS: 5.5. The Mobile Identity parser in (1) epan/dissectors/packet-ansi_a.c in the ANSI A dissector and (2) epan/dissectors/packet-gsm_a_common.c in the GSM A dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 improperly uses the tvb_bcd_dig_to_wmem_packet_str function, which allows remote attackers to cause a denial of service (buffer overflow and application crash) via a crafted packet.
Near-miss passage: CVE-2015-5254. CWE: CWE-20. CVSS: 9.800000190734863. Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.
Query: hunt for Hide Artifacts activity
Matching passage: T1564 Hide Artifacts. Tactics: stealth. Description: Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system. Adversaries may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity to evade detection.(Citation: Sofacy Komplex Trojan)(Citation: Cybereason OSX Pirrit)(Citation: MalwareBytes ADS July 2015) Adversaries may also attempt to hide artifacts associated with malicious behavior by creating computing regions that are isolated from common security instrumentation, such as through the use of virtualization technology.(Citation: Sophos Ragnar May 2020)
Near-miss passage: T1564.012 File/Path Exclusions. Tactics: stealth. Description: Adversaries may attempt to hide their file-based artifacts by writing them to specific folders or file names excluded from antivirus (AV) scanning and other defensive capabilities. AV and other file-based scanners often include exclusions to optimize performance as well as ease installation and legitimate use of applications. These exclusions may be contextual (e.g., scans are only initiated in response to specific triggering events/alerts), but are also often hardcoded strings referencing specific folders and/or files assumed to be trusted and legitimate.(Citation: Microsoft File Folder Exclusions) Adversaries may abuse these exclusions to hide their file-based artifacts. For example, rather than tampering with tool settings to add a new exclusion (i.e., [Disable or Modify Tools](https://attack.mitre.org/techniques/T1685)), adversaries may drop their file-based payloads in default or otherwise well-known exclusions. Adversaries may also use [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001) and other [Discovery](https://attack.mitre.org/tactics/TA0007)/[Reconnaissance](https://attack.mitre.org/tactics/TA0043) activities to both discover and verify existing exclusions in a victim environment.
Query: write Sigma for Detects the deletion of IIS WebServer access logs which may indicate an attempt to destroy forensic evidence
Matching passage: Sigma rule: Detects the deletion of IIS WebServer access logs which may indicate an attempt to destroy forensic evidence. Logsource: windows / file_delete. Rule: title: IIS WebServer Access Logs Deleted id: 3eb8c339-a765-48cc-a150-4364c04652bf related: - id: 0649be4a-aeb0-45b0-b89e-7f1668f6d9c0 type: similar status: test description: Detects the deletion of IIS WebServer access logs which may indicate an attempt to destroy forensic evidence references: - https://www.elastic.co/guide/en/security/current/webserver-access-logs-deleted.html author: Tim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-09-16 modified: 2023-02-15 tags: - attack.stealth - attack.t1070 logsource: category: file_delete product: windows detection: selection: TargetFilename|contains: \inetpub\logs\LogFiles\ TargetFilename|endswith: .log condition: selection falsepositives: - During uninstallation of the IIS service - During log rotation level: medium
Near-miss passage: Sigma rule: Identifies when a Virtual Network is modified or deleted in Azure.. Logsource: azure / activitylogs. Rule: title: Azure Virtual Network Modified or Deleted id: bcfcc962-0e4a-4fd9-84bb-a833e672df3f status: test description: Identifies when a Virtual Network is modified or deleted in Azure. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer @austinsonger date: 2021-08-08 modified: 2022-08-23 tags: - attack.impact logsource: product: azure service: activitylogs detection: selection: operationName|startswith: - MICROSOFT.NETWORK/VIRTUALNETWORKGATEWAYS/ - MICROSOFT.NETWORK/VIRTUALNETWORKS/ operationName|endswith: - /WRITE - /DELETE condition: selection falsepositives: - Virtual Network being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Virtual Network modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: vulnerability: Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file.
Matching passage: CVE-2015-0838. CWE: CWE-119. CVSS: 7.5. Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file.
Near-miss passage: CVE-2015-9156. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 615/16/SD 415, SD 617, SD 800, SD 808, and SD 810, when making a high speed Dual Carrier Downlink Data call in a multicell environment, a buffer overflow may occur.
Query: describe CVE-2015-4997
Matching passage: CVE-2015-4997. CWE: CWE-264. CVSS: 6.800000190734863. IBM WebSphere Portal 8.5.0 before CF08 allows remote attackers to bypass intended access restrictions via a crafted request.
Near-miss passage: CVE-2015-3270. CWE: CWE-264. CVSS: 6.5. Apache Ambari before 2.0.2 or 2.1.x before 2.1.1 allows remote authenticated users to gain administrative privileges via unspecified vectors, possibly related to changing passwords.