alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: Cross-site scripting (XSS) vulnerability in the form function in the WP_Nav_Menu_Widget class in wp-includes/default-widgets.php in WordPress before 4.2.4 allows remote attackers t
Matching passage: CVE-2015-5732. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the form function in the WP_Nav_Menu_Widget class in wp-includes/default-widgets.php in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via a widget title.
Near-miss passage: CVE-2015-4374. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Webform module before 6.x-3.23, 7.x-3.x before 7.x-3.23, and 7.x-4.x before 7.x-4.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a component name in the recipient (To) address of an email.
Query: rule covering Detects the use of IOX - a tool for port forwarding and intranet proxy purposes
Matching passage: Sigma rule: Detects the use of IOX - a tool for port forwarding and intranet proxy purposes. Logsource: windows / process_creation. Rule: title: PUA- IOX Tunneling Tool Execution id: d7654f02-e04b-4934-9838-65c46f187ebc status: test description: Detects the use of IOX - a tool for port forwarding and intranet proxy purposes references: - https://github.com/EddieIvan01/iox author: Florian Roth (Nextron Systems) date: 2022-10-08 modified: 2024-11-23 tags: - attack.command-and-control - attack.t1090 logsource: category: process_creation product: windows detection: selection: Image|endswith: \iox.exe selection_commandline: CommandLine|contains: - '.exe fwd -l ' - '.exe fwd -r ' - '.exe proxy -l ' - '.exe proxy -r ' selection_hashes: Hashes|contains: - MD5=9DB2D314DD3F704A02051EF5EA210993 - SHA1=039130337E28A6623ECF9A0A3DA7D92C5964D8DD - SHA256=C6CF82919B809967D9D90EA73772A8AA1C1EB3BC59252D977500F64F1A0D6731 condition: 1 of selection* falsepositives: - Legitimate use level: high
Near-miss passage: Sigma rule: Detects disabling security tools. Logsource: linux / process_creation. Rule: title: Disabling Security Tools id: e3a8a052-111f-4606-9aee-f28ebeb76776 status: test description: Detects disabling security tools references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md author: Ömer Günal, Alejandro Ortuno, oscd.community date: 2020-06-17 modified: 2022-10-09 tags: - attack.defense-impairment - attack.t1686 logsource: category: process_creation product: linux detection: selection_iptables_1: Image|endswith: /service CommandLine|contains|all: - iptables - stop selection_iptables_2: Image|endswith: /service CommandLine|contains|all: - ip6tables - stop selection_iptables_3: Image|endswith: /chkconfig CommandLine|contains|all: - iptables - stop selection_iptables_4: Image|endswith: /chkconfig CommandLine|contains|all: - ip6tables - stop selection_firewall_1: Image|endswith: /systemctl CommandLine|contains|all: - firewalld - stop selection_firewall_2: Image|endswith: /systemctl CommandLine|contains|all: - firewalld - disable selection_carbonblack_1: Image|endswith: /service CommandLine|contains|all: - cbdaemon - stop selection_carbonblack_2: Image|endswith: /chkconfig CommandLine|contains|all: - cbdaemon - 'off' selection_carbonblack_3: Image|endswith: /systemctl CommandLine|contains|all: - cbdaemon - stop selection_carbonblack_4: Image|endswith: /systemctl CommandLine|contains|all: - cbdaemon - disable selection_selinux: Image|endswith: /setenforce CommandLine|contains: '0' selection_crowdstrike_1: Image|endswith: /systemctl CommandLine|contains|all: - stop - falcon-sensor selection_crowdstrike_2: Image|endswith: /systemctl CommandLine|contains|all: - disable - falcon-sensor condition: 1 of selection* falsepositives: - Legitimate administration activities level: medium
Query: exploit The extractFrom function in Internals/QuotedString.cpp in Arduino JSON before 4.5 allows remote attackers to cause a denial of service (crash) via a JSON string with a \ (backslash
Matching passage: CVE-2015-4590. CWE: CWE-119. CVSS: 5.0. The extractFrom function in Internals/QuotedString.cpp in Arduino JSON before 4.5 allows remote attackers to cause a denial of service (crash) via a JSON string with a \ (backslash) followed by a terminator, as demonstrated by "\\\0", which triggers a buffer overflow and over-read.
Near-miss passage: CVE-2015-7497. CWE: CWE-119. CVSS: 5.0. Heap-based buffer overflow in the xmlDictComputeFastQKey function in dict.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service via unspecified vectors.
Query: detection rule: Detects calls to PowerShell with Invoke-WebRequest cmdlet using direct IP access
Matching passage: Sigma rule: Detects calls to PowerShell with Invoke-WebRequest cmdlet using direct IP access. Logsource: windows / process_creation. Rule: title: Suspicious Invoke-WebRequest Execution With DirectIP id: 1edff897-9146-48d2-9066-52e8d8f80a2f status: test description: Detects calls to PowerShell with Invoke-WebRequest cmdlet using direct IP access references: - https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-21 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell_ise.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - powershell_ise.EXE - PowerShell.EXE - pwsh.dll selection_commands: CommandLine|contains: - 'curl ' - Invoke-RestMethod - Invoke-WebRequest - ' irm ' - 'iwr ' - 'wget ' selection_ip: CommandLine|contains: - ://1 - ://2 - ://3 - ://4 - ://5 - ://6 - ://7 - ://8 - ://9 condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters. Logsource: windows / process_creation. Rule: title: PUA - Seatbelt Execution id: 38646daa-e78f-4ace-9de0-55547b2d30da status: test description: Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters references: - https://github.com/GhostPack/Seatbelt - https://www.bluetangle.dev/2022/08/fastening-seatbelt-on-threat-hunting.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-18 modified: 2023-02-04 tags: - attack.discovery - attack.t1526 - attack.t1087 - attack.t1083 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \Seatbelt.exe - OriginalFileName: Seatbelt.exe - Description: Seatbelt - CommandLine|contains: - ' DpapiMasterKeys' - ' InterestingProcesses' - ' InterestingFiles' - ' CertificateThumbprints' - ' ChromiumBookmarks' - ' ChromiumHistory' - ' ChromiumPresence' - ' CloudCredentials' - ' CredEnum' - ' CredGuard' - ' FirefoxHistory' - ' ProcessCreationEvents' selection_group_list: CommandLine|contains: - ' -group=misc' - ' -group=remote' - ' -group=chromium' - ' -group=slack' - ' -group=system' - ' -group=user' - ' -group=all' selection_group_output: CommandLine|contains: ' -outputfile=' condition: selection_img or all of selection_group_* falsepositives: - Unlikely level: high
Query: risk of HP Virtual Connect Enterprise Manager (VCEM) SDK before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote attackers to obtain sensiti
Matching passage: CVE-2015-5432. CWE: UNKNOWN. CVSS: 7.5. HP Virtual Connect Enterprise Manager (VCEM) SDK before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote attackers to obtain sensitive information or modify data via unspecified vectors.
Near-miss passage: CVE-2015-2264. CWE: UNKNOWN. CVSS: 6.900000095367432. Multiple untrusted search path vulnerabilities in (1) EQATEC.Analytics.Monitor.Win32_vc100.dll and (2) EQATEC.Analytics.Monitor.Win32_vc100-x64.dll in Telerik Analytics Monitor Library before 3.2.125 allow local users to gain privileges via a Trojan horse (a) csunsapi.dll, (b) swift.dll, (c) nfhwcrhk.dll, or (d) surewarehook.dll file in an unspecified directory.
Query: exploit The uuencode inspection engine in Cisco AsyncOS on Cisco Email Security Appliance (ESA) devices 8.5 and earlier allows remote attackers to bypass intended content restrictions via 
Matching passage: CVE-2015-0605. CWE: CWE-264. CVSS: 4.300000190734863. The uuencode inspection engine in Cisco AsyncOS on Cisco Email Security Appliance (ESA) devices 8.5 and earlier allows remote attackers to bypass intended content restrictions via a crafted e-mail attachment with uuencode encoding, aka Bug ID CSCzv54343.
Near-miss passage: CVE-2015-7809. CWE: CWE-264. CVSS: 6.800000190734863. The displayBlock function Template.php in Sensio Labs Twig before 1.20.0, when Sandbox mode is enabled, allows remote attackers to execute arbitrary code via the _self variable in a template.
Query: vulnerability: Microsoft Internet Explorer 8 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability."
Matching passage: CVE-2015-0051. CWE: CWE-264. CVSS: 4.300000190734863. Microsoft Internet Explorer 8 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability."
Near-miss passage: CVE-2015-5645. CWE: CWE-264. CVSS: 6.5. ICZ MATCHA SNS before 1.3.7 allows remote authenticated users to obtain administrative privileges via unspecified vectors.
Query: vulnerability: Race condition in the setreuid system-call implementation in the kernel in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 allows attackers to cause a deni
Matching passage: CVE-2015-1099. CWE: CWE-362. CVSS: 4.0. Race condition in the setreuid system-call implementation in the kernel in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 allows attackers to cause a denial of service via a crafted app.
Near-miss passage: CVE-2015-7990. CWE: CWE-362. CVSS: 5.800000190734863. Race condition in the rds_sendmsg function in net/rds/sendmsg.c in the Linux kernel before 4.3.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by using a socket that was not properly bound. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6937.
Query: write Sigma for Detects suspicious Kerberos TGT requests with pre-authentication disabled (Pre-Authentication Type = 0) and Ticket Encry
Matching passage: Sigma rule: Detects suspicious Kerberos TGT requests with pre-authentication disabled (Pre-Authentication Type = 0) and Ticket Encry. Logsource: windows / security. Rule: title: Potential AS-REP Roasting via Kerberos TGT Requests id: 3e2f1b2c-4d5e-11ee-be56-0242ac120002 status: experimental description: 'Detects suspicious Kerberos TGT requests with pre-authentication disabled (Pre-Authentication Type = 0) and Ticket Encryption Type (0x17) i.e, RC4-HMAC. This may indicate an AS-REP Roasting attack, where attackers request AS-REP messages for accounts without pre-authentication and attempt to crack the encrypted ticket offline to recover user passwords. ' references: - https://medium.com/system-weakness/detecting-as-rep-roasting-attacks-b5b3965f9714 - https://www.picussecurity.com/resource/blog/as-rep-roasting-attack-explained-mitre-attack-t1558.004 author: ANosir date: 2025-05-22 modified: 2025-07-04 logsource: product: windows service: security detection: selection: EventID: 4768 TicketEncryptionType: '0x17' ServiceName: krbtgt PreAuthType: 0 condition: selection falsepositives: - Legacy systems or applications that legitimately use RC4 encryption - Misconfigured accounts with pre-authentication disabled level: medium
Near-miss passage: Sigma rule: Detects when a Microsoft Cloud App Security reported a risky sign-in attempt due to a login associated with an impossibl. Logsource: m365 / threat_management. Rule: title: Microsoft 365 - Impossible Travel Activity id: d7eab125-5f94-43df-8710-795b80fa1189 status: test description: Detects when a Microsoft Cloud App Security reported a risky sign-in attempt due to a login associated with an impossible travel. references: - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference author: Austin Songer @austinsonger date: 2020-07-06 modified: 2021-11-27 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078 logsource: service: threat_management product: m365 detection: selection: eventSource: SecurityComplianceCenter eventName: Impossible travel activity status: success condition: selection falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-9101
Matching passage: CVE-2015-9101. CWE: CWE-119. CVSS: 5.5. The fill_buffer_resample function in util.c in libmp3lame.a in LAME 3.98.4, 3.98.2, 3.98, 3.99, 3.99.1, 3.99.2, 3.99.3, 3.99.4 and 3.99.5 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted audio file.
Near-miss passage: CVE-2015-2451. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2450.
Query: detect Threat Intel Vendors
Matching passage: T1597.001 Threat Intel Vendors. Tactics: reconnaissance. Description: Adversaries may search private data from threat intelligence vendors for information that can be used during targeting. Threat intelligence vendors may offer paid feeds or portals that offer more data than what is publicly reported. Although sensitive details (such as customer names and other identifiers) may be redacted, this information may contain trends regarding breaches such as target industries, attribution claims, and successful TTPs/countermeasures.(Citation: D3Secutrity CTI Feeds) Adversaries may search in private threat intelligence vendor data to gather actionable information. If a threat actor is searching for information on their own activities, that falls under [Search Threat Vendor Data](https://attack.mitre.org/techniques/T1681). Information reported by vendors may also reveal opportunities other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190) or [External Remote Services](https://attack.mitre.org/techniques/T1133)).
Near-miss passage: T1597.002 Purchase Technical Data. Tactics: reconnaissance. Description: Adversaries may purchase technical information about victims that can be used during targeting. Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets. Adversaries may purchase information about their already identified targets, or use purchased data to discover opportunities for successful breaches. Threat actors may gather various technical details from purchased data, including but not limited to employee contact information, credentials, or specifics regarding a victim’s infrastructure.(Citation: ZDNET Selling Data) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).
Query: CVE similar to CVE-2015-7063
Matching passage: CVE-2015-7063. CWE: CWE-264. CVSS: 7.199999809265137. The kernel loader in EFI in Apple OS X before 10.11.2 allows local users to gain privileges via a crafted pathname.
Near-miss passage: CVE-2015-4331. CWE: CWE-264. CVSS: 3.5. Cisco Prime Infrastructure (PI) 1.4(0.45) and earlier, when AAA authentication is used, allows remote authenticated users to bypass intended access restrictions via a username with a modified composition of lowercase and uppercase characters, aka Bug ID CSum59958.
Query: common weakness: Reliance on Security Through Obscurity
Matching passage: CWE-656 Reliance on Security Through Obscurity. The product uses a protection mechanism whose strength depends heavily on its obscurity, such that knowledge of its algorithms or key data is sufficient to defeat the mechanism.
Near-miss passage: CWE-393 Return of Wrong Status Code. A function or operation returns an incorrect return value or status code that does not indicate the true result of execution, causing the product to modify its behavior based on the incorrect result.
Query: write Sigma for Detects external disk drives or plugged-in USB devices.
Matching passage: Sigma rule: Detects external disk drives or plugged-in USB devices.. Logsource: windows / security. Rule: title: External Disk Drive Or USB Storage Device Was Recognized By The System id: f69a87ea-955e-4fb4-adb2-bb9fd6685632 status: test description: Detects external disk drives or plugged-in USB devices. references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6416 author: Keith Wright date: 2019-11-20 modified: 2024-02-09 tags: - attack.t1091 - attack.t1200 - attack.lateral-movement - attack.initial-access logsource: product: windows service: security detection: selection_eid: EventID: 6416 selection_field: - ClassName: DiskDrive - DeviceDescription: USB Mass Storage Device condition: all of selection_* falsepositives: - Likely level: low
Near-miss passage: Sigma rule: Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell.. Logsource: linux / process_creation. Rule: title: OMIGOD SCX RunAsProvider ExecuteScript id: 6eea1bf6-f8d2-488a-a742-e6ef6c1b67db status: test description: 'Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell. Script being executed gets created as a temp file in /tmp folder with a scx* prefix. Then it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/. The file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite. ' references: - https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure - https://github.com/Azure/Azure-Sentinel/pull/3059 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC date: 2021-10-15 modified: 2022-10-05 tags: - attack.privilege-escalation - attack.initial-access - attack.execution - attack.t1068 - attack.t1190 - attack.t1203 logsource: product: linux category: process_creation detection: selection: User: root LogonId: 0 CurrentDirectory: /var/opt/microsoft/scx/tmp CommandLine|contains: /etc/opt/microsoft/scx/conf/tmpdir/scx condition: selection falsepositives: - Legitimate use of SCX RunAsProvider ExecuteScript. level: high
Query: risk of Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP commands via CRLF sequences in an (1) email address to the validateAddre
Matching passage: CVE-2015-8476. CWE: CWE-20. CVSS: 5.0. Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP commands via CRLF sequences in an (1) email address to the validateAddress function in class.phpmailer.php or (2) SMTP command to the sendCommand function in class.smtp.php, a different vulnerability than CVE-2012-0796.
Near-miss passage: CVE-2015-2245. CWE: CWE-20. CVSS: 7.5. Huawei Ascend P7 allows remote attackers to cause a denial of service (phone process crash).
Query: SOC runbook when seeing Suspicious Cron execution detected on endpoint
Matching passage: Playbook for T1053.003 Cron. 1) Validate alert telemetry against T1053.003. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: execution, persistence, privilege escalation. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code.(Citation: 20 macOS Common Tools and Techniques) The <code>cron</code> utility is a time-based job scheduler for Unix-like operating systems. The <code> crontab</code> file contains the schedule of cron entries to be run and the specified times for execution. Any <cod
Near-miss passage: Playbook for T1053.002 At. Different response path focused on execution, persistence, privilege escalation.
Query: campaign using Web Portal Capture
Matching passage: T1056.003 Web Portal Capture. Tactics: collection, credential access. Description: Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service. This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through [External Remote Services](https://attack.mitre.org/techniques/T1133) and [Valid Accounts](https://attack.mitre.org/techniques/T1078) or as part of the initial compromise by exploitation of the externally facing web service.(Citation: Volexity Virtual Private Keylogging)
Near-miss passage: T1056.004 Credential API Hooking. Tactics: collection, credential access. Description: Adversaries may hook into Windows application programming interface (API) functions and Linux system functions to collect user credentials. Malicious hooking mechanisms may capture API or function calls that include parameters that reveal user authentication credentials.(Citation: Microsoft TrojanSpy:Win32/Ursnif.gen!I Sept 2017) Unlike [Keylogging](https://attack.mitre.org/techniques/T1056/001), this technique focuses specifically on API functions that include parameters that reveal user credentials. In Windows, hooking involves redirecting calls to these functions and can be implemented via: * **Hooks procedures**, which intercept and execute designated code in response to events such as messages, keystrokes, and mouse inputs.(Citation: Microsoft Hook Overview)(Citation: Elastic Process Injection July 2017) * **Import address table (IAT) hooking**, which use modifications to a process’s IAT, where pointers to imported API functions are stored.(Citation: Elastic Process Injection July 2017)(Citation: Adlice Software IAT Hooks Oct 2014)(Citation: MWRInfoSecurity Dynamic Hooking 2015) * **Inline hooking**, which overwrites the first bytes in an API function to redirect code flow.(Citation: Elastic Process Injection July 2017)(Citation: HighTech Bridge Inline Hooking Sept 2011)(Citation: MWRInfoSecurity Dynamic Hooking 2015) In Linux and macOS, adversaries may hook into system functions via the `LD_PRELOAD` (Linux) or `DYLD_INSERT_LIBRARIES` (macOS) environment variables, which enables loading shared libraries into a program’s address space. For example, an adversary may capture credentials by hooking into the `libc read` function leveraged by SSH or SCP.(Citation: Intezer Symbiote 2022)