alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: CVE similar to CVE-2015-8759
Matching passage: CVE-2015-8759. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in the typoLink function in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote authenticated editors to inject arbitrary web script or HTML via a link field.
Near-miss passage: CVE-2015-0265. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the Policy Admin Tool in Apache Ranger before 0.5.0 allows remote attackers to inject arbitrary web script or HTML via the HTTP User-Agent header.
Query: detection rule: Detects the execution of an AnyDesk binary with a version prior to 8.0.8. Prior to version 8.0.8, the Anydesk applicatio
Matching passage: Sigma rule: Detects the execution of an AnyDesk binary with a version prior to 8.0.8. Prior to version 8.0.8, the Anydesk applicatio. Logsource: windows / process_creation. Rule: title: Remote Access Tool - AnyDesk Execution With Known Revoked Signing Certificate id: 41f407b5-3096-44ea-a74f-96d04fbc41be status: test description: 'Detects the execution of an AnyDesk binary with a version prior to 8.0.8. Prior to version 8.0.8, the Anydesk application used a signing certificate that got compromised by threat actors. Use this rule to detect instances of older versions of Anydesk using the compromised certificate This is recommended in order to avoid attackers leveraging the certificate and signing their binaries to bypass detections. ' references: - https://www.bleepingcomputer.com/news/security/anydesk-says-hackers-breached-its-production-servers-reset-passwords/ - https://anydesk.com/en/changelog/windows author: Sai Prashanth Pulisetti, Nasreddine Bencherchali (Nextron Systems) date: 2024-02-08 tags: - attack.execution - attack.initial-access logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \AnyDesk.exe - Description: AnyDesk - Product: AnyDesk - Company: AnyDesk Software GmbH selection_version: FileVersion|startswith: - 7.0. - 7.1. - 8.0.1 - 8.0.2 - 8.0.3 - 8.0.4 - 8.0.5 - 8.0.6 - 8.0.7 filter_main_uninstall: CommandLine|contains: - ' --remove' - ' --uninstall' condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unlikely level: medium
Near-miss passage: Sigma rule: Detects loading of "Amsi.dll" by a living of the land process. This could be an indication of a "PowerShell without Powe. Logsource: windows / image_load. Rule: title: Amsi.DLL Loaded Via LOLBIN Process id: 6ec86d9e-912e-4726-91a2-209359b999b9 status: test description: Detects loading of "Amsi.dll" by a living of the land process. This could be an indication of a "PowerShell without PowerShell" attack references: - Internal Research - https://www.paloaltonetworks.com/blog/security-operations/stopping-powershell-without-powershell/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-01 modified: 2025-10-07 tags: - attack.defense-impairment logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \amsi.dll Image|endswith: - \ExtExport.exe - \odbcconf.exe - \rundll32.exe condition: selection falsepositives: - Unknown level: medium
Query: exploit Directory traversal vulnerability in D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 allows remote attackers to read sensitive information via a .. (dot dot)
Matching passage: CVE-2015-7245. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 allows remote attackers to read sensitive information via a .. (dot dot) in the errorpage parameter.
Near-miss passage: CVE-2015-0878. CWE: CWE-22. CVSS: 5.800000190734863. Directory traversal vulnerability in CREAR AL-Mail32 before 1.13d allows remote attackers to write to arbitrary files via a crafted filename of an attachment.
Query: CVE similar to CVE-2015-4291
Matching passage: CVE-2015-4291. CWE: CWE-399. CVSS: 7.800000190734863. Cisco IOS XE 2.x before 2.4.3 and 2.5.x before 2.5.1 on ASR 1000 devices allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted series of fragmented (1) IPv4 or (2) IPv6 packets, aka Bug ID CSCtd72617.
Near-miss passage: CVE-2015-7944. CWE: CWE-399. CVSS: 7.5. The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.12.6, 2.13.x before 2.13.3, 2.14.x before 2.14.2, and 2.15.x before 2.15.2, when used in SSL mode, allows remote attackers to cause a denial of service (resource consumption) via SSL parameter renegotiation.
Query: detection rule: This the exploitation of a NTFS vulnerability as reported without many details via Twitter
Matching passage: Sigma rule: This the exploitation of a NTFS vulnerability as reported without many details via Twitter. Logsource: windows / system. Rule: title: NTFS Vulnerability Exploitation id: f14719ce-d3ab-4e25-9ce6-2899092260b0 status: test description: This the exploitation of a NTFS vulnerability as reported without many details via Twitter references: - https://twitter.com/jonasLyk/status/1347900440000811010 - https://twitter.com/wdormann/status/1347958161609809921 - https://www.bleepingcomputer.com/news/security/windows-10-bug-corrupts-your-hard-drive-on-seeing-this-files-icon/ author: Florian Roth (Nextron Systems) date: 2021-01-11 modified: 2022-12-25 tags: - attack.impact - attack.t1499.001 logsource: product: windows service: system detection: selection: Provider_Name: Ntfs EventID: 55 Origin: File System Driver Description|contains|all: - contains a corrupted file record - The name of the file is "\" condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the addition of the "Debugger" value to the "DbgManagedDebugger" key in order to achieve persistence. Which will. Logsource: windows / registry_set. Rule: title: Potential Registry Persistence Attempt Via DbgManagedDebugger id: 9827ae57-3802-418f-994b-d5ecf5cd974b status: test description: Detects the addition of the "Debugger" value to the "DbgManagedDebugger" key in order to achieve persistence. Which will get invoked when an application crashes references: - https://www.hexacorn.com/blog/2013/09/19/beyond-good-ol-run-key-part-4/ - https://github.com/last-byte/PersistenceSniper author: frack113 date: 2022-08-07 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Microsoft\.NETFramework\DbgManagedDebugger filter: Details: '"C:\Windows\system32\vsjitdebugger.exe" PID %d APPDOM %d EXTEXT "%s" EVTHDL %d' condition: selection and not filter falsepositives: - Legitimate use of the key to setup a debugger. Which is often the case on developers machines level: medium
Query: threat report mentioning Remote Access Hardware
Matching passage: T1219.003 Remote Access Hardware. Tactics: command and control. Description: An adversary may use legitimate remote access hardware to establish an interactive command and control channel to target systems within networks. These services, including IP-based keyboard, video, or mouse (KVM) devices such as TinyPilot and PiKVM, are commonly used as legitimate tools and may be allowed by peripheral device policies within a target environment. Remote access hardware may be physically installed and used post-compromise as an alternate communications channel for redundant access or as a way to establish an interactive remote session with the target system. Using hardware-based remote access tools may allow threat actors to bypass software security solutions and gain more control over the compromised device(s).(Citation: Palo Alto Unit 42 North Korean IT Workers 2024)(Citation: Google Cloud Threat Intelligence DPRK IT Workers 2024)
Near-miss passage: T1219 Remote Access Tools. Tactics: command and control. Description: An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy) Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access. Remote access tools may be installed and used post-compromise as an alternate communications channel for redundant access or to establish an interactive remote desktop session with the target system. It may also be used as a malware component to establish a reverse connection or back-connect to a service or adversary-controlled system. Installation of many remote access tools may also include persistence (e.g., the software's installation routine creates a [Windows Service](https://attack.mitre.org/techniques/T1543/003)). Remote access modules/features may also exist as part of otherwise existing software (e.g., Google Chrome’s Remote Desktop).(Citation: Google Chrome Remote Desktop)(Citation: Chrome Remote Desktop)
Query: vulnerability: The em_sysenter function in arch/x86/kvm/emulate.c in the Linux kernel before 3.18.5, when the guest OS lacks SYSENTER MSR initialization, allows guest OS users to gain guest OS pr
Matching passage: CVE-2015-0239. CWE: CWE-269. CVSS: 4.400000095367432. The em_sysenter function in arch/x86/kvm/emulate.c in the Linux kernel before 3.18.5, when the guest OS lacks SYSENTER MSR initialization, allows guest OS users to gain guest OS privileges or cause a denial of service (guest OS crash) by triggering use of a 16-bit code segment for emulation of a SYSENTER instruction.
Near-miss passage: CVE-2015-5071. CWE: CWE-269. CVSS: 6.5. AR System Mid Tier in the AR System Mid Tier component before 9.0 SP1 for BMC Remedy AR System Server allows remote authenticated users to "navigate" to arbitrary files via the __report parameter of the BIRT viewer servlet.
Query: exploit The do_free_upto function in crypto/cms/cms_smime.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a 
Matching passage: CVE-2015-1792. CWE: CWE-399. CVSS: 5.0. The do_free_upto function in crypto/cms/cms_smime.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (infinite loop) via vectors that trigger a NULL value of a BIO data structure, as demonstrated by an unrecognized X.660 OID for a hash function.
Near-miss passage: CVE-2015-6332. CWE: CWE-399. CVSS: 5.0. Cisco Prime Infrastructure 2.2 allows remote attackers to cause a denial of service (daemon hang) by sending many SSL renegotiation requests, aka Bug ID CSCuv56830.
Query: detection rule: Detects suspicious sysprep process start with AppData folder as target (as used by Trojan Syndicasec in Thrip report by
Matching passage: Sigma rule: Detects suspicious sysprep process start with AppData folder as target (as used by Trojan Syndicasec in Thrip report by. Logsource: windows / process_creation. Rule: title: Sysprep on AppData Folder id: d5b9ae7a-e6fc-405e-80ff-2ff9dcc64e7e status: test description: Detects suspicious sysprep process start with AppData folder as target (as used by Trojan Syndicasec in Thrip report by Symantec) references: - https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets - https://app.any.run/tasks/61a296bb-81ad-4fee-955f-3b399f4aaf4b author: Florian Roth (Nextron Systems) date: 2018-06-22 modified: 2021-11-27 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection: Image|endswith: \sysprep.exe CommandLine|contains: \AppData\ condition: selection falsepositives: - False positives depend on scripts and administrative tools used in the monitored environment level: medium
Near-miss passage: Sigma rule: Detects when a user creates action secret for the organization, environment, codespaces or repository.. Logsource: github / audit. Rule: title: Github New Secret Created id: f9405037-bc97-4eb7-baba-167dad399b83 status: test description: Detects when a user creates action secret for the organization, environment, codespaces or repository. author: Muhammad Faisal (@faisalusuf) date: 2023-01-20 references: - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#audit-log-actions tags: - attack.persistence - attack.privilege-escalation - attack.initial-access - attack.stealth - attack.t1078.004 logsource: product: github service: audit definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming' detection: selection: action: - codespaces.create_an_org_secret - environment.create_actions_secret - org.create_actions_secret - repo.create_actions_secret condition: selection falsepositives: - This detection cloud be noisy depending on the environment. It is recommended to keep a check on the new secrets when created and validate the "actor". level: low
Query: vulnerability: The Local Packet Transport Services (LPTS) implementation in Cisco IOS XR 5.1.2, 5.1.3, 5.2.1, and 5.2.2 on ASR9k devices makes incorrect decisions about the opening of TCP and UDP
Matching passage: CVE-2015-4285. CWE: CWE-399. CVSS: 5.0. The Local Packet Transport Services (LPTS) implementation in Cisco IOS XR 5.1.2, 5.1.3, 5.2.1, and 5.2.2 on ASR9k devices makes incorrect decisions about the opening of TCP and UDP ports during the processing of flow base entries, which allows remote attackers to cause a denial of service (resource consumption) by sending traffic to these ports continuously, aka Bug ID CSCur88273.
Near-miss passage: CVE-2015-0046. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0038 and CVE-2015-0042.
Query: exploit Stack-based buffer overflow in the *printf function implementations in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.
Matching passage: CVE-2015-0242. CWE: CWE-787. CVSS: 8.800000190734863. Stack-based buffer overflow in the *printf function implementations in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1, when running on a Windows system, allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a floating point number with a large precision, as demonstrated by using the to_char function.
Near-miss passage: CVE-2015-5628. CWE: CWE-787. CVSS: 9.800000190734863. Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry R3.09.50 and earlier, CENTUM VP R5.04.20 and earlier, CENTUM VP Entry R5.04.20 and earlier, ProSafe-RS R3.02.10 and earlier, Exaopc R3.72.00 and earlier, Exaquantum R2.85.00 and earlier, Exaquantum/Batch R2.50.30 and earlier, Exapilot R3.96.10 and earlier, Exaplog R3.40.00 and earlier, Exasmoc R4.03.20 and earlier, Exarqe R4.03.20 and earlier, Field Wireless Device OPC Server R2.01.02 and earlier, PRM R3.12.00 and earlier, STARDOM VDS R7.30.01 and earlier, STARDOM OPC Server for Windows R3.40 and earlier, FAST/TOOLS R10.01 and earlier, B/M9000CS R5.05.01 and earlier, B/M9000 VP R7.03.04 and earlier, and FieldMate R1.01 or R1.02 allows remote attackers to execute arbitrary code via a crafted packet.
Query: describe CVE-2015-5215
Matching passage: CVE-2015-5215. CWE: CWE-79. CVSS: 6.099999904632568. The default configuration of the Jinja templating engine used in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not enable auto-escaping, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via template variables. NOTE: This may be a duplicate of CVE-2015-5216. Moreover, the Jinja development team does not enable auto-escape by default for performance issues as explained in https://jinja.palletsprojects.com/en/master/faq/#why-is-autoescaping-not-the-default.
Near-miss passage: CVE-2015-9403. CWE: CWE-79. CVSS: 6.099999904632568. The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_location XSS.
Query: detect Detects execution of regsvr32 where the DLL is located in a highly suspicious locations in logs
Matching passage: Sigma rule: Detects execution of regsvr32 where the DLL is located in a highly suspicious locations. Logsource: windows / process_creation. Rule: title: Regsvr32 Execution From Highly Suspicious Location id: 327ff235-94eb-4f06-b9de-aaee571324be status: test description: Detects execution of regsvr32 where the DLL is located in a highly suspicious locations references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-26 tags: - attack.stealth - attack.t1218.010 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \regsvr32.exe - OriginalFileName: REGSVR32.EXE selection_path_1: CommandLine|contains: - :\PerfLogs\ - :\Temp\ - \Windows\Registration\CRMLog - \Windows\System32\com\dmp\ - \Windows\System32\FxsTmp\ - \Windows\System32\Microsoft\Crypto\RSA\MachineKeys\ - \Windows\System32\spool\drivers\color\ - \Windows\System32\spool\PRINTERS\ - \Windows\System32\spool\SERVERS\ - \Windows\System32\Tasks_Migrated\ - \Windows\System32\Tasks\Microsoft\Windows\SyncCenter\ - \Windows\SysWOW64\com\dmp\ - \Windows\SysWOW64\FxsTmp\ - \Windows\SysWOW64\Tasks\Microsoft\Windows\PLA\System\ - \Windows\SysWOW64\Tasks\Microsoft\Windows\SyncCenter\ - \Windows\Tasks\ - \Windows\Tracing\ selection_path_2: CommandLine|contains: - ' "C:\' - ' C:\' - ' ''C:\' - D:\ selection_exclude_known_dirs: CommandLine|contains: - C:\Program Files (x86)\ - C:\Program Files\ - C:\ProgramData\ - C:\Users\ - ' C:\Windows\' - ' "C:\Windows\' - ' ''C:\Windows\' filter_main_empty: CommandLine: '' filter_main_null: CommandLine: null condition: selection_img and (selection_path_1 or (selection_path_2 and not selection_exclude_known_dirs)) and not 1 of filter_main_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects PowerShell script execution via input stream redirect. Logsource: windows / process_creation. Rule: title: Run PowerShell Script from Redirected Input Stream id: c83bf4b5-cdf0-437c-90fa-43d734f7c476 status: test description: Detects PowerShell script execution via input stream redirect references: - https://github.com/LOLBAS-Project/LOLBAS/blob/4db780e0f0b2e2bb8cb1fa13e09196da9b9f1834/yml/LOLUtilz/OSBinaries/Powershell.yml - https://twitter.com/Moriarty_Meng/status/984380793383370752 author: Moriarty Meng (idea), Anton Kutepov (rule), oscd.community date: 2020-10-17 modified: 2021-11-27 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|re: \s-\s*< condition: selection falsepositives: - Unknown level: high
Query: write Sigma for Transferring files with well-known filenames (sensitive files with credential data) using network shares
Matching passage: Sigma rule: Transferring files with well-known filenames (sensitive files with credential data) using network shares. Logsource: zeek / smb_files. Rule: title: Transferring Files with Credential Data via Network Shares - Zeek id: 2e69f167-47b5-4ae7-a390-47764529eff5 related: - id: 910ab938-668b-401b-b08c-b596e80fdca5 type: similar status: test description: Transferring files with well-known filenames (sensitive files with credential data) using network shares references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment author: '@neu5ron, Teymur Kheirkhabarov, oscd.community' date: 2020-04-02 modified: 2021-11-27 tags: - attack.credential-access - attack.t1003.002 - attack.t1003.001 - attack.t1003.003 logsource: product: zeek service: smb_files detection: selection: name: - \mimidrv - \lsass - \windows\minidump\ - \hiberfil - \sqldmpr - \sam - \ntds.dit - \security condition: selection falsepositives: - Transferring sensitive files for legitimate administration work by legitimate administrator level: medium
Near-miss passage: Sigma rule: Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detec. Logsource: linux / process_creation. Rule: title: Scheduled Cron Task/Job - Linux id: 6b14bac8-3e3a-4324-8109-42f0546a347f status: test description: Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.003/T1053.003.md author: Alejandro Ortuno, oscd.community date: 2020-10-06 modified: 2022-11-27 tags: - attack.execution - attack.persistence - attack.privilege-escalation - attack.t1053.003 logsource: category: process_creation product: linux detection: selection: Image|endswith: crontab CommandLine|contains: /tmp/ condition: selection falsepositives: - Legitimate administration activities level: medium