alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: The Qpid server on Red Hat Satellite 6 does not properly restrict message types, which allows remote authenticated users with administrative access on a managed content host to exe
Matching passage: CVE-2015-5164. CWE: CWE-502. CVSS: 7.199999809265137. The Qpid server on Red Hat Satellite 6 does not properly restrict message types, which allows remote authenticated users with administrative access on a managed content host to execute arbitrary code via a crafted message, related to a pickle processing problem in pulp.
Near-miss passage: CVE-2015-8103. CWE: CWE-502. CVSS: 9.800000190734863. The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy variant in 'ysoserial'".
Query: rule covering Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55)
Matching passage: Sigma rule: Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55). Logsource: windows / file_event. Rule: title: UAC Bypass Using MSConfig Token Modification - File id: 41bb431f-56d8-4691-bb56-ed34e390906f status: test description: Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-30 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: file_event product: windows detection: selection: TargetFilename|startswith: C:\Users\ TargetFilename|endswith: \AppData\Local\Temp\pkgmgr.exe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious process command line that starts with a shell that executes something and finally gets piped into ano. Logsource: linux / process_creation. Rule: title: Linux Shell Pipe to Shell id: 880973f3-9708-491c-a77b-2a35a1921158 status: test description: Detects suspicious process command line that starts with a shell that executes something and finally gets piped into another shell references: - Internal Research author: Florian Roth (Nextron Systems) date: 2022-03-14 modified: 2022-07-26 tags: - attack.stealth - attack.t1140 logsource: product: linux category: process_creation detection: selection: CommandLine|startswith: - 'sh -c ' - 'bash -c ' selection_exec: - CommandLine|contains: - '| bash ' - '| sh ' - '|bash ' - '|sh ' - CommandLine|endswith: - '| bash' - '| sh' - '|bash' - ' |sh' condition: all of selection* falsepositives: - Legitimate software that uses these patterns level: medium
Query: CVE similar to CVE-2015-2858
Matching passage: CVE-2015-2858. CWE: UNKNOWN. CVSS: 7.5. Datalex airline booking software before 2015-09-03 allows remote attackers to read or write to arbitrary user data via a modified profileId parameter to (1) ValidateFormAction.do or (2) ProfileConfirmEditAddressAction.do.
Near-miss passage: CVE-2015-0250. CWE: UNKNOWN. CVSS: 6.400000095367432. XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.
Query: CVE similar to CVE-2015-3420
Matching passage: CVE-2015-3420. CWE: CWE-295. CVSS: 5.900000095367432. The ssl-proxy-openssl.c function in Dovecot before 2.2.17, when SSLv3 is disabled, allow remote attackers to cause a denial of service (login process crash) via vectors related to handshake failures.
Near-miss passage: CVE-2015-0210. CWE: CWE-295. CVSS: 5.900000095367432. wpa_supplicant 2.0-16 does not properly check certificate subject name, which allows remote attackers to cause a man-in-the-middle attack.
Query: risk of The feed-them-social plugin before 1.7.0 for WordPress has possible shortcode execution in the Facebook Feeds load more button.
Matching passage: CVE-2015-9351. CWE: CWE-20. CVSS: 9.800000190734863. The feed-them-social plugin before 1.7.0 for WordPress has possible shortcode execution in the Facebook Feeds load more button.
Near-miss passage: CVE-2015-6243. CWE: CWE-20. CVSS: 4.300000190734863. The dissector-table implementation in epan/packet.c in Wireshark 1.12.x before 1.12.7 mishandles table searches for empty strings, which allows remote attackers to cause a denial of service (application crash) via a crafted packet, related to the (1) dissector_get_string_handle and (2) dissector_get_default_string_handle functions.
Query: vulnerability: WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of se
Matching passage: CVE-2015-3739. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Near-miss passage: CVE-2015-6949. CWE: CWE-119. CVSS: 9.300000190734863. Stack-based buffer overflow in the ASUS TM-AC1900 router allows remote attackers to execute arbitrary code via crafted HTTP header values.
Query: weakness Missing Authentication for Critical Function
Matching passage: CWE-306 Missing Authentication for Critical Function. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Near-miss passage: CWE-468 Incorrect Pointer Scaling. In C and C++, one may often accidentally refer to the wrong memory due to the semantics of when math operations are implicitly scaled.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the execution of AdvancedRun utility in the context of the TrustedInstaller, SYSTEM, Local Service or Network Se. Logsource: windows / process_creation. Rule: title: PUA - AdvancedRun Suspicious Execution id: fa00b701-44c6-4679-994d-5a18afa8a707 related: - id: d2b749ee-4225-417e-b20e-a8d2193cbb84 type: similar status: test description: Detects the execution of AdvancedRun utility in the context of the TrustedInstaller, SYSTEM, Local Service or Network Service accounts references: - https://twitter.com/splinter_code/status/1483815103279603714 - https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3 - https://www.elastic.co/security-labs/operation-bleeding-bear - https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/ author: Florian Roth (Nextron Systems) date: 2022-01-20 modified: 2023-02-21 tags: - attack.privilege-escalation - attack.stealth - attack.t1134.002 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - /EXEFilename - /CommandLine selection_runas: - CommandLine|contains: - ' /RunAs 8 ' - ' /RunAs 4 ' - ' /RunAs 10 ' - ' /RunAs 11 ' - CommandLine|endswith: - /RunAs 8 - /RunAs 4 - /RunAs 10 - /RunAs 11 condition: all of selection* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_advancedrun_priv_user/info.yml
Near-miss passage: Sigma rule: Monitor and alert for changes to the device registration policy.. Logsource: azure / auditlogs. Rule: title: Changes to Device Registration Policy id: 9494bff8-959f-4440-bbce-fb87a208d517 status: test description: Monitor and alert for changes to the device registration policy. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#device-registrations-and-joins-outside-policy author: Michael Epping, '@mepples21' date: 2022-06-28 tags: - attack.privilege-escalation - attack.defense-impairment - attack.t1484 logsource: product: azure service: auditlogs detection: selection: Category: Policy ActivityDisplayName: Set device registration policies condition: selection falsepositives: - Unknown level: high
Query: Sigma YAML for windows / registry_event
Matching passage: Sigma rule: Detects a registry key used by IceID in a campaign that distributes malicious OneNote files. Logsource: windows / registry_event. Rule: title: Potential Qakbot Registry Activity id: 1c8e96cd-2bed-487d-9de0-b46c90cade56 status: test description: Detects a registry key used by IceID in a campaign that distributes malicious OneNote files references: - https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution author: Hieu Tran date: 2023-03-13 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_event product: windows detection: selection: TargetObject|endswith: \Software\firm\soft\Name condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, Amm. Logsource: windows / process_creation. Rule: title: Remote Access Tool - NetSupport Execution id: 758ff488-18d5-4cbe-8ec4-02b6285a434f status: test description: 'An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md author: frack113 date: 2022-09-25 modified: 2023-03-06 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: windows detection: selection: - Description: NetSupport Client Configurator - Product: NetSupport Remote Control - Company: NetSupport Ltd - OriginalFileName: PCICFGUI.EXE condition: selection falsepositives: - Legitimate use level: medium
Query: detect Detects potential DLL sideloading of "waveedit.dll", which is part of the Nero WaveEditor audio editing software. in logs
Matching passage: Sigma rule: Detects potential DLL sideloading of "waveedit.dll", which is part of the Nero WaveEditor audio editing software.. Logsource: windows / image_load. Rule: title: Potential Waveedit.DLL Sideloading id: 71b31e99-9ad0-47d4-aeb5-c0ca3928eeeb status: test description: Detects potential DLL sideloading of "waveedit.dll", which is part of the Nero WaveEditor audio editing software. references: - https://www.trendmicro.com/en_us/research/23/f/behind-the-scenes-unveiling-the-hidden-workings-of-earth-preta.html author: X__Junior (Nextron Systems) date: 2023-06-14 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \waveedit.dll filter_main_legit_path: Image: - C:\Program Files (x86)\Nero\Nero Apps\Nero WaveEditor\waveedit.exe - C:\Program Files\Nero\Nero Apps\Nero WaveEditor\waveedit.exe ImageLoaded|startswith: - C:\Program Files (x86)\Nero\Nero Apps\Nero WaveEditor\ - C:\Program Files\Nero\Nero Apps\Nero WaveEditor\ condition: selection and not 1 of filter_main_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects creation of a file named "ntds.dit" (Active Directory Database). Logsource: windows / file_event. Rule: title: NTDS.DIT Created id: 0b8baa3f-575c-46ee-8715-d6f28cc7d33c status: test description: Detects creation of a file named "ntds.dit" (Active Directory Database) references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-05 tags: - attack.credential-access - attack.t1003.003 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: ntds.dit condition: selection falsepositives: - Unknown level: low
Query: detection rule: Detects the execution of SharpWSUS or WSUSpendu, utilities that allow for lateral movement through WSUS. Windows Server
Matching passage: Sigma rule: Detects the execution of SharpWSUS or WSUSpendu, utilities that allow for lateral movement through WSUS. Windows Server. Logsource: windows / process_creation. Rule: title: HackTool - SharpWSUS/WSUSpendu Execution id: b0ce780f-10bd-496d-9067-066d23dc3aa5 status: test description: 'Detects the execution of SharpWSUS or WSUSpendu, utilities that allow for lateral movement through WSUS. Windows Server Update Services (WSUS) is a critical component of Windows systems and is frequently configured in a way that allows an attacker to circumvent internal networking limitations. ' references: - https://labs.nettitude.com/blog/introducing-sharpwsus/ - https://github.com/nettitude/SharpWSUS - https://web.archive.org/web/20210512154016/https://github.com/AlsidOfficial/WSUSpendu/blob/master/WSUSpendu.ps1 author: '@Kostastsale, Nasreddine Bencherchali (Nextron Systems)' date: 2022-10-07 modified: 2024-08-23 tags: - attack.execution - attack.lateral-movement - attack.t1210 logsource: product: windows category: process_creation detection: selection_wsuspendu_inject: CommandLine|contains: ' -Inject ' selection_wsuspendu_payload: CommandLine|contains: - ' -PayloadArgs ' - ' -PayloadFile ' selection_sharpwsus_commands: CommandLine|contains: - ' approve ' - ' create ' - ' check ' - ' delete ' selection_sharpwsus_flags: CommandLine|contains: - ' /payload:' - ' /payload=' - ' /updateid:' - ' /updateid=' condition: all of selection_wsuspendu_* or all of selection_sharpwsus_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the addition of firewall address objects on a Fortinet FortiGate Firewall.. Logsource: fortigate / event. Rule: title: FortiGate - Firewall Address Object Added id: 5c8d7b41-3812-432f-a0bb-4cfb7c31827e status: experimental description: Detects the addition of firewall address objects on a Fortinet FortiGate Firewall. references: - https://www.fortiguard.com/psirt/FG-IR-24-535 - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/306021697/config-firewall-address - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) date: 2025-11-01 modified: 2026-05-04 tags: - attack.defense-impairment - attack.t1686.002 logsource: product: fortigate service: event detection: selection: action: Add cfgpath: firewall.address condition: selection falsepositives: - An address could be added or deleted for legitimate purposes. level: medium
Query: indicators of Modify System Image
Matching passage: T1601 Modify System Image. Tactics: defense impairment. Description: Adversaries may make changes to the operating system of embedded network devices to weaken defenses and provide new capabilities for themselves. On such devices, the operating systems are typically monolithic and most of the device functionality and capabilities are contained within a single file. To change the operating system, the adversary typically only needs to affect this one file, replacing or modifying it. This can either be done live in memory during system runtime for immediate effect, or in storage to implement the change on the next boot of the network device.
Near-miss passage: T1601.002 Downgrade System Image. Tactics: defense impairment. Description: Adversaries may install an older version of the operating system of a network device to weaken security. Older operating system versions on network devices often have weaker encryption ciphers and, in general, fewer/less updated defensive features. (Citation: Cisco Synful Knock Evolution) On embedded devices, downgrading the version typically only requires replacing the operating system file in storage. With most embedded devices, this can be achieved by downloading a copy of the desired version of the operating system file and reconfiguring the device to boot from that file on next system restart. The adversary could then restart the device to implement the change immediately or they could wait until the next time the system restarts. Downgrading the system image to an older versions may allow an adversary to evade defenses by enabling behaviors such as [Weaken Encryption](https://attack.mitre.org/techniques/T1600). Downgrading of a system image can be done on its own, or it can be used in conjunction with [Patch System Image](https://attack.mitre.org/techniques/T1601/001).
Query: exploit Microsoft Office Compatibility Pack SP3, Office 2010 SP2, Office 2013 SP1, and Office 2013 RT SP1 allow remote attackers to execute arbitrary code via a crafted Office document, ak
Matching passage: CVE-2015-1760. CWE: CWE-19. CVSS: 9.300000190734863. Microsoft Office Compatibility Pack SP3, Office 2010 SP2, Office 2013 SP1, and Office 2013 RT SP1 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-7971. CWE: CWE-19. CVSS: 2.0999999046325684. Xen 3.2.x through 4.6.x does not limit the number of printk console messages when logging certain pmu and profiling hypercalls, which allows local guests to cause a denial of service via a sequence of crafted (1) HYPERCALL_xenoprof_op hypercalls, which are not properly handled in the do_xenoprof_op function in common/xenoprof.c, or (2) HYPERVISOR_xenpmu_op hypercalls, which are not properly handled in the do_xenpmu_op function in arch/x86/cpu/vpmu.c.
Query: CVE similar to CVE-2015-8705
Matching passage: CVE-2015-8705. CWE: CWE-20. CVSS: 7.0. buffer.c in named in ISC BIND 9.10.x before 9.10.3-P3, when debug logging is enabled, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit, or daemon crash) or possibly have unspecified other impact via (1) OPT data or (2) an ECS option.
Near-miss passage: CVE-2015-2754. CWE: CWE-20. CVSS: 6.800000190734863. FreeXL before 1.0.0i allows remote attackers to cause a denial of service (stack corruption) and possibly execute arbitrary code via a crafted workbook, related to a "premature EOF."
Query: CVE similar to CVE-2015-3776
Matching passage: CVE-2015-3776. CWE: CWE-119. CVSS: 9.300000190734863. IOKit in Apple iOS before 8.4.1 and OS X before 10.10.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption and application crash) via a malformed plist.
Near-miss passage: CVE-2015-1500. CWE: CWE-119. CVSS: 6.800000190734863. Multiple stack-based buffer overflows in the TSUnicodeGraphEditorControl in SolarWinds Server and Application Monitor (SAM) allow remote attackers to execute arbitrary code via unspecified vectors to (1) graphManager.load or (2) factory.load.
Query: patch priority for CVE-2015-6252
Matching passage: CVE-2015-6252. CWE: CWE-399. CVSS: 2.0999999046325684. The vhost_dev_ioctl function in drivers/vhost/vhost.c in the Linux kernel before 4.1.5 allows local users to cause a denial of service (memory consumption) via a VHOST_SET_LOG_FD ioctl call that triggers permanent file-descriptor allocation.
Near-miss passage: CVE-2015-2340. CWE: CWE-399. CVSS: 6.099999904632568. TPInt.dll in VMware Workstation 10.x before 10.0.6 and 11.x before 11.1.1, VMware Player 6.x before 6.0.6 and 7.x before 7.1.1, and VMware Horizon Client 3.2.x before 3.2.1, 3.3.x, and 5.x local-mode before 5.4.2 on Windows does not properly allocate memory, which allows guest OS users to cause a host OS denial of service via unspecified vectors.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in unspecified administration pages in the Petition module 6.x-1.x before 6.x-1.3 for Drupal allows remote authenticated users with the "cr
Matching passage: CVE-2015-4377. CWE: CWE-79. CVSS: 2.0999999046325684. Cross-site scripting (XSS) vulnerability in unspecified administration pages in the Petition module 6.x-1.x before 6.x-1.3 for Drupal allows remote authenticated users with the "create petition" permission to inject arbitrary web script or HTML via unknown vectors.
Near-miss passage: CVE-2015-0522. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in EMC RSA Certificate Manager (RCM) before 6.9 build 558 and RSA Registration Manager (RRM) before 6.9 build 558 allows remote attackers to inject arbitrary web script or HTML via vectors related to the email address parameter.
Query: exploit The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted requests.
Matching passage: CVE-2015-7705. CWE: CWE-20. CVSS: 9.800000190734863. The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted requests.
Near-miss passage: CVE-2015-8226. CWE: CWE-20. CVSS: 5.5. The Joint Photographic Experts Group Processing Unit (JPU) driver in Huawei ALE smartphones with software before ALE-UL00C00B220 and ALE-TL00C01B220 and GEM-703L smartphones with software before V100R001C233B111 allows remote attackers to cause a denial of service (crash) via a crafted application with the system or camera permission, a different vulnerability than CVE-2015-8225.
Query: risk of Belkin F9K1102 2 devices with firmware 2.10.17 use an improper algorithm for selecting the ID value in the header of a DNS query, which makes it easier for remote attackers to spoo
Matching passage: CVE-2015-5987. CWE: UNKNOWN. CVSS: 8.600000381469727. Belkin F9K1102 2 devices with firmware 2.10.17 use an improper algorithm for selecting the ID value in the header of a DNS query, which makes it easier for remote attackers to spoof responses by predicting this value.
Near-miss passage: CVE-2015-4880. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 10.1.3.5.1 allows remote attackers to affect integrity via unknown vectors related to Content Server, a different vulnerability than CVE-2015-4867.
Query: CVE similar to CVE-2015-2933
Matching passage: CVE-2015-2933. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Html class in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via a LanguageConverter substitution string when using a language variant.
Near-miss passage: CVE-2015-7373. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the "magic-macros" feature in Revive Adserver before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via a GET parameter, which is not properly handled in a banner.
Query: common weakness: Time-of-check Time-of-use (TOCTOU) Race Condition
Matching passage: CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition. The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
Near-miss passage: CWE-104 Struts: Form Bean Does Not Extend Validation Class. If a form bean does not extend an ActionForm subclass of the Validator framework, it can expose the application to other weaknesses related to insufficient input validation.