alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: The CoreGraphics component in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows remote attackers to execute arbitrary code or cause a denial of service (me
Matching passage: CVE-2015-5926. CWE: CWE-119. CVSS: 6.800000190734863. The CoreGraphics component in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2015-5925.
Near-miss passage: CVE-2015-3214. CWE: CWE-119. CVSS: 6.900000095367432. The pit_ioport_read in i8254.c in the Linux kernel before 2.6.33 and QEMU before 2.3.1 does not distinguish between read lengths and write lengths, which might allow guest OS users to execute arbitrary code on the host OS by triggering use of an invalid index.
Query: patch priority for CVE-2015-4310
Matching passage: CVE-2015-4310. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Cisco Finesse 10.5(1) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a (1) GET or (2) POST request, aka Bug IDs CSCuq82322, CSCut95853, and CSCuq73975.
Near-miss passage: CVE-2015-2973. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the Welcart plugin before 1.4.18 for WordPress allow remote attackers to inject arbitrary web script or HTML via the usces_referer parameter to (1) classes/usceshop.class.php, (2) includes/edit-form-advanced.php, (3) includes/edit-form-advanced30.php, (4) includes/edit-form-advanced34.php, (5) includes/member_edit_form.php, (6) includes/order_edit_form.php, (7) includes/order_list.php, or (8) includes/usces_item_master_list.php, related to admin.php.
Query: alert when Detects usage of winget to add a new insecure (http) download source. Winget will not allow the addition of insecure sou
Matching passage: Sigma rule: Detects usage of winget to add a new insecure (http) download source. Winget will not allow the addition of insecure sou. Logsource: windows / process_creation. Rule: title: Add Insecure Download Source To Winget id: 81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2 related: - id: 05ebafc8-7aa2-4bcd-a269-2aec93f9e842 type: similar - id: c15a46a0-07d4-4c87-b4b6-89207835a83b type: similar status: test description: 'Detects usage of winget to add a new insecure (http) download source. Winget will not allow the addition of insecure sources, hence this could indicate potential suspicious activity (or typos) ' references: - https://learn.microsoft.com/en-us/windows/package-manager/winget/source - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-17 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \winget.exe - OriginalFileName: winget.exe selection_cli: CommandLine|contains|all: - 'source ' - 'add ' - http:// condition: all of selection_* falsepositives: - False positives might occur if the users are unaware of such control checks level: high
Near-miss passage: Sigma rule: Detects PowerShell core DLL being loaded by an Office Product. Logsource: windows / image_load. Rule: title: PowerShell Core DLL Loaded Via Office Application id: bb2ba6fb-95d4-4a25-89fc-30bb736c021a status: test description: Detects PowerShell core DLL being loaded by an Office Product references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-01 tags: - attack.stealth logsource: category: image_load product: windows detection: selection: Image|endswith: - \excel.exe - \mspub.exe - \outlook.exe - \onenote.exe - \onenoteim.exe - \powerpnt.exe - \winword.exe ImageLoaded|contains: - \System.Management.Automation.Dll - \System.Management.Automation.ni.Dll condition: selection falsepositives: - Unknown level: medium
Query: Sigma rule for Detecting attempts to extract passwords with grep and laZagne
Matching passage: Sigma rule: Detecting attempts to extract passwords with grep and laZagne. Logsource: macos / process_creation. Rule: title: Credentials In Files id: 53b1b378-9b06-4992-b972-dde6e423d2b4 status: test description: Detecting attempts to extract passwords with grep and laZagne references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md author: Igor Fits, Mikhail Larin, oscd.community date: 2020-10-19 modified: 2021-11-27 tags: - attack.credential-access - attack.t1552.001 logsource: product: macos category: process_creation detection: selection1: Image|endswith: /grep CommandLine|contains: password selection2: CommandLine|contains: laZagne condition: 1 of selection* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Alert on when a user has performed an eDiscovery search or exported a PST file from the search. This PST file usually ha. Logsource: m365 / threat_management. Rule: title: PST Export Alert Using eDiscovery Alert id: 18b88d08-d73e-4f21-bc25-4b9892a4fdd0 related: - id: 6897cd82-6664-11ed-9022-0242ac120002 type: similar status: test description: Alert on when a user has performed an eDiscovery search or exported a PST file from the search. This PST file usually has sensitive information including email body content references: - https://learn.microsoft.com/en-us/microsoft-365/compliance/alert-policies?view=o365-worldwide author: Sorina Ionescu date: 2022-02-08 modified: 2022-11-17 tags: - attack.collection - attack.t1114 logsource: service: threat_management product: m365 definition: Requires the 'eDiscovery search or exported' alert to be enabled detection: selection: eventSource: SecurityComplianceCenter eventName: eDiscovery search started or exported status: success condition: selection falsepositives: - PST export can be done for legitimate purposes but due to the sensitive nature of its content it must be monitored. level: medium
Query: exploit An issue was discovered on Samsung mobile devices with software through 2015-11-12, affecting the Galaxy S6/S6 Edge, Galaxy S6 Edge+, and Galaxy Note5 with the Shannon333 chipset. 
Matching passage: CVE-2015-8546. CWE: CWE-787. CVSS: 9.800000190734863. An issue was discovered on Samsung mobile devices with software through 2015-11-12, affecting the Galaxy S6/S6 Edge, Galaxy S6 Edge+, and Galaxy Note5 with the Shannon333 chipset. There is a stack-based buffer overflow in the baseband process that is exploitable for remote code execution via a fake base station. The Samsung ID is SVE-2015-5123 (December 2015).
Near-miss passage: CVE-2015-5110. CWE: CWE-787. CVSS: 6.800000190734863. Stack-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.
Query: risk of Directory traversal vulnerability in abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to read, write to, or change ownership of arbitrary files via unspecified v
Matching passage: CVE-2015-3151. CWE: CWE-22. CVSS: 7.800000190734863. Directory traversal vulnerability in abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to read, write to, or change ownership of arbitrary files via unspecified vectors to the (1) NewProblem, (2) GetInfo, (3) SetElement, or (4) DeleteElement method.
Near-miss passage: CVE-2015-8794. CWE: CWE-22. CVSS: 6.5. Absolute path traversal vulnerability in program/steps/addressbook/photo.inc in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via a full pathname in the _alt parameter, related to contact photo handling.
Query: Suspicious Web Service execution detected on endpoint
Matching passage: T1102 Web Service. Tactics: command and control. Description: Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise.(Citation: Broadcom BirdyClient Microsoft Graph API 2024) Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).
Near-miss passage: T1102.001 Dead Drop Resolver. Tactics: command and control. Description: Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of a dead drop resolver may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).
Query: exploit Basware Banking (Maksuliikenne) 8.90.07.X does not properly prevent access to private keys, which allows remote attackers to spoof communications with banks via unspecified vectors
Matching passage: CVE-2015-6747. CWE: CWE-200. CVSS: 5.0. Basware Banking (Maksuliikenne) 8.90.07.X does not properly prevent access to private keys, which allows remote attackers to spoof communications with banks via unspecified vectors. NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 due to different vulnerability types. NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-6746.
Near-miss passage: CVE-2015-7991. CWE: CWE-200. CVSS: 5.0. The Web Dispatcher service in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote attackers to read web dispatcher and security trace files and possibly obtain passwords via unspecified vectors, aka SAP Security Note 2148854.
Query: exploit A vulnerability classified as problematic was found in WooFramework Tweaks Plugin up to 1.0.1 on WordPress. Affected by this vulnerability is the function admin_screen_logic of the
Matching passage: CVE-2015-10113. CWE: CWE-601. CVSS: 6.099999904632568. A vulnerability classified as problematic was found in WooFramework Tweaks Plugin up to 1.0.1 on WordPress. Affected by this vulnerability is the function admin_screen_logic of the file wooframework-tweaks.php. The manipulation of the argument url leads to open redirect. The attack can be launched remotely. Upgrading to version 1.0.2 is able to address this issue. The identifier of the patch is 3b57d405149c1a59d1119da6e0bb8212732c9c88. It is recommended to upgrade the affected component. The identifier VDB-230653 was assigned to this vulnerability.
Near-miss passage: CVE-2015-10052. CWE: CWE-601. CVSS: 6.099999904632568. ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as problematic, was found in calesanz gibb-modul-151. This affects the function bearbeiten/login. The manipulation leads to open redirect. It is possible to initiate the attack remotely. The patch is named 88a517dc19443081210c804b655e72770727540d. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218379. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Query: exploit Common LaTeX Service Interface (CLSI) before 0.1.3, as used in ShareLaTeX before 0.1.3, allows remote authenticated users to execute arbitrary code via ` (backtick) characters in a
Matching passage: CVE-2015-0934. CWE: CWE-77. CVSS: 6.5. Common LaTeX Service Interface (CLSI) before 0.1.3, as used in ShareLaTeX before 0.1.3, allows remote authenticated users to execute arbitrary code via ` (backtick) characters in a filename.
Near-miss passage: CVE-2015-2210. CWE: CWE-77. CVSS: 7.800000190734863. The help window in Epicor CRS Retail Store before 3.2.03.01.008 allows local users to execute arbitrary code by injecting Javascript into the window source to create a button that spawns a command shell.
Query: write Sigma for Detects suspicious files created via the OneNote application. This could indicate a potential malicious ".one"/".onepkg"
Matching passage: Sigma rule: Detects suspicious files created via the OneNote application. This could indicate a potential malicious ".one"/".onepkg". Logsource: windows / file_event. Rule: title: Suspicious File Created Via OneNote Application id: fcc6d700-68d9-4241-9a1a-06874d621b06 status: test description: Detects suspicious files created via the OneNote application. This could indicate a potential malicious ".one"/".onepkg" file was executed as seen being used in malware activity in the wild references: - https://www.bleepingcomputer.com/news/security/hackers-now-use-microsoft-onenote-attachments-to-spread-malware/ - https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/ - https://twitter.com/MaD_c4t/status/1623414582382567424 - https://labs.withsecure.com/publications/detecting-onenote-abuse - https://www.trustedsec.com/blog/new-attacks-old-tricks-how-onenote-malware-is-evolving/ - https://app.any.run/tasks/17f2d378-6d11-4d6f-8340-954b04f35e83/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-09 modified: 2023-02-27 tags: - attack.stealth logsource: category: file_event product: windows detection: selection: Image|endswith: - \onenote.exe - \onenotem.exe - \onenoteim.exe TargetFilename|contains: \AppData\Local\Temp\OneNote\ TargetFilename|endswith: - .bat - .chm - .cmd - .dll - .exe - .hta - .htm - .html - .js - .lnk - .ps1 - .vbe - .vbs - .wsf condition: selection falsepositives: - False positives should be very low with the extensions list cited. Especially if you don't heavily utilize OneNote. - Occasional FPs might occur if OneNote is used internally to share different embedded documents level: high
Near-miss passage: Sigma rule: Detects the removal of a deployment from a Kubernetes cluster. This could indicate disruptive activity aiming to impact. Logsource: kubernetes / application / audit. Rule: title: Deployment Deleted From Kubernetes Cluster id: 40967487-139b-4811-81d9-c9767a92aa5a status: test description: 'Detects the removal of a deployment from a Kubernetes cluster. This could indicate disruptive activity aiming to impact business operations. ' references: - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Data%20destruction/ author: Leo Tsaousis (@laripping) date: 2024-03-26 tags: - attack.t1498 - attack.impact logsource: category: application product: kubernetes service: audit detection: selection: verb: delete objectRef.resource: deployments condition: selection falsepositives: - Unknown level: low
Query: patch priority for CVE-2015-0642
Matching passage: CVE-2015-0642. CWE: CWE-20. CVSS: 7.800000190734863. Cisco IOS 12.2, 12.4, 15.0, 15.1, 15.2, 15.3, and 15.4 and IOS XE 2.5.x, 2.6.x, 3.1.xS through 3.12.xS before 3.12.3S, 3.2.xE through 3.7.xE before 3.7.1E, 3.3.xSG, 3.4.xSG, and 3.13.xS before 3.13.2S allow remote attackers to cause a denial of service (device reload) by sending malformed IKEv2 packets over (1) IPv4 or (2) IPv6, aka Bug ID CSCum36951.
Near-miss passage: CVE-2015-9060. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a pointer is not properly validated in a QTEE system call.
Query: detect Detects the use of various CLI utilities exfiltrating data via web requests in logs
Matching passage: Sigma rule: Detects the use of various CLI utilities exfiltrating data via web requests. Logsource: windows / process_creation. Rule: title: Potential Data Exfiltration Activity Via CommandLine Tools id: 7d1aaf3d-4304-425c-b7c3-162055e0b3ab status: test description: Detects the use of various CLI utilities exfiltrating data via web requests references: - https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-02 modified: 2025-10-19 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_iwr: Image|endswith: - \powershell_ise.exe - \powershell.exe - \pwsh.exe - \cmd.exe CommandLine|contains: - 'curl ' - Invoke-RestMethod - Invoke-WebRequest - 'irm ' - 'iwr ' - 'wget ' CommandLine|contains|all: - ' -ur' - ' -me' - ' -b' - ' POST ' selection_curl: Image|endswith: \curl.exe CommandLine|contains: --ur selection_curl_data: CommandLine|contains: - ' -d ' - ' --data ' selection_wget: Image|endswith: \wget.exe CommandLine|contains: - --post-data - --post-file payloads: - CommandLine|re: - net\s+view - sc\s+query - CommandLine|contains: - Get-Content - GetBytes - hostname - ifconfig - ipconfig - netstat - nltest - qprocess - systeminfo - tasklist - ToBase64String - whoami - CommandLine|contains|all: - 'type ' - ' > ' - ' C:\' condition: (selection_iwr or all of selection_curl* or selection_wget) and payloads falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects a failed installation of a Exchange Transport Agent. Logsource: windows / msexchange-management. Rule: title: Failed MSExchange Transport Agent Installation id: c7d16cae-aaf3-42e5-9c1c-fb8553faa6fa status: test description: Detects a failed installation of a Exchange Transport Agent references: - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=8 author: Tobias Michalski (Nextron Systems) date: 2021-06-08 modified: 2022-07-12 tags: - attack.persistence - attack.t1505.002 logsource: service: msexchange-management product: windows detection: selection: EventID: 6 Data|contains: Install-TransportAgent condition: selection falsepositives: - Legitimate installations of exchange TransportAgents. AssemblyPath is a good indicator for this. level: high
Query: exploit The kernel in Apple iOS before 9.1 and OS X before 10.11.1 does not initialize an unspecified data structure, which allows remote attackers to execute arbitrary code via vectors in
Matching passage: CVE-2015-6988. CWE: UNKNOWN. CVSS: 10.0. The kernel in Apple iOS before 9.1 and OS X before 10.11.1 does not initialize an unspecified data structure, which allows remote attackers to execute arbitrary code via vectors involving an unknown network-connectivity requirement.
Near-miss passage: CVE-2015-7041. CWE: UNKNOWN. CVSS: 4.300000190734863. The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to cause a denial of service via a crafted app, a different vulnerability than CVE-2015-7040, CVE-2015-7042, and CVE-2015-7043.
Query: patch priority for CVE-2015-1391
Matching passage: CVE-2015-1391. CWE: CWE-352. CVSS: 8.800000190734863. Aruba AirWave before 8.0.7 allows bypass of a CSRF protection mechanism.
Near-miss passage: CVE-2015-5412. CWE: CWE-352. CVSS: 6.0. Cross-site request forgery (CSRF) vulnerability in HP Version Control Repository Manager (VCRM) before 7.5.0 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.
Query: describe CVE-2015-1965
Matching passage: CVE-2015-1965. CWE: CWE-119. CVSS: 7.800000190734863. Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1925, CVE-2015-1929, CVE-2015-1930, CVE-2015-1948, CVE-2015-1953, CVE-2015-1954, CVE-2015-1962, CVE-2015-1963, and CVE-2015-1964.
Near-miss passage: CVE-2015-4511. CWE: CWE-119. CVSS: 6.800000190734863. Heap-based buffer overflow in the nestegg_track_codec_data function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allows remote attackers to execute arbitrary code via a crafted header in a WebM video.
Query: weakness Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
Matching passage: CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'). The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.
Near-miss passage: CWE-1096 Singleton Class Instance Creation without Proper Locking or Synchronization. The product implements a Singleton design pattern but does not use appropriate locking or other synchronization mechanism to ensure that the singleton class is only instantiated once.
Query: risk of The CBBBRInit method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat R
Matching passage: CVE-2015-6710. CWE: UNKNOWN. CVSS: 6.800000190734863. The CBBBRInit method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6711, CVE-2015-6712, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7616, CVE-2015-7618, CVE-2015-7619, CVE-2015-7620, and CVE-2015-7623.
Near-miss passage: CVE-2015-2296. CWE: UNKNOWN. CVSS: 6.800000190734863. The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.
Query: CVE similar to CVE-2015-2001
Matching passage: CVE-2015-2001. CWE: CWE-118. CVSS: 9.800000190734863. The MetaIO SDK before 6.0.2.1 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.
Near-miss passage: CVE-2015-2004. CWE: CWE-118. CVSS: 9.800000190734863. The GraceNote GNSDK SDK before SVN Changeset 1.1.7 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.
Query: describe CVE-2015-0855
Matching passage: CVE-2015-0855. CWE: CWE-94. CVSS: 9.800000190734863. The _mediaLibraryPlayCb function in mainwindow.py in pitivi before 0.95 allows attackers to execute arbitrary code via shell metacharacters in a file path.
Near-miss passage: CVE-2015-8761. CWE: CWE-94. CVSS: 9.0. The Values module 7.x-1.x before 7.x-1.2 for Drupal does not properly check permissions, which allows remote administrators with the "Import value sets" permission to execute arbitrary PHP code via the exported values list in a ctools import.