alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not indicate what web site originated an input prompt, which
Matching passage: CVE-2015-3729. CWE: CWE-254. CVSS: 4.300000190734863. Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not indicate what web site originated an input prompt, which allows remote attackers to conduct spoofing attacks via a crafted site.
Near-miss passage: CVE-2015-1269. CWE: CWE-254. CVSS: 4.300000190734863. The DecodeHSTSPreloadRaw function in net/http/transport_security_state.cc in Google Chrome before 43.0.2357.130 does not properly canonicalize DNS hostnames before making comparisons to HSTS or HPKP preload entries, which allows remote attackers to bypass intended access restrictions via a string that (1) ends in a . (dot) character or (2) is not entirely lowercase.
Query: common weakness: Incorrect Block Delimitation
Matching passage: CWE-483 Incorrect Block Delimitation. The code does not explicitly delimit a block that is intended to contain 2 or more statements, creating a logic error.
Near-miss passage: CWE-283 Unverified Ownership. The product does not properly verify that a critical resource is owned by the proper entity.
Query: weakness Improper Handling of Missing Special Element
Matching passage: CWE-166 Improper Handling of Missing Special Element. The product receives input from an upstream component, but it does not handle or incorrectly handles when an expected special element is missing.
Near-miss passage: CWE-298 Improper Validation of Certificate Expiration. A certificate expiration is not validated or is incorrectly validated.
Query: describe CVE-2015-1250
Matching passage: CVE-2015-1250. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in Google Chrome before 42.0.2311.135 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Near-miss passage: CVE-2015-4759. CWE: UNKNOWN. CVSS: 6.800000190734863. Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Data Quality based on Trillium, a different vulnerability than CVE-2015-0443, CVE-2015-0444, CVE-2015-0445, CVE-2015-0446, CVE-2015-2634, CVE-2015-2635, CVE-2015-2636, and CVE-2015-4758.
Query: exploit HP Matrix Operating Environment before 7.5.0 allows remote attackers to obtain sensitive information or modify data via unspecified vectors, a different vulnerability than CVE-2015
Matching passage: CVE-2015-5428. CWE: UNKNOWN. CVSS: 7.5. HP Matrix Operating Environment before 7.5.0 allows remote attackers to obtain sensitive information or modify data via unspecified vectors, a different vulnerability than CVE-2015-5427 and CVE-2015-5429.
Near-miss passage: CVE-2015-4134. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in goto.php in phpwind 8.7 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.
Query: patch priority for CVE-2015-3673
Matching passage: CVE-2015-3673. CWE: CWE-264. CVSS: 7.199999809265137. Admin Framework in Apple OS X before 10.10.4 does not properly restrict the location of writeconfig clients, which allows local users to obtain root privileges by moving and then modifying Directory Utility.
Near-miss passage: CVE-2015-9013. CWE: CWE-264. CVSS: 9.800000190734863. An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36393251.
Query: CVE similar to CVE-2015-5523
Matching passage: CVE-2015-5523. CWE: CWE-119. CVSS: 4.300000190734863. The ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service (crash) via vectors involving multiple whitespace characters before an empty href, which triggers a large memory allocation.
Near-miss passage: CVE-2015-8455. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, and CVE-2015-8451.
Query: patch priority for CVE-2015-6769
Matching passage: CVE-2015-6769. CWE: CWE-264. CVSS: 7.5. The provisional-load commit implementation in WebKit/Source/bindings/core/v8/WindowProxy.cpp in Google Chrome before 47.0.2526.73 allows remote attackers to bypass the Same Origin Policy by leveraging a delay in window proxy clearing.
Near-miss passage: CVE-2015-1904. CWE: CWE-264. CVSS: 3.5. IBM Business Process Manager (BPM) 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0, when external Enterprise Content Management (ECM) integration is enabled with a certain technical system account configuration, allows remote authenticated users to bypass intended document-access restrictions via a (1) upload or (2) download action.
Query: weakness Exposure of Sensitive Information caused by Shared Microarchitectural Predictor State that Influences Transient Execution
Matching passage: CWE-1423 Exposure of Sensitive Information caused by Shared Microarchitectural Predictor State that Influences Transient Execution. Shared microarchitectural predictor state may allow code to influence transient execution across a hardware boundary, potentially exposing data that is accessible beyond the boundary over a covert channel.
Near-miss passage: CWE-588 Attempt to Access Child of a Non-structure Pointer. Casting a non-structure type to a structure type and accessing a field can lead to memory access errors or data corruption.
Query: CVE similar to CVE-2015-3057
Matching passage: CVE-2015-3057. CWE: CWE-119. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-9161, CVE-2015-3046, CVE-2015-3049, CVE-2015-3050, CVE-2015-3051, CVE-2015-3052, CVE-2015-3056, CVE-2015-3070, and CVE-2015-3076.
Near-miss passage: CVE-2015-7065. CWE: CWE-119. CVSS: 6.800000190734863. OpenGL in Apple iOS before 9.2, OS X before 10.11.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Query: risk of win32k.sys in the kernel-mode drivers in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to obtain sensitive infor
Matching passage: CVE-2015-2381. CWE: CWE-200. CVSS: 2.0999999046325684. win32k.sys in the kernel-mode drivers in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to obtain sensitive information from kernel memory via a crafted application, aka "Win32k Information Disclosure Vulnerability," a different vulnerability than CVE-2015-2382.
Near-miss passage: CVE-2015-7418. CWE: CWE-200. CVSS: 4.400000095367432. IBM WebSphere eXtreme Scale and the WebSphere DataPower XC10 Appliance allow some sensitive data to linger in memory instead of being overwritten which could allow a local user with administrator privileges to obtain sensitive information.
Query: hunt for Relocate Malware activity
Matching passage: T1070.010 Relocate Malware. Tactics: stealth. Description: Once a payload is delivered, adversaries may reproduce copies of the same malware on the victim system to remove evidence of their presence and/or avoid defenses. Copying malware payloads to new locations may also be combined with [File Deletion](https://attack.mitre.org/techniques/T1070/004) to cleanup older artifacts. Relocating malware may be a part of many actions intended to evade defenses. For example, adversaries may copy and rename payloads to better blend into the local environment (i.e., [Match Legitimate Resource Name or Location](https://attack.mitre.org/techniques/T1036/005)).(Citation: DFIR Report Trickbot June 2023) Payloads may also be repositioned to target [File/Path Exclusions](https://attack.mitre.org/techniques/T1564/012) as well as specific locations associated with establishing [Persistence](https://attack.mitre.org/tactics/TA0003).(Citation: Latrodectus APR 2024) Relocating malicious payloads may also hinder defensive analysis, especially to separate these payloads from earlier events (such as [User Execution](https://attack.mitre.org/techniques/T1204) and [Phishing](https://attack.mitre.org/techniques/T1566)) that may have generated alerts or otherwise drawn attention from defenders. Moving payloads into target directories does not alter the Creation timestamp, thereby evading detection logic reliant on modifications to this artifact (i.e., [Timestomp](https://attack.mitre.org/techniques/T1070/006)).
Near-miss passage: T1070.005 Network Share Connection Removal. Tactics: stealth. Description: Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) connections can be removed when no longer needed. [Net](https://attack.mitre.org/software/S0039) is an example utility that can be used to remove network share connections with the <code>net use \\system\share /delete</code> command. (Citation: Technet Net Use)
Query: detect Detects instances where an OpenCanary node has been targeted by a SYN port scan. in logs
Matching passage: Sigma rule: Detects instances where an OpenCanary node has been targeted by a SYN port scan.. Logsource: opencanary / application. Rule: title: OpenCanary - Host Port Scan (SYN Scan) id: 974be8d2-283e-4033-ab08-7505b84204d0 status: experimental description: Detects instances where an OpenCanary node has been targeted by a SYN port scan. references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Marco Pedrinazzi (@pedrinazziM) date: 2026-01-06 tags: - attack.discovery - attack.t1046 logsource: category: application product: opencanary detection: selection: logtype: 5001 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects Bitsadmin connections to domains with uncommon TLDs. Logsource: proxy. Rule: title: Bitsadmin to Uncommon TLD id: 9eb68894-7476-4cd6-8752-23b51f5883a7 status: test description: Detects Bitsadmin connections to domains with uncommon TLDs references: - https://twitter.com/jhencinski/status/1102695118455349248 - https://isc.sans.edu/forums/diary/Investigating+Microsoft+BITS+Activity/23281/ author: Florian Roth (Nextron Systems), Tim Shelton date: 2019-03-07 modified: 2023-05-17 tags: - attack.command-and-control - attack.execution - attack.stealth - attack.t1071.001 - attack.persistence - attack.t1197 - attack.s0190 logsource: category: proxy detection: selection: c-useragent|startswith: Microsoft BITS/ falsepositives: cs-host|endswith: - .com - .net - .org - .scdn.co - .sfx.ms condition: selection and not falsepositives falsepositives: - Rare programs that use Bitsadmin and update from regional TLDs e.g. .uk or .ca level: high
Query: weakness Access to Critical Private Variable via Public Method
Matching passage: CWE-767 Access to Critical Private Variable via Public Method. The product defines a public method that reads or modifies a private variable.
Near-miss passage: CWE-697 Incorrect Comparison. The product compares two entities in a security-relevant context, but the comparison is incorrect.
Query: detect Detects the use of NirCmd tool for command execution as SYSTEM user in logs
Matching passage: Sigma rule: Detects the use of NirCmd tool for command execution as SYSTEM user. Logsource: windows / process_creation. Rule: title: PUA - NirCmd Execution As LOCAL SYSTEM id: d9047477-0359-48c9-b8c7-792cedcdc9c4 status: test description: Detects the use of NirCmd tool for command execution as SYSTEM user references: - https://www.nirsoft.net/utils/nircmd.html - https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/ - https://www.nirsoft.net/utils/nircmd2.html#using author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-01-24 modified: 2023-02-13 tags: - attack.execution - attack.t1569.002 - attack.s0029 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: ' runassystem ' condition: selection falsepositives: - Legitimate use by administrators level: high
Near-miss passage: Sigma rule: Detects the load of dbghelp/dbgcore DLL (used to make memory dumps) by suspicious processes. Tools like ProcessHacker an. Logsource: windows / image_load. Rule: title: Suspicious Unsigned Dbghelp/Dbgcore DLL Loaded id: bdc64095-d59a-42a2-8588-71fd9c9d9abc related: - id: 0e277796-5f23-4e49-a490-483131d4f6e1 type: similar status: test description: 'Detects the load of dbghelp/dbgcore DLL (used to make memory dumps) by suspicious processes. Tools like ProcessHacker and some attacker tradecract use MiniDumpWriteDump API found in dbghelp.dll or dbgcore.dll. As an example, SilentTrynity C2 Framework has a module that leverages this API to dump the contents of Lsass.exe and transfer it over the network back to the attacker''s machine. ' references: - https://learn.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump - https://www.pinvoke.net/default.aspx/dbghelp/MiniDumpWriteDump.html - https://medium.com/@fsx30/bypass-edrs-memory-protection-introduction-to-hooking-2efb21acffd6 author: Perez Diego (@darkquassar), oscd.community, Ecco date: 2019-10-27 modified: 2022-12-09 tags: - attack.credential-access - attack.t1003.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: - \dbghelp.dll - \dbgcore.dll Signed: 'false' condition: selection falsepositives: - Unknown level: high
Query: detect Detects usage of Sysinternals PsService which can be abused for service reconnaissance and tampering in logs
Matching passage: Sigma rule: Detects usage of Sysinternals PsService which can be abused for service reconnaissance and tampering. Logsource: windows / process_creation. Rule: title: Sysinternals PsService Execution id: 3371f518-5fe3-4cf6-a14b-2a0ae3fd8a4f status: test description: Detects usage of Sysinternals PsService which can be abused for service reconnaissance and tampering references: - https://learn.microsoft.com/en-us/sysinternals/downloads/psservice author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-16 modified: 2026-06-29 tags: - attack.privilege-escalation - attack.discovery - attack.persistence - attack.t1543.003 logsource: category: process_creation product: windows detection: selection: - OriginalFileName: psservice.exe - Image|endswith: - \PsService.exe - \PsService64.exe - \PsService64a.exe condition: selection falsepositives: - Legitimate use of PsService by an administrator level: medium
Near-miss passage: Sigma rule: Detects execition of commands and binaries from the context of The program compatibility assistant (Pcalua.exe). This ca. Logsource: windows / process_creation. Rule: title: Use of Pcalua For Execution id: 0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2 related: - id: fa47597e-90e9-41cd-ab72-c3b74cfb0d02 type: obsolete status: test description: Detects execition of commands and binaries from the context of The program compatibility assistant (Pcalua.exe). This can be used as a LOLBIN in order to bypass application whitelisting. references: - https://lolbas-project.github.io/lolbas/Binaries/Pcalua/ - https://pentestlab.blog/2020/07/06/indirect-command-execution/ author: Nasreddine Bencherchali (Nextron Systems), E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community date: 2022-06-14 modified: 2023-01-04 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection: Image|endswith: \pcalua.exe CommandLine|contains: ' -a' condition: selection falsepositives: - Legitimate use by a via a batch script or by an administrator. level: medium
Query: exploit SQL injection vulnerability in modules/module.ab-testing.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to execute arbitrary SQL comma
Matching passage: CVE-2015-4064. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in modules/module.ab-testing.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the post parameter in an edit delete-variation action to wp-admin/post.php.
Near-miss passage: CVE-2015-1513. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in SIPhone Enterprise PBX allows remote attackers to execute arbitrary SQL commands via the Username.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects when an internet hosted webdav share is mounted using the "net.exe" utility. Logsource: windows / process_creation. Rule: title: Windows Internet Hosted WebDav Share Mount Via Net.EXE id: 7e6237fe-3ddb-438f-9381-9bf9de5af8d0 status: test description: Detects when an internet hosted webdav share is mounted using the "net.exe" utility references: - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-21 modified: 2023-07-25 tags: - attack.lateral-movement - attack.t1021.002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \net.exe - \net1.exe - OriginalFileName: - net.exe - net1.exe selection_cli: CommandLine|contains|all: - ' use ' - ' http' condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects usage of cmdkey to look for cached credentials on the system. Logsource: windows / process_creation. Rule: title: Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE id: 07f8bdc2-c9b3-472a-9817-5a670b872f53 status: test description: Detects usage of cmdkey to look for cached credentials on the system references: - https://www.peew.pw/blog/2017/11/26/exploring-cmdkey-an-edge-case-for-privilege-escalation - https://technet.microsoft.com/en-us/library/cc754243(v=ws.11).aspx - https://github.com/redcanaryco/atomic-red-team/blob/b27a3cb25025161d49ac861cb216db68c46a3537/atomics/T1003.005/T1003.005.md#atomic-test-1---cached-credential-dump-via-cmdkey author: jmallette, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2019-01-16 modified: 2024-03-05 tags: - attack.credential-access - attack.t1003.005 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \cmdkey.exe - OriginalFileName: cmdkey.exe selection_cli: CommandLine|contains|windash: ' -l' condition: all of selection* falsepositives: - Legitimate administrative tasks level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_cmdkey_recon/info.yml simulation: - type: atomic-red-team name: Cached Credential Dump via Cmdkey technique: T1003.005 atomic_guid: 56506854-89d6-46a3-9804-b7fde90791f9
Query: alert when Detects installation of suspicious packages using system installation utilities
Matching passage: Sigma rule: Detects installation of suspicious packages using system installation utilities. Logsource: linux / process_creation. Rule: title: Suspicious Package Installed - Linux id: 700fb7e8-2981-401c-8430-be58e189e741 status: test description: Detects installation of suspicious packages using system installation utilities references: - https://gist.githubusercontent.com/MichaelKoczwara/12faba9c061c12b5814b711166de8c2f/raw/e2068486692897b620c25fde1ea258c8218fe3d3/history.txt author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-03 modified: 2026-01-01 tags: - attack.defense-impairment - attack.t1553.004 logsource: product: linux category: process_creation detection: selection_tool_apt: Image|endswith: - /apt - /apt-get CommandLine|contains: install selection_tool_yum: Image|endswith: /yum CommandLine|contains: - localinstall - install selection_tool_rpm: Image|endswith: /rpm CommandLine|contains: -i selection_tool_dpkg: Image|endswith: /dpkg CommandLine|contains: - --install - -i selection_keyword: CommandLine|contains: - nmap - ' nc' - netcat - wireshark - tshark - openconnect - proxychains - socat condition: 1 of selection_tool_* and selection_keyword falsepositives: - Legitimate administration activities level: medium
Near-miss passage: Sigma rule: Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-. Logsource: windows / process_creation. Rule: title: Terminal Service Process Spawn id: 1012f107-b8f1-4271-af30-5aed2de89b39 status: test description: Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708) references: - https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708/ author: Florian Roth (Nextron Systems) date: 2019-05-22 modified: 2023-01-25 tags: - attack.initial-access - attack.t1190 - attack.lateral-movement - attack.t1210 - car.2013-07-002 logsource: product: windows category: process_creation detection: selection: ParentCommandLine|contains|all: - \svchost.exe - termsvcs filter_img: Image|endswith: - \rdpclip.exe - :\Windows\System32\csrss.exe - :\Windows\System32\wininit.exe - :\Windows\System32\winlogon.exe filter_null: Image: null condition: selection and not 1 of filter_* falsepositives: - Unknown level: high
Query: describe CVE-2015-8350
Matching passage: CVE-2015-8350. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in the Calls to Action plugin before 2.5.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) open-tab parameter in a wp_cta_global_settings action to wp-admin/edit.php or (2) wp-cta-variation-id parameter to ab-testing-call-to-action-example/.
Near-miss passage: CVE-2015-6475. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in IBC Solar ServeMaster TLP+ and Danfoss TLX Pro+ allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: vulnerability: Cross-site request forgery (CSRF) vulnerability in SearchBlox before 8.2 allows remote attackers to hijack the authentication of arbitrary users.
Matching passage: CVE-2015-0970. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in SearchBlox before 8.2 allows remote attackers to hijack the authentication of arbitrary users.
Near-miss passage: CVE-2015-9388. CWE: CWE-352. CVSS: 6.5. The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/edit.php CSRF with resultant XSS.
Query: CVE similar to CVE-2015-0212
Matching passage: CVE-2015-0212. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in course/pending.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted course summary.
Near-miss passage: CVE-2015-9412. CWE: CWE-79. CVSS: 6.099999904632568. The Royal-Slider plugin before 3.2.7 for WordPress has XSS via the rstype parameter.