alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of Cross-site scripting (XSS) vulnerability in errorfe.aspx in Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject ar
Matching passage: CVE-2015-1632. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in errorfe.aspx in Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via the msgParam parameter in an authError action, aka "Exchange Error Message Cross Site Scripting Vulnerability."
Near-miss passage: CVE-2015-5732. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the form function in the WP_Nav_Menu_Widget class in wp-includes/default-widgets.php in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via a widget title.
Query: patch priority for CVE-2015-4276
Matching passage: CVE-2015-4276. CWE: CWE-20. CVSS: 6.5. Cisco WebEx Meetings Server 2.5MR1 allows remote authenticated users to execute arbitrary code via a crafted command parameter, aka Bug ID CSCus56138.
Near-miss passage: CVE-2015-8705. CWE: CWE-20. CVSS: 7.0. buffer.c in named in ISC BIND 9.10.x before 9.10.3-P3, when debug logging is enabled, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit, or daemon crash) or possibly have unspecified other impact via (1) OPT data or (2) an ECS option.
Query: CVE similar to CVE-2015-2648
Matching passage: CVE-2015-2648. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote authenticated users to affect availability via vectors related to DML.
Near-miss passage: CVE-2015-2728. CWE: UNKNOWN. CVSS: 7.5. The IndexedDatabaseManager class in the IndexedDB implementation in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 misinterprets an unspecified IDBDatabase field as a pointer, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors, related to a "type confusion" issue.
Query: vulnerability: PowerDNS (aka pdns) Authoritative Server 3.4.4 before 3.4.7 allows remote attackers to cause a denial of service (assertion failure and server crash) via crafted query packets.
Matching passage: CVE-2015-5311. CWE: CWE-20. CVSS: 5.0. PowerDNS (aka pdns) Authoritative Server 3.4.4 before 3.4.7 allows remote attackers to cause a denial of service (assertion failure and server crash) via crafted query packets.
Near-miss passage: CVE-2015-1611. CWE: CWE-20. CVSS: 7.5. OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology and affect the flow of data, related to "fake LLDP injection."
Query: describe CVE-2015-5081
Matching passage: CVE-2015-5081. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in django CMS before 3.0.14, 3.1.x before 3.1.1 allows remote attackers to manipulate privileged users into performing unknown actions via unspecified vectors.
Near-miss passage: CVE-2015-7936. CWE: CWE-352. CVSS: 7.5. Cross-site request forgery (CSRF) vulnerability in Motorola Solutions MOSCAD IP Gateway allows remote attackers to hijack the authentication of administrators for requests that modify a password.
Query: detect Detects PowerShell commands that decrypt an ".LNK" "file to drop the next stage of the malware. in logs
Matching passage: Sigma rule: Detects PowerShell commands that decrypt an ".LNK" "file to drop the next stage of the malware.. Logsource: windows / process_creation. Rule: title: PowerShell Execution With Potential Decryption Capabilities id: 434c08ba-8406-4d15-8b24-782cb071a691 status: test description: Detects PowerShell commands that decrypt an ".LNK" "file to drop the next stage of the malware. references: - https://research.checkpoint.com/2023/chinese-threat-actors-targeting-europe-in-smugx-campaign/ author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2023-06-30 modified: 2023-12-05 tags: - attack.execution logsource: product: windows category: process_creation detection: selection_img: Image|endswith: - \powershell.exe - \pwsh.exe OriginalFileName: - PowerShell.EXE - pwsh.dll selection_cli_dir: CommandLine|contains: - 'Get-ChildItem ' - 'dir ' - 'gci ' - 'ls ' selection_cli_gc: CommandLine|contains: - 'Get-Content ' - 'gc ' - 'cat ' - 'type ' - ReadAllBytes selection_cli_specific: - CommandLine|contains|all: - ' ^| ' - \*.lnk - -Recurse - '-Skip ' - CommandLine|contains|all: - ' -ExpandProperty ' - \*.lnk - WriteAllBytes - ' .length ' condition: all of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the use of Windows Credential Editor (WCE). Logsource: windows / registry_event. Rule: title: Windows Credential Editor Registry id: a6b33c02-8305-488f-8585-03cb2a7763f2 status: test description: Detects the use of Windows Credential Editor (WCE) references: - https://www.ampliasecurity.com/research/windows-credentials-editor/ author: Florian Roth (Nextron Systems) date: 2019-12-31 modified: 2021-11-27 tags: - attack.credential-access - attack.t1003.001 - attack.s0005 logsource: category: registry_event product: windows detection: selection: TargetObject|contains: Services\WCESERVICE\Start condition: selection falsepositives: - Unknown level: critical
Query: CVE similar to CVE-2015-2272
Matching passage: CVE-2015-2272. CWE: CWE-264. CVSS: 4.0. login/token.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to bypass a forced-password-change requirement by creating a web-services token.
Near-miss passage: CVE-2015-0761. CWE: CWE-264. CVSS: 7.199999809265137. Cisco AnyConnect Secure Mobility Client before 3.1(8009) and 4.x before 4.0(2052) on Linux does not properly implement unspecified internal functions, which allows local users to obtain root privileges via crafted vpnagent options, aka Bug ID CSCus86790.
Query: patch priority for CVE-2015-3352
Matching passage: CVE-2015-3352. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the Jammer module before 6.x-1.8 and 7.x-1.x before 7.x-1.4 for Drupal allow remote attackers to hijack the authentication of administrators for requests that delete a setting for (1) hidden form elements or (2) status messages via unspecified vectors, related to "report administration."
Near-miss passage: CVE-2015-0276. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in Kallithea before 0.2.
Query: vulnerability: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 
Matching passage: CVE-2015-9171. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, if OEMCrypto_Dash_InstallEncapKeybox() is called with keyBoxLength set to a value higher than TZ_WV_MAX_DATA_LEN (20k), a buffer over-read occurs.
Near-miss passage: CVE-2015-2868. CWE: CWE-119. CVSS: 9.800000190734863. An exploitable remote code execution vulnerability exists in the Trane ComfortLink II firmware version 2.0.2 in DSS service. An attacker who can connect to the DSS service on the Trane ComfortLink II device can send an overly long REG request that can overflow a fixed size stack buffer, resulting in arbitrary code execution.
Query: detection rule: Detects when the enablement of developer features such as "Developer Mode" or "Application Sideloading". Which allows th
Matching passage: Sigma rule: Detects when the enablement of developer features such as "Developer Mode" or "Application Sideloading". Which allows th. Logsource: windows / registry_set. Rule: title: Potential Signing Bypass Via Windows Developer Features - Registry id: b110ebaf-697f-4da1-afd5-b536fa27a2c1 related: - id: a383dec4-deec-4e6e-913b-ed9249670848 type: similar status: test description: Detects when the enablement of developer features such as "Developer Mode" or "Application Sideloading". Which allows the user to install untrusted packages. references: - https://twitter.com/malmoeb/status/1560536653709598721 - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-12 modified: 2023-08-17 tags: - attack.stealth logsource: category: registry_set product: windows detection: selection: TargetObject|contains: - \Microsoft\Windows\CurrentVersion\AppModelUnlock - \Policies\Microsoft\Windows\Appx\ TargetObject|endswith: - \AllowAllTrustedApps - \AllowDevelopmentWithoutDevLicense Details: DWORD (0x00000001) condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects encoded base64 MZ header in the commandline. Logsource: windows / process_creation. Rule: title: Base64 MZ Header In CommandLine id: 22e58743-4ac8-4a9f-bf19-00a0428d8c5f status: test description: Detects encoded base64 MZ header in the commandline references: - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-12 tags: - attack.execution logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - TVqQAAMAAAAEAAAA - TVpQAAIAAAAEAA8A - TVqAAAEAAAAEABAA - TVoAAAAAAAAAAAAA - TVpTAQEAAAAEAAAA condition: selection falsepositives: - Unlikely level: high
Query: detect Detects the creation of a new PowerShell module in the first folder of the module directory structure "\WindowsPowerShel in logs
Matching passage: Sigma rule: Detects the creation of a new PowerShell module in the first folder of the module directory structure "\WindowsPowerShel. Logsource: windows / file_event. Rule: title: Potential Suspicious PowerShell Module File Created id: e8a52bbd-bced-459f-bd93-64db45ce7657 status: test description: Detects the creation of a new PowerShell module in the first folder of the module directory structure "\WindowsPowerShell\Modules\malware\malware.psm1". This is somewhat an uncommon practice as legitimate modules often includes a version folder. references: - Internal Research - https://learn.microsoft.com/en-us/powershell/scripting/developer/module/understanding-a-windows-powershell-module?view=powershell-7.3 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-09 tags: - attack.persistence logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: - \\WindowsPowerShell\\Modules\\*\.ps - \\WindowsPowerShell\\Modules\\*\.dll condition: selection falsepositives: - False positive rate will vary depending on the environments. Additional filters might be required to make this logic usable in production. level: medium
Near-miss passage: Sigma rule: Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other. Logsource: windows / process_creation. Rule: title: PUA - System Informer Execution id: 5722dff1-4bdd-4949-86ab-fbaf707e767a related: - id: 811e0002-b13b-4a15-9d00-a613fce66e42 type: similar status: test description: Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations references: - https://github.com/winsiderss/systeminformer author: Florian Roth (Nextron Systems) date: 2023-05-08 modified: 2024-11-23 tags: - attack.persistence - attack.privilege-escalation - attack.discovery - attack.stealth - attack.t1082 - attack.t1564 - attack.t1543 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \SystemInformer.exe - OriginalFileName: SystemInformer.exe - Description: System Informer - Product: System Informer - Hashes|contains: - MD5=19426363A37C03C3ED6FEDF57B6696EC - SHA1=8B12C6DA8FAC0D5E8AB999C31E5EA04AF32D53DC - SHA256=8EE9D84DE50803545937A63C686822388A3338497CDDB660D5D69CF68B68F287 - IMPHASH=B68908ADAEB5D662F87F2528AF318F12 condition: selection falsepositives: - System Informer is regularly used legitimately by system administrators or developers. Apply additional filters accordingly level: medium
Query: risk of Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Ex
Matching passage: CVE-2015-2422. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2385, CVE-2015-2390, CVE-2015-2397, CVE-2015-2404, and CVE-2015-2406.
Near-miss passage: CVE-2015-7103. CWE: CWE-119. CVSS: 6.800000190734863. WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7095, CVE-2015-7096, CVE-2015-7097, CVE-2015-7098, CVE-2015-7099, CVE-2015-7100, CVE-2015-7101, and CVE-2015-7102.
Query: CVE similar to CVE-2015-2781
Matching passage: CVE-2015-2781. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in cgi-bin/hotspotlogin.cgi in Hotspot Express hotEx Billing Manager 73 allows remote attackers to inject arbitrary web script or HTML via the reply parameter.
Near-miss passage: CVE-2015-6477. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in the Wind Farm Portal application in Nordex Control 2 (NC2) SCADA 16 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: patch priority for CVE-2015-4513
Matching passage: CVE-2015-4513. CWE: CWE-119. CVSS: 7.5. Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Near-miss passage: CVE-2015-6118. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Office 2007 SP3 and Office 2010 SP2 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Query: describe CVE-2015-2812
Matching passage: CVE-2015-2812. CWE: UNKNOWN. CVSS: 5.0. XML external entity (XXE) vulnerability in XMLValidationComponent in SAP NetWeaver Portal 7.31.201109172004 allows remote attackers to send requests to intranet servers via crafted XML, aka SAP Security Note 2093966.
Near-miss passage: CVE-2015-2656. CWE: UNKNOWN. CVSS: 6.900000095367432. Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-2583, CVE-2015-2624, CVE-2015-2626, CVE-2015-2640, CVE-2015-2654, CVE-2015-4754, CVE-2015-4764, CVE-2015-4775, CVE-2015-4776, CVE-2015-4777, CVE-2015-4778, CVE-2015-4780, CVE-2015-4781, CVE-2015-4782, CVE-2015-4783, CVE-2015-4784, CVE-2015-4785, CVE-2015-4786, CVE-2015-4787, CVE-2015-4789, and CVE-2015-4790.
Query: exploit calendar/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to obtain sensitive calendar-even
Matching passage: CVE-2015-0215. CWE: CWE-200. CVSS: 4.0. calendar/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to obtain sensitive calendar-event information via a web-services request.
Near-miss passage: CVE-2015-0260. CWE: CWE-200. CVSS: 4.0. RhodeCode before 2.2.7 and Kallithea 0.1 allows remote authenticated users to obtain API keys and other sensitive information via the get_repo API method.
Query: alert when Open a handle on the drive volume via the \\.\ DOS device path specifier and perform direct access read of the first few
Matching passage: Sigma rule: Open a handle on the drive volume via the \\.\ DOS device path specifier and perform direct access read of the first few. Logsource: windows / ps_script. Rule: title: Suspicious IO.FileStream id: 70ad982f-67c8-40e0-a955-b920c2fa05cb status: test description: Open a handle on the drive volume via the \\.\ DOS device path specifier and perform direct access read of the first few bytes of the volume. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1006/T1006.md author: frack113 date: 2022-01-09 modified: 2022-03-05 tags: - attack.stealth - attack.t1070.003 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - New-Object - IO.FileStream - \\\\.\\ condition: selection falsepositives: - Legitimate PowerShell scripts level: medium
Near-miss passage: Sigma rule: Detects the execution of rundll32 with a command line that doesn't contain a common extension. Logsource: windows / process_creation. Rule: title: Rundll32 Execution With Uncommon DLL Extension id: c3a99af4-35a9-4668-879e-c09aeb4f2bdf status: test description: Detects the execution of rundll32 with a command line that doesn't contain a common extension references: - https://twitter.com/mrd0x/status/1481630810495139841?s=12 author: Tim Shelton, Florian Roth (Nextron Systems), Yassine Oukessou date: 2022-01-13 modified: 2024-04-04 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE filter_main_null: CommandLine: null filter_main_empty: CommandLine: '' filter_main_known_extension: - CommandLine|contains: - '.cpl ' - .cpl, - .cpl" - .cpl' - '.dll ' - .dll, - .dll" - .dll' - '.inf ' - .inf, - .inf" - .inf' - CommandLine|endswith: - .cpl - .dll - '.inf' filter_main_localserver: CommandLine|contains: ' -localserver ' filter_main_zzzzInvokeManagedCustomActionOutOfProc: ParentImage|endswith: \msiexec.exe CommandLine|contains|all: - :\Windows\Installer\ - .tmp - zzzzInvokeManagedCustomActionOutOfProc filter_optional_EdgeUpdate: ParentCommandLine|contains|all: - :\Users\ - \AppData\Local\Microsoft\EdgeUpdate\Install\{ - \EDGEMITMP_ - .tmp\setup.exe - --install-archive= - --previous-version= - --msedgewebview --verbose-logging --do-not-launch-msedge --user-level condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Query: rule covering Detects the use of the PhoneDeepLink parameter to potentially sideload a DLL file that does not exist. This non-existent
Matching passage: Sigma rule: Detects the use of the PhoneDeepLink parameter to potentially sideload a DLL file that does not exist. This non-existent. Logsource: windows / process_creation. Rule: title: Potential DLL Sideloading Via DeviceEnroller.EXE id: e173ad47-4388-4012-ae62-bd13f71c18a8 related: - id: ee4c5d06-3abc-48cc-8885-77f1c20f4451 type: similar status: test description: 'Detects the use of the PhoneDeepLink parameter to potentially sideload a DLL file that does not exist. This non-existent DLL file is named "ShellChromeAPI.dll". Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter ' references: - https://mobile.twitter.com/0gtweet/status/1564131230941122561 - https://strontic.github.io/xcyclopedia/library/DeviceEnroller.exe-24BEF0D6B0ECED36BB41831759FDE18D.html author: '@gott_cyber' date: 2022-08-29 modified: 2023-02-04 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \deviceenroller.exe - OriginalFileName: deviceenroller.exe selection_cli: CommandLine|contains: /PhoneDeepLink condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects modification of autostart extensibility point (ASEP) in registry.. Logsource: windows / registry_set. Rule: title: WinSock2 Autorun Keys Modification id: d6c2ce7e-afb5-4337-9ca4-4b5254ed0565 related: - id: 17f878b8-9968-4578-b814-c4217fc5768c type: derived status: test description: Detects modification of autostart extensibility point (ASEP) in registry. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) date: 2019-10-25 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_set product: windows detection: winsock_parameters_base: TargetObject|contains: \System\CurrentControlSet\Services\WinSock2\Parameters winsock_parameters: TargetObject|contains: - \Protocol_Catalog9\Catalog_Entries - \NameSpace_Catalog5\Catalog_Entries filter: - Details: (Empty) - Image: C:\Windows\System32\MsiExec.exe - Image: C:\Windows\syswow64\MsiExec.exe condition: winsock_parameters_base and winsock_parameters and not filter falsepositives: - Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason - Legitimate administrator sets up autorun keys for legitimate reason level: medium
Query: risk of Argument injection vulnerability in devscripts before 2.15.7 allows remote attackers to write to arbitrary files via a crafted symlink and crafted filename.
Matching passage: CVE-2015-5705. CWE: CWE-59. CVSS: 7.5. Argument injection vulnerability in devscripts before 2.15.7 allows remote attackers to write to arbitrary files via a crafted symlink and crafted filename.
Near-miss passage: CVE-2015-3147. CWE: CWE-59. CVSS: 6.5. daemon/abrt-handle-upload.in in Automatic Bug Reporting Tool (ABRT), when moving problem reports from /var/spool/abrt-upload, allows local users to write to arbitrary files or possibly have other unspecified impact via a symlink attack on (1) /var/spool/abrt or (2) /var/tmp/abrt.