alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of The font mapper in win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Wind
Matching passage: CVE-2015-0060. CWE: CWE-19. CVSS: 4.699999809265137. The font mapper in win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly scale fonts, which allows local users to cause a denial of service (system hang) via a crafted application, aka "Windows Font Driver Denial of Service Vulnerability."
Near-miss passage: CVE-2015-8240. CWE: CWE-19. CVSS: 7.5. The Traffic Management Microkernel (TMM) in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, and BIG-IP PEM before 11.4.1 HF10, 11.5.x before 11.5.4, and 11.6.x before 11.6.0 HF6 and BIG-IP PSM before 11.4.1 HF10 does not properly handle TCP options, which allows remote attackers to cause a denial of service via unspecified vectors, related to the tm.minpathmtu database variable.
Query: risk of Directory Traversal was discovered in University of Cambridge mod_ucam_webauth before 2.0.2. The key identification field ("kid") of the IdP's HTTP response message ("WLS-Response"
Matching passage: CVE-2015-9287. CWE: CWE-22. CVSS: 9.800000190734863. Directory Traversal was discovered in University of Cambridge mod_ucam_webauth before 2.0.2. The key identification field ("kid") of the IdP's HTTP response message ("WLS-Response") can be manipulated by an attacker. The "kid" field is not signed like the rest of the message, and manipulation is therefore trivial. The "kid" field should only ever represent an integer. However, it is possible to provide any string value. An attacker could use this to their advantage to force the application agent to load the RSA public key required for message integrity checking from an unintended location.
Near-miss passage: CVE-2015-1003. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in IniNet embeddedWebServer (aka eWebServer) before 2.02 allows remote attackers to read arbitrary files via a crafted pathname.
Query: Sigma rule for Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network fil
Matching passage: Sigma rule: Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network fil. Logsource: windows / ps_script. Rule: title: Change User Agents with WebRequest id: d4488827-73af-4f8d-9244-7b7662ef046e status: test description: 'Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1071.001/T1071.001.md#t1071001---web-protocols author: frack113 date: 2022-01-23 modified: 2025-07-18 tags: - attack.command-and-control - attack.t1071.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_webrequest: ScriptBlockText|contains: - Invoke-WebRequest - Invoke-RestMethod - ' irm ' - 'iwr ' selection_useragent: ScriptBlockText|contains: '-UserAgent ' condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects suspicious computer name samtheadmin-{1..100}$ generated by hacktool. Logsource: windows / security. Rule: title: Win Susp Computer Name Containing Samtheadmin id: 39698b3f-da92-4bc6-bfb5-645a98386e45 status: test description: Detects suspicious computer name samtheadmin-{1..100}$ generated by hacktool references: - https://twitter.com/malmoeb/status/1511760068743766026 - https://github.com/helloexp/0day/blob/614227a7b9beb0e91e7e2c6a5e532e6f7a8e883c/00-CVE_EXP/CVE-2021-42287/sam-the-admin/sam_the_admin.py author: elhoim date: 2022-09-09 modified: 2023-01-04 tags: - attack.initial-access - cve.2021-42278 - cve.2021-42287 - attack.persistence - attack.privilege-escalation - attack.stealth - attack.t1078 logsource: service: security product: windows detection: selection1: SamAccountName|startswith: SAMTHEADMIN- SamAccountName|endswith: $ selection2: TargetUserName|startswith: SAMTHEADMIN- TargetUserName|endswith: $ condition: 1 of selection* falsepositives: - Unknown level: critical
Query: CVE similar to CVE-2015-1251
Matching passage: CVE-2015-1251. CWE: UNKNOWN. CVSS: 6.800000190734863. Use-after-free vulnerability in the SpeechRecognitionClient implementation in the Speech subsystem in Google Chrome before 43.0.2357.65 allows remote attackers to execute arbitrary code via a crafted document.
Near-miss passage: CVE-2015-2594. CWE: UNKNOWN. CVSS: 6.599999904632568. Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 4.0.32, 4.1.40, 4.2.32, and 4.3.30 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core.
Query: rule covering Detects Windows Installer service (msiexec.exe) spawning "cmd" or "powershell"
Matching passage: Sigma rule: Detects Windows Installer service (msiexec.exe) spawning "cmd" or "powershell". Logsource: windows / process_creation. Rule: title: Always Install Elevated MSI Spawned Cmd And Powershell id: 1e53dd56-8d83-4eb4-a43e-b790a05510aa status: test description: Detects Windows Installer service (msiexec.exe) spawning "cmd" or "powershell" references: - https://image.slidesharecdn.com/kheirkhabarovoffzonefinal-181117201458/95/hunting-for-privilege-escalation-in-windows-environment-50-638.jpg author: Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community date: 2020-10-13 modified: 2022-10-20 tags: - attack.privilege-escalation - attack.t1548.002 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - Cmd.Exe - PowerShell.EXE - pwsh.dll selection_parent: ParentImage|contains|all: - \Windows\Installer\ - msi ParentImage|endswith: tmp condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects usage of Sysinternals PsService which can be abused for service reconnaissance and tampering. Logsource: windows / process_creation. Rule: title: Sysinternals PsService Execution id: 3371f518-5fe3-4cf6-a14b-2a0ae3fd8a4f status: test description: Detects usage of Sysinternals PsService which can be abused for service reconnaissance and tampering references: - https://learn.microsoft.com/en-us/sysinternals/downloads/psservice author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-16 modified: 2026-06-29 tags: - attack.privilege-escalation - attack.discovery - attack.persistence - attack.t1543.003 logsource: category: process_creation product: windows detection: selection: - OriginalFileName: psservice.exe - Image|endswith: - \PsService.exe - \PsService64.exe - \PsService64a.exe condition: selection falsepositives: - Legitimate use of PsService by an administrator level: medium
Query: risk of In FreeType before 2.6.1, a buffer over-read occurs in type1/t1parse.c on function T1_Get_Private_Dict where there is no check that the new values of cur and limit are sensible bef
Matching passage: CVE-2015-9290. CWE: CWE-125. CVSS: 9.800000190734863. In FreeType before 2.6.1, a buffer over-read occurs in type1/t1parse.c on function T1_Get_Private_Dict where there is no check that the new values of cur and limit are sensible before going to Again.
Near-miss passage: CVE-2015-8629. CWE: CWE-125. CVSS: 5.300000190734863. The xdr_nullstring function in lib/kadm5/kadm_rpc_xdr.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 does not verify whether '\0' characters exist as expected, which allows remote authenticated users to obtain sensitive information or cause a denial of service (out-of-bounds read) via a crafted string.
Query: describe CVE-2015-5061
Matching passage: CVE-2015-5061. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 and earlier allows remote authenticated users with permissions to add new vendors to inject arbitrary web script or HTML via the organizationName parameter to VendorDef.do.
Near-miss passage: CVE-2015-0901. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the duwasai flashy theme 1.3 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: risk of Multiple SQL injection vulnerabilities in admin.php in the Collne Welcart plugin before 1.5.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via t
Matching passage: CVE-2015-7791. CWE: CWE-89. CVSS: 6.300000190734863. Multiple SQL injection vulnerabilities in admin.php in the Collne Welcart plugin before 1.5.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) search[column] or (2) switch parameter.
Near-miss passage: CVE-2015-7517. CWE: CWE-89. CVSS: 9.800000190734863. Multiple SQL injection vulnerabilities in the Double Opt-In for Download plugin before 2.0.9 for WordPress allow remote attackers to execute arbitrary SQL commands via the ver parameter to (1) class-doifd-download.php or (2) class-doifd-landing-page.php in public/includes/.
Query: patch priority for CVE-2015-5846
Matching passage: CVE-2015-5846. CWE: CWE-119. CVSS: 9.300000190734863. IOKit in the kernel in Apple iOS before 9 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2015-5844 and CVE-2015-5845.
Near-miss passage: CVE-2015-4004. CWE: CWE-119. CVSS: 8.5. The OZWPAN driver in the Linux kernel through 4.0.5 relies on an untrusted length field during packet parsing, which allows remote attackers to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read and system crash) via a crafted packet.
Query: risk of The scalar-function implementation in IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote attackers to cause 
Matching passage: CVE-2015-1935. CWE: CWE-17. CVSS: 8.0. The scalar-function implementation in IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote attackers to cause a denial of service or execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-0173. CWE: CWE-17. CVSS: 4.300000190734863. The HTTP connection-management functionality in Internet Pass-Thru (IPT) before 2.1.0.2 in IBM WebSphere MQ, when HTTPS is disabled, does not properly generate MQIPT Session IDs, which makes it easier for remote attackers to bypass intended restrictions on MQ message data by predicting an ID value.
Query: Sigma YAML for linux / process_creation
Matching passage: Sigma rule: Detects disabling security tools. Logsource: linux / process_creation. Rule: title: Disabling Security Tools id: e3a8a052-111f-4606-9aee-f28ebeb76776 status: test description: Detects disabling security tools references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md author: Ömer Günal, Alejandro Ortuno, oscd.community date: 2020-06-17 modified: 2022-10-09 tags: - attack.defense-impairment - attack.t1686 logsource: category: process_creation product: linux detection: selection_iptables_1: Image|endswith: /service CommandLine|contains|all: - iptables - stop selection_iptables_2: Image|endswith: /service CommandLine|contains|all: - ip6tables - stop selection_iptables_3: Image|endswith: /chkconfig CommandLine|contains|all: - iptables - stop selection_iptables_4: Image|endswith: /chkconfig CommandLine|contains|all: - ip6tables - stop selection_firewall_1: Image|endswith: /systemctl CommandLine|contains|all: - firewalld - stop selection_firewall_2: Image|endswith: /systemctl CommandLine|contains|all: - firewalld - disable selection_carbonblack_1: Image|endswith: /service CommandLine|contains|all: - cbdaemon - stop selection_carbonblack_2: Image|endswith: /chkconfig CommandLine|contains|all: - cbdaemon - 'off' selection_carbonblack_3: Image|endswith: /systemctl CommandLine|contains|all: - cbdaemon - stop selection_carbonblack_4: Image|endswith: /systemctl CommandLine|contains|all: - cbdaemon - disable selection_selinux: Image|endswith: /setenforce CommandLine|contains: '0' selection_crowdstrike_1: Image|endswith: /systemctl CommandLine|contains|all: - stop - falcon-sensor selection_crowdstrike_2: Image|endswith: /systemctl CommandLine|contains|all: - disable - falcon-sensor condition: 1 of selection* falsepositives: - Legitimate administration activities level: medium
Near-miss passage: Sigma rule: Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22). Logsource: windows / process_creation. Rule: title: UAC Bypass Using Consent and Comctl32 - Process id: 1ca6bd18-0ba0-44ca-851c-92ed89a61085 status: test description: Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-23 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \consent.exe Image|endswith: \werfault.exe IntegrityLevel: - High - System - S-1-16-16384 - S-1-16-12288 condition: selection falsepositives: - Unknown level: high
Query: detect Detects the use of wmic.exe to modify user account settings and explicitly disable password expiration. in logs
Matching passage: Sigma rule: Detects the use of wmic.exe to modify user account settings and explicitly disable password expiration.. Logsource: windows / process_creation. Rule: title: Password Set to Never Expire via WMI id: 7864a175-3654-4824-9f0d-f0da18ab27c0 status: experimental description: 'Detects the use of wmic.exe to modify user account settings and explicitly disable password expiration. ' references: - https://www.huntress.com/blog/the-unwanted-guest author: Daniel Koifman (KoifSec) date: 2025-07-30 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1047 - attack.t1098 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \wmic.exe - OriginalFileName: wmic.exe selection_cli: CommandLine|contains|all: - useraccount - ' set ' - passwordexpires - 'false' condition: all of selection_* falsepositives: - Legitimate administrative activity level: medium
Near-miss passage: Sigma rule: Detects ScreenConnect program starts that establish a remote access to a system.. Logsource: windows / process_creation. Rule: title: Remote Access Tool - ScreenConnect Installation Execution id: 75bfe6e6-cd8e-429e-91d3-03921e1d7962 status: test description: Detects ScreenConnect program starts that establish a remote access to a system. references: - https://www.anomali.com/blog/probable-iranian-cyber-actors-static-kitten-conducting-cyberespionage-campaign-targeting-uae-and-kuwait-government-agencies author: Florian Roth (Nextron Systems) date: 2021-02-11 modified: 2024-02-26 tags: - attack.persistence - attack.initial-access - attack.t1133 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - e=Access& - y=Guest& - '&p=' - '&c=' - '&k=' condition: selection falsepositives: - Legitimate use by administrative staff level: medium
Query: playbook for alert: SIEM correlation: credential access activity consistent with Shell History
Matching passage: Playbook for T1552.003 Shell History. 1) Validate alert telemetry against T1552.003. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: credential access. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may search the command history on compromised systems for insecurely stored credentials. On Linux and macOS systems, shells such as Bash and Zsh keep track of the commands users type on the command-line with the "history" utility. Once a user logs out, the history is flushed to the user's history file. For each user, this file resides at the same location: for example, `~/.bash_history
Near-miss passage: Playbook for T1552 Unsecured Credentials. Different response path focused on credential access.
Query: vulnerability: A vulnerable file in Opto 22 PAC Project Professional versions prior to R9.4006, PAC Project Basic versions prior to R9.4006, PAC Display Basic versions prior to R9.4f, PAC Display
Matching passage: CVE-2015-1006. CWE: CWE-121. CVSS: 9.800000190734863. A vulnerable file in Opto 22 PAC Project Professional versions prior to R9.4006, PAC Project Basic versions prior to R9.4006, PAC Display Basic versions prior to R9.4f, PAC Display Professional versions prior to R9.4f, OptoOPCServer versions prior to R9.4c, and OptoDataLink version R9.4d and prior versions that were installed by PAC Project installer, versions prior to R9.4006, is susceptible to a heap-based buffer overflow condition that may allow remote code execution on the target system. Opto 22 suggests upgrading to the new product version as soon as possible.
Near-miss passage: CVE-2015-1007. CWE: CWE-121. CVSS: 7.800000190734863. A specially crafted configuration file could be used to cause a stack-based buffer overflow condition in the OPCTest.exe, which may allow remote code execution on Opto 22 PAC Project Professional versions prior to R9.4008, PAC Project Basic versions prior to R9.4008, PAC Display Basic versions prior to R9.4g, PAC Display Professional versions prior to R9.4g, OptoOPCServer version R9.4c and prior that were installed by PAC Project installer, versions prior to R9.4008, and OptoDataLink version R9.4d and prior that were installed by PAC Project installer, versions prior to R9.4008. Opto 22 suggests upgrading to the new product version as soon as possible.
Query: containment actions for EDR alert: possible Unused/Unsupported Cloud Regions (T1535)
Matching passage: Playbook for T1535 Unused/Unsupported Cloud Regions. 1) Validate alert telemetry against T1535. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may create cloud instances in unused geographic service regions in order to evade detection. Access is usually obtained through compromising accounts used to manage cloud infrastructure. Cloud service providers often provide infrastructure throughout the world in order to improve performance, provide redundancy, and allow customers to meet compliance requirements. Oftentimes, a custome
Near-miss passage: Playbook for T1218 System Binary Proxy Execution. Different response path focused on stealth.
Query: exploit Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified
Matching passage: CVE-2015-3072. CWE: CWE-284. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified vectors, a different vulnerability than CVE-2015-3060, CVE-2015-3061, CVE-2015-3062, CVE-2015-3063, CVE-2015-3064, CVE-2015-3065, CVE-2015-3066, CVE-2015-3067, CVE-2015-3068, CVE-2015-3069, CVE-2015-3071, CVE-2015-3073, and CVE-2015-3074.
Near-miss passage: CVE-2015-8139. CWE: CWE-284. CVSS: 5.300000190734863. ntpq in NTP before 4.2.8p7 allows remote attackers to obtain origin timestamps and then impersonate peers via unspecified vectors.
Query: common weakness: Reliance on Insufficiently Trustworthy Component
Matching passage: CWE-1357 Reliance on Insufficiently Trustworthy Component. The product is built from multiple separate components, but it uses a component that is not sufficiently trusted to meet expectations for security, reliability, updateability, and maintainability.
Near-miss passage: CWE-696 Incorrect Behavior Order. The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways that may produce resultant weaknesses.
Query: detect Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons in logs
Matching passage: Sigma rule: Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons. Logsource: windows / dns_query. Rule: title: Suspicious Cobalt Strike DNS Beaconing - Sysmon id: f356a9c4-effd-4608-bbf8-408afd5cd006 related: - id: 0d18728b-f5bf-4381-9dcf-915539fff6c2 type: similar status: test description: Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons references: - https://www.icebrg.io/blog/footprints-of-fin7-tracking-actor-patterns - https://www.sekoia.io/en/hunting-and-detecting-cobalt-strike/ author: Florian Roth (Nextron Systems) date: 2021-11-09 modified: 2023-01-16 tags: - attack.command-and-control - attack.t1071.004 logsource: product: windows category: dns_query detection: selection1: QueryName|startswith: - aaa.stage. - post.1 selection2: QueryName|contains: .stage.123456. condition: 1 of selection* falsepositives: - Unknown level: critical
Near-miss passage: Sigma rule: Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where t. Logsource: windows / ps_module. Rule: title: Zip A Folder With PowerShell For Staging In Temp - PowerShell Module id: daf7eb81-35fd-410d-9d7a-657837e602bb related: - id: 71ff406e-b633-4989-96ec-bc49d825a412 type: similar - id: b7a3c9a3-09ea-4934-8864-6a32cacd98d9 type: similar - id: 85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98 type: similar status: test description: 'Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration. An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1074.001/T1074.001.md - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2021-07-20 modified: 2023-12-18 tags: - attack.collection - attack.t1074.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection: ContextInfo|contains|all: - Compress-Archive -Path*-DestinationPath $env:TEMP - Compress-Archive -Path*-DestinationPath*\AppData\Local\Temp\ - Compress-Archive -Path*-DestinationPath*:\Windows\Temp\ condition: selection falsepositives: - Unknown level: medium