alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of The phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (heap met
Matching passage: CVE-2015-3307. CWE: CWE-119. CVSS: 7.5. The phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (heap metadata corruption) or possibly have unspecified other impact via a crafted tar archive.
Near-miss passage: CVE-2015-6080. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6068, CVE-2015-6072, CVE-2015-6073, CVE-2015-6075, CVE-2015-6077, CVE-2015-6079, and CVE-2015-6082.
Query: patch priority for CVE-2015-8213
Matching passage: CVE-2015-8213. CWE: CWE-200. CVSS: 5.0. The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY.
Near-miss passage: CVE-2015-0757. CWE: CWE-200. CVSS: 5.0. The web framework in Cisco Identity Services Engine (ISE) 1.2(1.901) and 1.3(0.722) does not properly implement session handlers, which allows remote attackers to obtain sensitive information by reading web pages, as demonstrated by MnT reports, aka Bug ID CSCuq23140.
Query: Sigma rule for Detects potential DLL sideloading of "ShellDispatch.dll"
Matching passage: Sigma rule: Detects potential DLL sideloading of "ShellDispatch.dll". Logsource: windows / image_load. Rule: title: Potential ShellDispatch.DLL Sideloading id: 844f8eb2-610b-42c8-89a4-47596e089663 status: test description: Detects potential DLL sideloading of "ShellDispatch.dll" references: - https://www.hexacorn.com/blog/2023/06/07/this-lolbin-doesnt-exist/ author: X__Junior (Nextron Systems) date: 2023-06-20 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \ShellDispatch.dll filter_main_legit_path: - ImageLoaded|contains|all: - :\Users\ - \AppData\Local\Temp\ - ImageLoaded|contains: :\Windows\Temp\ condition: selection and not 1 of filter_main_* falsepositives: - Some installers may trigger some false positives level: medium
Near-miss passage: Sigma rule: Identifies when an ElastiCache security group has been modified or deleted.. Logsource: aws / cloudtrail. Rule: title: AWS ElastiCache Security Group Modified or Deleted id: 7c797da2-9cf2-4523-ba64-33b06339f0cc status: test description: Identifies when an ElastiCache security group has been modified or deleted. references: - https://github.com/elastic/detection-rules/blob/7d5efd68603f42be5e125b5a6a503b2ef3ac0f4e/rules/integrations/aws/impact_elasticache_security_group_modified_or_deleted.toml author: Austin Songer @austinsonger date: 2021-07-24 modified: 2022-10-09 tags: - attack.impact - attack.t1531 logsource: product: aws service: cloudtrail detection: selection: eventSource: elasticache.amazonaws.com eventName: - DeleteCacheSecurityGroup - AuthorizeCacheSecurityGroupIngress - RevokeCacheSecurityGroupIngress - AuthorizeCacheSecurityGroupEgress - RevokeCacheSecurityGroupEgress condition: selection falsepositives: - A ElastiCache security group deletion may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Security Group deletions from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: low
Query: CVE similar to CVE-2015-0832
Matching passage: CVE-2015-0832. CWE: CWE-254. CVSS: 5.0. Mozilla Firefox before 36.0 does not properly recognize the equivalence of domain names with and without a trailing . (dot) character, which allows man-in-the-middle attackers to bypass the HPKP and HSTS protection mechanisms by constructing a URL with this character and leveraging access to an X.509 certificate for a domain with this character.
Near-miss passage: CVE-2015-5943. CWE: CWE-254. CVSS: 4.300000190734863. SecurityAgent in Apple OS X before 10.11.1 does not prevent synthetic clicks from reaching keychain windows, which allows attackers to bypass intended access restrictions via a crafted app.
Query: risk of Directory traversal vulnerability in the Ubuntu network-manager package for Ubuntu (vivid) before 0.9.10.0-4ubuntu15.1, Ubuntu 14.10 before 0.9.8.8-0ubuntu28.1, and Ubuntu 14.04 LT
Matching passage: CVE-2015-1322. CWE: CWE-22. CVSS: 4.599999904632568. Directory traversal vulnerability in the Ubuntu network-manager package for Ubuntu (vivid) before 0.9.10.0-4ubuntu15.1, Ubuntu 14.10 before 0.9.8.8-0ubuntu28.1, and Ubuntu 14.04 LTS before 0.9.8.8-0ubuntu7.1 allows local users to change the modem device configuration or read arbitrary files via a .. (dot dot) in the file name in a request to read modem device contexts (com.canonical.NMOfono.ReadImsiContexts).
Near-miss passage: CVE-2015-5353. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the tab parameter to admin/.
Query: detect Detects when a user downloads a file from an IP based URL using CertOC.exe in logs
Matching passage: Sigma rule: Detects when a user downloads a file from an IP based URL using CertOC.exe. Logsource: windows / process_creation. Rule: title: File Download From IP Based URL Via CertOC.EXE id: b86f6dea-0b2f-41f5-bdcc-a057bd19cd6a related: - id: 70ad0861-d1fe-491c-a45f-fa48148a300d type: similar status: test description: Detects when a user downloads a file from an IP based URL using CertOC.exe references: - https://lolbas-project.github.io/lolbas/Binaries/Certoc/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-10-18 tags: - attack.command-and-control - attack.execution - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \certoc.exe - OriginalFileName: CertOC.exe selection_ip: CommandLine|re: ://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3} selection_cli: CommandLine|contains: -GetCACAPS condition: all of selection* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects uncommon or suspicious child processes spawning from a VsCode "code.exe" process. This could indicate an attempt. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Child Process Of VsCode id: 5a3164f2-b373-4152-93cf-090b13c12d27 status: test description: Detects uncommon or suspicious child processes spawning from a VsCode "code.exe" process. This could indicate an attempt of persistence via VsCode tasks or terminal profiles. references: - https://twitter.com/nas_bench/status/1618021838407495681 - https://twitter.com/nas_bench/status/1618021415852335105 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-26 modified: 2023-10-25 tags: - attack.execution - attack.stealth - attack.t1218 - attack.t1202 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \code.exe selection_children_images: Image|endswith: - \calc.exe - \regsvr32.exe - \rundll32.exe - \cscript.exe - \wscript.exe selection_children_cli: Image|endswith: - \powershell.exe - \pwsh.exe - \cmd.exe CommandLine|contains: - Invoke-Expressions - IEX - Invoke-Command - ICM - DownloadString - rundll32 - regsvr32 - wscript - cscript selection_children_paths: Image|contains: - :\Users\Public\ - :\Windows\Temp\ - :\Temp\ condition: selection_parent and 1 of selection_children_* falsepositives: - In development environment where VsCode is used heavily. False positives may occur when developers use task to compile or execute different types of code. Remove or add processes accordingly level: medium
Query: Sigma YAML for windows / registry_event
Matching passage: Sigma rule: Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs value in the Registry key can be abused to obtain pe. Logsource: windows / registry_event. Rule: title: New DLL Added to AppCertDlls Registry Key id: 6aa1d992-5925-4e9f-a49b-845e51d1de01 status: test description: 'Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs value in the Registry key can be abused to obtain persistence and privilege escalation by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. ' references: - http://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/ - https://eqllib.readthedocs.io/en/latest/analytics/14f90406-10a0-4d36-a672-31cabe149f2f.html author: Ilyas Ochkov, oscd.community date: 2019-10-25 modified: 2021-11-27 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.009 logsource: category: registry_event product: windows detection: selection: - TargetObject: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls - NewName: HKLM\SYSTEM\CurentControlSet\Control\Session Manager\AppCertDlls condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the deletion of S3 buckets in AWS CloudTrail logs. Monitoring the deletion of S3 buckets is critical for securit. Logsource: aws / cloudtrail. Rule: title: AWS Bucket Deleted id: 39c9f26d-6e3b-4dbb-9c7a-4154b0281112 status: experimental description: 'Detects the deletion of S3 buckets in AWS CloudTrail logs. Monitoring the deletion of S3 buckets is critical for security and data integrity, as it may indicate potential data loss or unauthorized access attempts. ' references: - https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucket.html - https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/delete-bucket.html author: Ivan Saakov, Nasreddine Bencherchali date: 2025-10-19 tags: - attack.stealth logsource: product: aws service: cloudtrail detection: selection_event_name: eventName: DeleteBucket selection_status_success: errorCode: Success selection_status_null: errorCode: null condition: selection_event_name and 1 of selection_status_* falsepositives: - During maintenance operations or testing, authorized administrators may delete S3 buckets as part of routine data management or cleanup activities. level: medium
Query: rule covering Detects the creation of a schtasks that potentially executes a payload stored in the Windows Registry using PowerShell.
Matching passage: Sigma rule: Detects the creation of a schtasks that potentially executes a payload stored in the Windows Registry using PowerShell.. Logsource: windows / process_creation. Rule: title: Scheduled Task Executing Payload from Registry id: 86588b36-c6d3-465f-9cee-8f9093e07798 related: - id: c4eeeeae-89f4-43a7-8b48-8d1bdfa66c78 type: derived status: test description: Detects the creation of a schtasks that potentially executes a payload stored in the Windows Registry using PowerShell. references: - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/ author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2023-07-18 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1053.005 - attack.t1059.001 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \schtasks.exe - OriginalFileName: schtasks.exe selection_cli_create: CommandLine|contains: /Create selection_cli_get: CommandLine|contains: - Get-ItemProperty - ' gp ' selection_cli_hive: CommandLine|contains: - 'HKCU:' - 'HKLM:' - 'registry::' - HKEY_ filter_main_encoding: CommandLine|contains: - FromBase64String - encodedcommand condition: all of selection_* and not 1 of filter_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects potential credential harvesting attempts through LSASS memory dumps using ProcDump. This rule identifies suspici. Logsource: windows / process_creation. Rule: title: Potential LSASS Process Dump Via Procdump id: 5afee48e-67dd-4e03-a783-f74259dcf998 status: stable description: 'Detects potential credential harvesting attempts through LSASS memory dumps using ProcDump. This rule identifies suspicious command-line patterns that combine memory dump flags (-ma, -mm, -mp) with LSASS-related process markers. LSASS (Local Security Authority Subsystem Service) contains sensitive authentication data including plaintext passwords, NTLM hashes, and Kerberos tickets in memory. Attackers commonly dump LSASS memory to extract credentials for lateral movement and privilege escalation. ' references: - https://learn.microsoft.com/en-us/sysinternals/downloads/procdump - https://research.splunk.com/endpoint/3742ebfe-64c2-11eb-ae93-0242ac130002 - https://x.com/wietze/status/1958302556033065292?s=12 author: Florian Roth (Nextron Systems) date: 2018-10-30 modified: 2025-10-19 tags: - attack.stealth - attack.t1036 - attack.credential-access - attack.t1003.001 - car.2013-05-009 logsource: category: process_creation product: windows detection: selection_flags: CommandLine|contains|windash: - ' -ma ' - ' -mm ' - ' -mp ' selection_process: CommandLine|contains: - ' ls' - ' keyiso' - ' samss' condition: all of selection_* falsepositives: - Unlikely, because no one should dump an lsass process memory - Another tool that uses command line flags similar to ProcDump level: high
Query: vulnerability: Directory traversal vulnerability in Seeds acmailer before 3.8.18 and 3.9.x before 3.9.12 Beta allows remote authenticated users to delete arbitrary files via a crafted string.
Matching passage: CVE-2015-2971. CWE: CWE-22. CVSS: 5.5. Directory traversal vulnerability in Seeds acmailer before 3.8.18 and 3.9.x before 3.9.12 Beta allows remote authenticated users to delete arbitrary files via a crafted string.
Near-miss passage: CVE-2015-5688. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the PATH_INFO to the default URI.
Query: exploit Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via a long comment that i
Matching passage: CVE-2015-3440. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type.
Near-miss passage: CVE-2015-10098. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability was found in Broken Link Checker Plugin up to 1.10.5 on WordPress. It has been rated as problematic. Affected by this issue is the function print_module_list/show_warnings_section_notice/status_text/ui_get_action_links. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.10.6 is able to address this issue. The name of the patch is f30638869e281461b87548e40b517738b4350e47. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-225152.
Query: exploit Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, 
Matching passage: CVE-2015-5568. CWE: CWE-20. CVSS: 10.0. Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to cause a denial of service (vector-length corruption) or possibly have unspecified other impact via unknown vectors.
Near-miss passage: CVE-2015-1047. CWE: CWE-20. CVSS: 5.0. vpxd in VMware vCenter Server 5.0 before u3e, 5.1 before u3, and 5.5 before u2 allows remote attackers to cause a denial of service via a long heartbeat message.
Query: campaign using Hide Infrastructure
Matching passage: T1665 Hide Infrastructure. Tactics: command and control. Description: Adversaries may manipulate network traffic in order to hide and evade detection of their C2 infrastructure. This can be accomplished by identifying and filtering traffic from defensive tools,(Citation: TA571) masking malicious domains to obfuscate the true destination from both automated scanning tools and security researchers,(Citation: Schema-abuse)(Citation: Facad1ng)(Citation: Browser-updates) and otherwise hiding malicious artifacts to delay discovery and prolong the effectiveness of adversary infrastructure that could otherwise be identified, blocked, or taken down entirely. C2 networks may include the use of [Proxy](https://attack.mitre.org/techniques/T1090) or VPNs to disguise IP addresses, which can allow adversaries to blend in with normal network traffic and bypass conditional access policies or anti-abuse protections. For example, an adversary may use a virtual private cloud to spoof their IP address to closer align with a victim's IP address ranges. This may also bypass security measures relying on geolocation of the source IP address.(Citation: sysdig)(Citation: Orange Residential Proxies) Adversaries may also attempt to filter network traffic in order to evade defensive tools in numerous ways, including blocking/redirecting common incident responder or security appliance user agents.(Citation: mod_rewrite)(Citation: SocGholish-update) Filtering traffic based on IP and geo-fencing may also avoid automated sandboxing or researcher activity (i.e., [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497)).(Citation: TA571)(Citation: mod_rewrite) Hiding C2 infrastructure may also be supported by [Resource Development](https://attack.mitre.org/tactics/TA0042) activities such as [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) and [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584). For example, using widely trusted hosting services or domains such as prominent URL shortening providers or marketing ser
Near-miss passage: T1568 Dynamic Resolution. Tactics: command and control. Description: Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control. Adversaries may use dynamic resolution for the purpose of [Fallback Channels](https://attack.mitre.org/techniques/T1008). When contact is lost with the primary command and control server malware may employ dynamic resolution as a means to reestablishing command and control.(Citation: Talos CCleanup 2017)(Citation: FireEye POSHSPY April 2017)(Citation: ESET Sednit 2017 Activity)
Query: patch priority for CVE-2015-2618
Matching passage: CVE-2015-2618. CWE: UNKNOWN. CVSS: 2.0999999046325684. Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote authenticated users to affect integrity via unknown vectors related to Input validation.
Near-miss passage: CVE-2015-0427. CWE: UNKNOWN. CVSS: 3.200000047683716. Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 4.3.20 allows local users to affect integrity and availability via vectors related to VMSVGA virtual graphics device, a different vulnerability than CVE-2014-6588, CVE-2014-6589, CVE-2014-6590, and CVE-2014-6595.
Query: Sigma rule for Identifies when sensitive information is re-identified in google Cloud.
Matching passage: Sigma rule: Identifies when sensitive information is re-identified in google Cloud.. Logsource: gcp / gcp.audit. Rule: title: Google Cloud Re-identifies Sensitive Information id: 234f9f48-904b-4736-a34c-55d23919e4b7 status: test description: Identifies when sensitive information is re-identified in google Cloud. references: - https://cloud.google.com/dlp/docs/reference/rest/v2/projects.content/reidentify author: Austin Songer @austinsonger date: 2021-08-15 modified: 2022-10-09 tags: - attack.impact - attack.t1565 logsource: product: gcp service: gcp.audit detection: selection: gcp.audit.method_name: projects.content.reidentify condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanetsvc.exe" process usin. Logsource: windows / image_load. Rule: title: Aruba Network Service Potential DLL Sideloading id: 90ae0469-0cee-4509-b67f-e5efcef040f7 status: test description: Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanetsvc.exe" process using DLL Search Order Hijacking references: - https://twitter.com/wdormann/status/1616581559892545537?t=XLCBO9BziGzD7Bmbt8oMEQ&s=09 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-22 modified: 2023-03-15 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: Image|endswith: \arubanetsvc.exe ImageLoaded|endswith: - \wtsapi32.dll - \msvcr100.dll - \msvcp100.dll - \dbghelp.dll - \dbgcore.dll - \wininet.dll - \iphlpapi.dll - \version.dll - \cryptsp.dll - \cryptbase.dll - \wldp.dll - \profapi.dll - \sspicli.dll - \winsta.dll - \dpapi.dll filter: ImageLoaded|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ condition: selection and not filter falsepositives: - Unknown level: high
Query: describe CVE-2015-7281
Matching passage: CVE-2015-7281. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability on ReadyNet WRT300N-DD devices with firmware 1.0.26 allows remote attackers to hijack the authentication of arbitrary users.
Near-miss passage: CVE-2015-3388. CWE: CWE-352. CVSS: 5.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Commerce Balanced Payments module for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that delete the user's configured bank accounts via unspecified vectors.
Query: describe CVE-2015-2284
Matching passage: CVE-2015-2284. CWE: CWE-264. CVSS: 10.0. userlogin.jsp in SolarWinds Firewall Security Manager (FSM) before 6.6.5 HotFix1 allows remote attackers to gain privileges and execute arbitrary code via unspecified vectors, related to client session handling.
Near-miss passage: CVE-2015-0767. CWE: CWE-264. CVSS: 7.199999809265137. Cisco Edge 300 software 1.0 and 1.1 on Edge 340 devices allows local users to obtain root privileges via unspecified commands, aka Bug ID CSCur18132.