alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-8408
Matching passage: CVE-2015-8408. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, CVE-2015-8451, and CVE-2015-8455.
Near-miss passage: CVE-2015-1345. CWE: CWE-119. CVSS: 2.0999999046325684. The bmexec_trans function in kwset.c in grep 2.19 through 2.21 allows local users to cause a denial of service (out-of-bounds heap read and crash) via crafted input when using the -F option.
Query: risk of The web administration tool in IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 be
Matching passage: CVE-2015-1974. CWE: CWE-264. CVSS: 6.5. The web administration tool in IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 allows remote authenticated users to bypass intended command restrictions via unspecified vectors.
Near-miss passage: CVE-2015-2348. CWE: CWE-264. CVSS: 5.0. The move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 truncates a pathname upon encountering a \x00 character, which allows remote attackers to bypass intended extension restrictions and create files with unexpected names via a crafted second argument. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243.
Query: CVE similar to CVE-2015-8413
Matching passage: CVE-2015-8413. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Near-miss passage: CVE-2015-0881. CWE: UNKNOWN. CVSS: 4.300000190734863. CRLF injection vulnerability in Squid before 3.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted header in a response.
Query: CVE similar to CVE-2015-6309
Matching passage: CVE-2015-6309. CWE: CWE-399. CVSS: 6.800000190734863. Cisco Email Security Appliance (ESA) 8.5.6-106 and 9.6.0-042 allows remote authenticated users to cause a denial of service (file-descriptor consumption and device reload) via crafted HTTP requests, aka Bug ID CSCuw32211.
Near-miss passage: CVE-2015-0586. CWE: CWE-399. CVSS: 7.800000190734863. The Network-Based Application Recognition (NBAR) protocol implementation in Cisco IOS 15.3(100)M and earlier on Cisco 2900 Integrated Services Router (aka Cisco Internet Router) devices allows remote attackers to cause a denial of service (NBAR process hang) via IPv4 packets, aka Bug ID CSCuo73682.
Query: incident response steps for Multiple failed authentications followed by Server
Matching passage: Playbook for T1583.004 Server. 1) Validate alert telemetry against T1583.004. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: resource development. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may buy, lease, rent, or obtain physical servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, such as watering hole operations in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), enabling [Phishing](https://attack.mitr
Near-miss passage: Playbook for T1583.003 Virtual Private Server. Different response path focused on resource development.
Query: explain CWE-1088
Matching passage: CWE-1088 Synchronous Access of Remote Resource without Timeout. The code has a synchronous call to a remote resource, but there is no timeout for the call, or the timeout is set to infinite.
Near-miss passage: CWE-761 Free of Pointer not at Start of Buffer. The product calls free() on a pointer to a memory resource that was allocated on the heap, but the pointer is not at the start of the buffer.
Query: describe CVE-2015-7817
Matching passage: CVE-2015-7817. CWE: CWE-362. CVSS: 7.099999904632568. Race condition in the administration-panel web service in IBM System Networking Switch Center (SNSC) before 7.3.1.5 and Lenovo Switch Center before 8.1.2.0 allows remote attackers to obtain privileged-account access, and consequently provide FileReader.jsp input containing directory traversal sequences to read arbitrary text files, via a request to port 40080 or 40443.
Near-miss passage: CVE-2015-1200. CWE: CWE-362. CVSS: 2.0999999046325684. Race condition in pxz 4.999.99 Beta 3 uses weak file permissions for the output file when compressing a file before changing the permission to match the original file, which allows local users to bypass the intended access restrictions.
Query: vulnerability: SQL injection vulnerability in Joomla! Component Contact Form Maker 1.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Matching passage: CVE-2015-2798. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in Joomla! Component Contact Form Maker 1.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Near-miss passage: CVE-2015-10016. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability, which was classified as critical, has been found in jeff-kelley opensim-utils. Affected by this issue is the function DatabaseForRegion of the file regionscrits.php. The manipulation of the argument region leads to sql injection. The patch is identified as c29e5c729a833a29dbf5b1e505a0553fe154575e. It is recommended to apply a patch to fix this issue. VDB-217550 is the identifier assigned to this vulnerability.
Query: risk of Local privilege escalation vulnerability in the Gentoo QEMU package before 2.5.0-r1.
Matching passage: CVE-2015-8556. CWE: CWE-362. CVSS: 10.0. Local privilege escalation vulnerability in the Gentoo QEMU package before 2.5.0-r1.
Near-miss passage: CVE-2015-4481. CWE: CWE-362. CVSS: 3.299999952316284. Race condition in the Mozilla Maintenance Service in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Windows allows local users to write to arbitrary files and consequently gain privileges via vectors involving a hard link to a log file during an update.
Query: common weakness: Improper Filtering of Special Elements
Matching passage: CWE-790 Improper Filtering of Special Elements. The product receives data from an upstream component, but does not filter or incorrectly filters special elements before sending it to a downstream component.
Near-miss passage: CWE-211 Externally-Generated Error Message Containing Sensitive Information. The product performs an operation that triggers an external diagnostic or error message that is not directly generated or controlled by the product, such as an error generated by the programming language interpreter that a software application uses. The error can contain sensitive system information.
Query: common weakness: Multiple Operations on Resource in Single-Operation Context
Matching passage: CWE-675 Multiple Operations on Resource in Single-Operation Context. The product performs the same operation on a resource two or more times, when the operation should only be applied once.
Near-miss passage: CWE-807 Reliance on Untrusted Inputs in a Security Decision. The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.
Query: vulnerability: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via vectors related to RMI.
Matching passage: CVE-2015-4903. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via vectors related to RMI.
Near-miss passage: CVE-2015-0510. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle Commerce Platform component in Oracle Commerce Platform 9.4, 10.0, and 10.2 allows remote attackers to affect integrity via vectors related to Dynamo Application Framework - HTML Admin User Interface.
Query: detection rule: Detects the execution of a text-based file access or inspection utilities to read the content of /etc/sudoers in order t
Matching passage: Sigma rule: Detects the execution of a text-based file access or inspection utilities to read the content of /etc/sudoers in order t. Logsource: linux / process_creation. Rule: title: Access of Sudoers File Content id: 0f79c4d2-4e1f-4683-9c36-b5469a665e06 status: test description: Detects the execution of a text-based file access or inspection utilities to read the content of /etc/sudoers in order to potentially list all users that have sudo rights. references: - https://github.com/sleventyeleven/linuxprivchecker/ author: Florian Roth (Nextron Systems) date: 2022-06-20 modified: 2025-06-04 tags: - attack.reconnaissance - attack.t1592.004 logsource: category: process_creation product: linux detection: selection: Image|endswith: - /cat - /ed - /egrep - /emacs - /fgrep - /grep - /head - /less - /more - /nano - /tail CommandLine|contains: ' /etc/sudoers' condition: selection falsepositives: - Legitimate administration activities level: medium
Near-miss passage: Sigma rule: Detects Windows Installer service (msiexec.exe) spawning "cmd" or "powershell". Logsource: windows / process_creation. Rule: title: Always Install Elevated MSI Spawned Cmd And Powershell id: 1e53dd56-8d83-4eb4-a43e-b790a05510aa status: test description: Detects Windows Installer service (msiexec.exe) spawning "cmd" or "powershell" references: - https://image.slidesharecdn.com/kheirkhabarovoffzonefinal-181117201458/95/hunting-for-privilege-escalation-in-windows-environment-50-638.jpg author: Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community date: 2020-10-13 modified: 2022-10-20 tags: - attack.privilege-escalation - attack.t1548.002 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - Cmd.Exe - PowerShell.EXE - pwsh.dll selection_parent: ParentImage|contains|all: - \Windows\Installer\ - msi ParentImage|endswith: tmp condition: all of selection_* falsepositives: - Unknown level: medium
Query: describe CVE-2015-2390
Matching passage: CVE-2015-2390. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2385, CVE-2015-2397, CVE-2015-2404, CVE-2015-2406, and CVE-2015-2422.
Near-miss passage: CVE-2015-4141. CWE: CWE-119. CVSS: 4.300000190734863. The WPS UPnP function in hostapd, when using WPS AP, and wpa_supplicant, when using WPS external registrar (ER), 0.7.0 through 2.4 allows remote attackers to cause a denial of service (crash) via a negative chunk length, which triggers an out-of-bounds read or heap-based buffer overflow.
Query: Sigma YAML for linux / auditd
Matching passage: Sigma rule: Detects the removal of system firewall rules. Adversaries may only delete or modify a specific system firewall rule to b. Logsource: linux / auditd. Rule: title: Modify System Firewall id: 323ff3f5-0013-4847-bbd4-250b5edb62cc related: - id: 53059bc0-1472-438b-956a-7508a94a91f0 type: similar status: test description: 'Detects the removal of system firewall rules. Adversaries may only delete or modify a specific system firewall rule to bypass controls limiting network usage or access. Detection rules that match only on the disabling of firewalls will miss this. ' references: - https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html - https://blog.aquasec.com/container-security-tnt-container-attack - https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/configuring_and_managing_networking/getting-started-with-nftables_configuring-and-managing-networking author: IAI date: 2023-03-06 modified: 2025-10-12 tags: - attack.defense-impairment - attack.t1686 logsource: product: linux service: auditd detection: selection1: type: EXECVE a0: iptables a1|contains: DROP selection2: type: EXECVE a0: firewall-cmd a1|contains: remove selection3: type: EXECVE a0: ufw a1|contains: delete selection4: type: EXECVE a0: nft a1|contains: - delete - flush condition: 1 of selection* falsepositives: - Legitimate admin activity level: medium
Near-miss passage: Sigma rule: Detects application popup reporting a failure of the Sysmon service. Logsource: windows / system. Rule: title: Sysmon Application Crashed id: 4d7f1827-1637-4def-8d8a-fd254f9454df status: test description: Detects application popup reporting a failure of the Sysmon service references: - https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows10/1803/W10_1803_Pro_19700101_17134.1/WEPExplorer/Application%20Popup.xml#L36 author: Tim Shelton date: 2022-04-26 modified: 2024-01-17 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: system detection: selection: Provider_Name: Application Popup EventID: 26 Caption: - sysmon64.exe - Application Error - sysmon.exe - Application Error condition: selection falsepositives: - Unknown level: high
Query: exploit Malicious file execution vulnerability in Intel Security McAfee Security Scan+ (MSS+) before 3.11.266.3 allows attackers to make the product momentarily vulnerable via executing pr
Matching passage: CVE-2015-8991. CWE: CWE-264. CVSS: 7.0. Malicious file execution vulnerability in Intel Security McAfee Security Scan+ (MSS+) before 3.11.266.3 allows attackers to make the product momentarily vulnerable via executing preexisting specifically crafted malware during installation or uninstallation, but not during normal operation.
Near-miss passage: CVE-2015-6348. CWE: CWE-264. CVSS: 4.0. The report-generation web interface in the Solution Engine in Cisco Secure Access Control Server (ACS) 5.7(0.15) allows remote authenticated users to bypass intended RBAC restrictions, and read report or status information, by visiting an unspecified web page.
Query: playbook for alert: Persistence mechanism resembling KernelCallbackTable
Matching passage: Playbook for T1574.013 KernelCallbackTable. 1) Validate alert telemetry against T1574.013. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth, execution. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may abuse the <code>KernelCallbackTable</code> of a process to hijack its execution flow in order to run their own payloads.(Citation: Lazarus APT January 2022)(Citation: FinFisher exposed ) The <code>KernelCallbackTable</code> can be found in the Process Environment Block (PEB) and is initialized to an array of graphic functions available to a GUI process once <code>user32.dll</code>
Near-miss passage: Playbook for T1574.014 AppDomainManager. Different response path focused on stealth, execution.
Query: alert when Detects the use of CleanWipe a tool usually used to delete Symantec antivirus.
Matching passage: Sigma rule: Detects the use of CleanWipe a tool usually used to delete Symantec antivirus.. Logsource: windows / process_creation. Rule: title: PUA - CleanWipe Execution id: f44800ac-38ec-471f-936e-3fa7d9c53100 status: test description: Detects the use of CleanWipe a tool usually used to delete Symantec antivirus. references: - https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Other/CleanWipe author: Nasreddine Bencherchali (Nextron Systems) date: 2021-12-18 modified: 2023-02-14 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection1: Image|endswith: \SepRemovalToolNative_x64.exe selection2: Image|endswith: \CATClean.exe CommandLine|contains: --uninstall selection3: Image|endswith: \NetInstaller.exe CommandLine|contains: -r selection4: Image|endswith: \WFPUnins.exe CommandLine|contains|all: - /uninstall - /enterprise condition: 1 of selection* falsepositives: - Legitimate administrative use (Should be investigated either way) level: high
Near-miss passage: Sigma rule: Detects a TacticalRMM service installation. Tactical RMM is a remote monitoring & management tool.. Logsource: windows / system. Rule: title: TacticalRMM Service Installation id: 4bb79b62-ef12-4861-981d-2aab43fab642 status: test description: Detects a TacticalRMM service installation. Tactical RMM is a remote monitoring & management tool. references: - https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-11-28 tags: - attack.command-and-control - attack.t1219.002 logsource: product: windows service: system detection: selection_root: Provider_Name: Service Control Manager EventID: 7045 selection_service: - ImagePath|contains: tacticalrmm.exe - ServiceName|contains: TacticalRMM Agent Service condition: all of selection_* falsepositives: - Legitimate use of the tool level: medium
Query: rule covering The 'LsaRegisterLogonProcess' function verifies that the application making the function call is a logon process by chec
Matching passage: Sigma rule: The 'LsaRegisterLogonProcess' function verifies that the application making the function call is a logon process by chec. Logsource: windows / security. Rule: title: User Couldn't Call a Privileged Service 'LsaRegisterLogonProcess' id: 6daac7fc-77d1-449a-a71a-e6b4d59a0e54 status: test description: The 'LsaRegisterLogonProcess' function verifies that the application making the function call is a logon process by checking that it has the SeTcbPrivilege privilege set. Possible Rubeus tries to get a handle to LSA. references: - https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1 author: Roberto Rodriguez (source), Ilyas Ochkov (rule), oscd.community date: 2019-10-24 modified: 2022-12-25 tags: - attack.credential-access - attack.lateral-movement - attack.privilege-escalation - attack.t1558.003 logsource: product: windows service: security detection: selection: EventID: 4673 Service: LsaRegisterLogonProcess() Keywords: '0x8010000000000000' condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of the Restic backup tool, which can be used for data exfiltration. Threat actors may leverage Res. Logsource: windows / process_creation. Rule: title: PUA - Restic Backup Tool Execution id: 6ddff2e8-ea1a-45d0-8938-93dfc1d67ae7 status: experimental description: 'Detects the execution of the Restic backup tool, which can be used for data exfiltration. Threat actors may leverage Restic to back up and exfiltrate sensitive data to remote storage locations, including cloud services. If not legitimately used in the enterprise environment, its presence may indicate malicious activity. ' references: - https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware/#exfiltration - https://restic.net/ - https://restic.readthedocs.io/en/stable/030_preparing_a_new_repo.html author: Nounou Mbeiri, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-10-17 tags: - attack.exfiltration - attack.t1048 - attack.t1567.002 logsource: product: windows category: process_creation detection: selection_specific: - CommandLine|contains|all: - --password-file - init - ' -r ' - CommandLine|contains|all: - --use-fs-snapshot - backup - ' -r ' selection_restic: CommandLine|contains: - 'sftp:' - rest:http - s3:s3. - s3.http - 'azure:' - ' gs:' - 'rclone:' - 'swift:' - ' b2:' CommandLine|contains|all: - ' init ' - ' -r ' condition: 1 of selection_* falsepositives: - Legitimate use of Restic for backup purposes within the organization. level: high
Query: vulnerability: Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.1.5, 11.1.1.7, 11.1.2.1, and 11.1.2.2 allows remote attackers to affect confidenti
Matching passage: CVE-2015-0434. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.1.5, 11.1.1.7, 11.1.2.1, and 11.1.2.2 allows remote attackers to affect confidentiality via vectors related to Integration with OAM.
Near-miss passage: CVE-2015-0436. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle iLearning component in Oracle iLearning 6.0 and 6.1 allows remote attackers to affect confidentiality via unknown vectors related to Login.