alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit Cross-site request forgery (CSRF) vulnerability in XZERES 442SR OS on 442SR wind turbines allows remote attackers to hijack the authentication of admins for requests that select a 
Matching passage: CVE-2015-3950. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in XZERES 442SR OS on 442SR wind turbines allows remote attackers to hijack the authentication of admins for requests that select a different default admin user via a GET request.
Near-miss passage: CVE-2015-2009. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in the xmlrpc.cgi service in IBM QRadar SIEM 7.1 before MR2 Patch 11 Interim Fix 02 and 7.2.x before 7.2.5 Patch 4 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences via vectors related to webmin. IBM X-Force ID: 103921.
Query: Sigma YAML for linux / process_creation
Matching passage: Sigma rule: Detects the execution of a text-based file access or inspection utilities to read the content of /etc/sudoers in order t. Logsource: linux / process_creation. Rule: title: Access of Sudoers File Content id: 0f79c4d2-4e1f-4683-9c36-b5469a665e06 status: test description: Detects the execution of a text-based file access or inspection utilities to read the content of /etc/sudoers in order to potentially list all users that have sudo rights. references: - https://github.com/sleventyeleven/linuxprivchecker/ author: Florian Roth (Nextron Systems) date: 2022-06-20 modified: 2025-06-04 tags: - attack.reconnaissance - attack.t1592.004 logsource: category: process_creation product: linux detection: selection: Image|endswith: - /cat - /ed - /egrep - /emacs - /fgrep - /grep - /head - /less - /more - /nano - /tail CommandLine|contains: ' /etc/sudoers' condition: selection falsepositives: - Legitimate administration activities level: medium
Near-miss passage: Sigma rule: Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of. Logsource: windows / image_load. Rule: title: Clfs.SYS Loaded By Process Located In a Potential Suspicious Location id: fb4e2211-6d08-426b-8e6f-0d4a161e3b1d status: experimental description: Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of many CVEs exploits that targets Common Log File. references: - https://ssd-disclosure.com/ssd-advisory-common-log-file-system-clfs-driver-pe/ - https://x.com/Threatlabz/status/1879956781360976155 author: X__Junior date: 2025-01-20 tags: - attack.execution - attack.t1059 logsource: category: image_load product: windows detection: selection_dll: ImageLoaded|endswith: \clfs.sys selection_folders_1: Image|contains: - :\Perflogs\ - :\Users\Public\ - \Temporary Internet - \Windows\Temp\ selection_folders_2: - Image|contains|all: - :\Users\ - \Favorites\ - Image|contains|all: - :\Users\ - \Favourites\ - Image|contains|all: - :\Users\ - \Contacts\ - Image|contains|all: - :\Users\ - \Pictures\ condition: selection_dll and 1 of selection_folders_* falsepositives: - Unknown level: medium
Query: detect SNMP (MIB Dump)
Matching passage: T1602.001 SNMP (MIB Dump). Tactics: collection. Description: Adversaries may target the Management Information Base (MIB) to collect and/or mine valuable information in a network managed using Simple Network Management Protocol (SNMP). The MIB is a configuration repository that stores variable information accessible via SNMP in the form of object identifiers (OID). Each OID identifies a variable that can be read or set and permits active management tasks, such as configuration changes, through remote modification of these variables. SNMP can give administrators great insight in their systems, such as, system information, description of hardware, physical location, and software packages(Citation: SANS Information Security Reading Room Securing SNMP Securing SNMP). The MIB may also contain device operational information, including running configuration, routing table, and interface details. Adversaries may use SNMP queries to collect MIB content directly from SNMP-managed devices in order to collect network information that allows the adversary to build network maps and facilitate future targeted exploitation.(Citation: US-CERT-TA18-106A)(Citation: Cisco Blog Legacy Device Attacks)
Near-miss passage: T1602.002 Network Device Configuration Dump. Tactics: collection. Description: Adversaries may access network configuration files to collect sensitive data about the device and the network. The network configuration is a file containing parameters that determine the operation of the device. The device typically stores an in-memory copy of the configuration while operating, and a separate configuration on non-volatile storage to load after device reset. Adversaries can inspect the configuration files to reveal information about the target network and its layout, the network device and its software, or identifying legitimate accounts and credentials for later use. Adversaries can use common management tools and protocols, such as Simple Network Management Protocol (SNMP) and Smart Install (SMI), to access network configuration files.(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)(Citation: Cisco Blog Legacy Device Attacks) These tools may be used to query specific data from a configuration repository or configure the device to export the configuration for later analysis.
Query: describe CVE-2015-4400
Matching passage: CVE-2015-4400. CWE: CWE-255. CVSS: 4.599999904632568. Ring (formerly DoorBot) video doorbells allow remote attackers to obtain sensitive information about the wireless network configuration by pressing the set up button and leveraging an API in the GainSpan Wi-Fi module.
Near-miss passage: CVE-2015-1842. CWE: CWE-255. CVSS: 10.0. The puppet manifests in the Red Hat openstack-puppet-modules package before 2014.2.13-2 uses a default password of CHANGEME for the pcsd daemon, which allows remote attackers to execute arbitrary shell commands via unspecified vectors.
Query: Sigma YAML for macos / process_creation
Matching passage: Sigma rule: Detects attempts to enable the root account via "dsenableroot". Logsource: macos / process_creation. Rule: title: Root Account Enable Via Dsenableroot id: 821bcf4d-46c7-4b87-bc57-9509d3ba7c11 status: test description: Detects attempts to enable the root account via "dsenableroot" references: - https://github.com/redcanaryco/atomic-red-team/blob/b27a3cb25025161d49ac861cb216db68c46a3537/atomics/T1078.003/T1078.003.md - https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/persistence_enable_root_account.toml - https://ss64.com/osx/dsenableroot.html author: Sohan G (D4rkCiph3r) date: 2023-08-22 tags: - attack.privilege-escalation - attack.stealth - attack.t1078 - attack.t1078.001 - attack.t1078.003 - attack.initial-access - attack.persistence logsource: category: process_creation product: macos detection: selection: Image|endswith: /dsenableroot filter_main_disable: CommandLine|contains: ' -d ' condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects when adversaries stop services or processes by deleting their respective scheduled tasks in order to conduct dat. Logsource: windows / process_creation. Rule: title: Delete Important Scheduled Task id: dbc1f800-0fe0-4bc0-9c66-292c2abe3f78 related: - id: 9e3cb244-bdb8-4632-8c90-6079c8f4f16d type: similar - id: 7595ba94-cf3b-4471-aa03-4f6baa9e5fad type: similar status: test description: Detects when adversaries stop services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-09 modified: 2026-03-11 tags: - attack.impact - attack.t1489 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \schtasks.exe - OriginalFileName: schtasks.exe selection_cli_delete: CommandLine|contains|windash: /delete selection_cli_task: CommandLine|contains: - \Windows\BitLocker - \Windows\ExploitGuard - \Windows\SystemRestore\SR - \Windows\UpdateOrchestrator\ - \Windows\Windows Defender\ - \Windows\WindowsBackup\ - \Windows\WindowsUpdate\ condition: all of selection_* falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_schtasks_delete/info.yml
Query: Sigma YAML for opencanary / application
Matching passage: Sigma rule: Detects instances where an OpenCanary node has been targeted by a NMAP XMAS Scan. Logsource: opencanary / application. Rule: title: OpenCanary - NMAP XMAS Scan id: d7553d7b-f485-479c-b192-cdac6edd83a4 status: experimental description: Detects instances where an OpenCanary node has been targeted by a NMAP XMAS Scan references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Marco Pedrinazzi (@pedrinazziM) date: 2026-01-06 tags: - attack.discovery - attack.t1046 logsource: category: application product: opencanary detection: selection: logtype: 5004 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detect scenarios where a potentially unauthorized application or user is modifying the system time.. Logsource: windows / security. Rule: title: Unauthorized System Time Modification id: faa031b5-21ed-4e02-8881-2591f98d82ed status: test description: Detect scenarios where a potentially unauthorized application or user is modifying the system time. references: - Private Cuckoo Sandbox (from many years ago, no longer have hash, NDA as well) - Live environment caused by malware - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4616 author: '@neu5ron' date: 2019-02-05 modified: 2025-12-03 tags: - attack.stealth - attack.t1070.006 logsource: product: windows service: security definition: 'Requirements: Audit Policy : System > Audit Security State Change, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\System\Audit Security State Change' detection: selection: EventID: 4616 filter_main_svchost: ProcessName: C:\Windows\System32\svchost.exe SubjectUserSid: S-1-5-19 filter_optional_vmtools: ProcessName: - C:\Program Files\VMware\VMware Tools\vmtoolsd.exe - C:\Program Files (x86)\VMware\VMware Tools\vmtoolsd.exe - C:\Windows\System32\VBoxService.exe - C:\Windows\System32\oobe\msoobe.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - HyperV or other virtualization technologies with binary not listed in filter portion of detection level: low
Query: CVE similar to CVE-2015-3224
Matching passage: CVE-2015-3224. CWE: CWE-284. CVSS: 4.300000190734863. request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request.
Near-miss passage: CVE-2015-7494. CWE: CWE-284. CVSS: 2.799999952316284. A vulnerability has been identified in IBM Cloud Orchestrator services/[action]/launch API. An authenticated domain admin user might modify cross domain resources via a /services/[action]/launch API call, provided it would have been possible for the domain admin user to gain access to a resource identifier of the other domain.
Query: exploit The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.
Matching passage: CVE-2015-0899. CWE: CWE-20. CVSS: 7.5. The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.
Near-miss passage: CVE-2015-2463. CWE: CWE-20. CVSS: 9.300000190734863. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Office 2007 SP3 and 2010 SP2, Live Meeting 2007 Console, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, Lync Basic 2013 SP1, Silverlight before 5.1.40728, and .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 allow remote attackers to execute arbitrary code via a crafted TrueType font, aka "TrueType Font Parsing Vulnerability," a different vulnerability than CVE-2015-2464.
Query: patch priority for CVE-2015-4410
Matching passage: CVE-2015-4410. CWE: CWE-20. CVSS: 7.5. The Moped::BSON::ObjecId.legal? method in rubygem-moped before commit dd5a7c14b5d2e466f7875d079af71ad19774609b allows remote attackers to cause a denial of service (worker resource consumption) or perform a cross-site scripting (XSS) attack via a crafted string.
Near-miss passage: CVE-2015-5828. CWE: CWE-20. CVSS: 4.300000190734863. The API in the WebKit Plug-ins component in Apple Safari before 9 does not provide notification of an HTTP Redirection (aka 3xx) status code to a plugin, which allows remote attackers to bypass intended request restrictions via a crafted web site.
Query: exploit The ReduceTransitionElementsKind function in hydrogen-check-elimination.cc in Google V8 before 4.2.77.8, as used in Google Chrome before 42.0.2311.90, allows remote attackers to ca
Matching passage: CVE-2015-1242. CWE: UNKNOWN. CVSS: 7.5. The ReduceTransitionElementsKind function in hydrogen-check-elimination.cc in Google V8 before 4.2.77.8, as used in Google Chrome before 42.0.2311.90, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that leverages "type confusion" in the check-elimination optimization.
Near-miss passage: CVE-2015-7917. CWE: UNKNOWN. CVSS: 7.199999809265137. Untrusted search path vulnerability in Open Automation OPC Systems.NET 8.00.0023 and earlier allows local users to gain privileges via a Trojan horse DLL in an unspecified directory.
Query: exploit Thales nShield Connect hardware models 500, 1500, 6000, 500+, 1500+, and 6000+ before 11.72 allows physically proximate attackers to sign arbitrary data with previously loaded sign
Matching passage: CVE-2015-1878. CWE: CWE-264. CVSS: 6.800000190734863. Thales nShield Connect hardware models 500, 1500, 6000, 500+, 1500+, and 6000+ before 11.72 allows physically proximate attackers to sign arbitrary data with previously loaded signing keys, extract the device identification key [KNETI] and impersonate the nShield Connect device on a network, affect the integrity and confidentiality of newly created keys, and potentially cause other unspecified impacts using previously loaded keys by connecting to the USB port on the front panel.
Near-miss passage: CVE-2015-4303. CWE: CWE-264. CVSS: 6.5. Cisco TelePresence Video Communication Server (VCS) X8.5.2 allows remote authenticated users to execute arbitrary commands in the context of the nobody user account via an unspecified web-page parameter, aka Bug ID CSCuv12333.
Query: detection rule: Detects Obfuscated Powershell via COMPRESS OBFUSCATION
Matching passage: Sigma rule: Detects Obfuscated Powershell via COMPRESS OBFUSCATION. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell id: 20e5497e-331c-4cd5-8d36-935f6e2a9a07 status: test description: Detects Obfuscated Powershell via COMPRESS OBFUSCATION references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Timur Zinniatullin, oscd.community date: 2020-10-18 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_4104: ScriptBlockText|contains|all: - new-object - text.encoding]::ascii ScriptBlockText|contains: - system.io.compression.deflatestream - system.io.streamreader ScriptBlockText|endswith: readtoend condition: selection_4104 falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the creation or modification of files within the "sudoers.d" directory on Linux systems. Such activity may indic. Logsource: linux / file_event. Rule: title: Persistence Via Sudoers.d Files id: ddb26b76-4447-4807-871f-1b035b2bfa5d status: test description: 'Detects the creation or modification of files within the "sudoers.d" directory on Linux systems. Such activity may indicate an attempt to establish or maintain privilege escalation by granting specific users elevated permissions. Unauthorized changes to sudoers files are a common technique used by attackers to persist administrative access. ' references: - https://github.com/h3xduck/TripleCross/blob/1f1c3e0958af8ad9f6ebe10ab442e75de33e91de/apps/deployer.sh author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-05 modified: 2026-03-18 tags: - attack.privilege-escalation - attack.persistence - attack.t1548.003 logsource: product: linux category: file_event detection: selection: TargetFilename|startswith: /etc/sudoers.d/ filter_main_dpkg: Image|endswith: /usr/bin/dpkg TargetFilename: /etc/sudoers.d/README.dpkg-new condition: selection and not 1 of filter_main_* falsepositives: - Creation of legitimate files in sudoers.d folder as part of administrator work level: medium
Query: exploit WebKit in Apple iOS before 9.2 and Safari before 9.0.2 misparses content extensions, which allows remote attackers to obtain sensitive browsing-history information via a crafted we
Matching passage: CVE-2015-7050. CWE: CWE-200. CVSS: 4.300000190734863. WebKit in Apple iOS before 9.2 and Safari before 9.0.2 misparses content extensions, which allows remote attackers to obtain sensitive browsing-history information via a crafted web site.
Near-miss passage: CVE-2015-5898. CWE: CWE-200. CVSS: 2.0999999046325684. CFNetwork in Apple iOS before 9 relies on the hardware UID for its cache encryption key, which makes it easier for physically proximate attackers to obtain sensitive information by obtaining this UID.
Query: alert when Detects when the password policy is enumerated.
Matching passage: Sigma rule: Detects when the password policy is enumerated.. Logsource: windows / security. Rule: title: Password Policy Enumerated id: 12ba6a38-adb3-4d6b-91ba-a7fb248e3199 status: test description: Detects when the password policy is enumerated. references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4661 - https://github.com/jpalanco/alienvault-ossim/blob/f74359c0c027e42560924b5cff25cdf121e5505a/os-sim/agent/src/ParserUtil.py#L951 author: Zach Mathis date: 2023-05-19 tags: - attack.discovery - attack.t1201 logsource: product: windows service: security definition: dfd8c0f4-e6ad-4e07-b91b-f2fca0ddef64 detection: selection: EventID: 4661 AccessList|contains: '%%5392' ObjectServer: Security Account Manager condition: selection level: medium
Near-miss passage: Sigma rule: Detects use of an encoded/obfuscated version of an IP address (hex, octal...) in an URL combined with a download command. Logsource: windows / process_creation. Rule: title: Obfuscated IP Download Activity id: cb5a2333-56cf-4562-8fcb-22ba1bca728d status: test description: Detects use of an encoded/obfuscated version of an IP address (hex, octal...) in an URL combined with a download command references: - https://h.43z.one/ipconverter/ - https://twitter.com/Yasser_Elsnbary/status/1553804135354564608 - https://twitter.com/fr0s7_/status/1712780207105404948 author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems) date: 2022-08-03 modified: 2026-03-16 tags: - attack.discovery logsource: category: process_creation product: windows detection: selection_command: CommandLine|contains: - Invoke-WebRequest - 'iwr ' - Invoke-RestMethod - 'irm ' - 'wget ' - 'curl ' - DownloadFile - DownloadString selection_ip_1: CommandLine|contains: - ' 0x' - //0x - .0x - .00x selection_ip_2: CommandLine|contains|all: - http://% - '%2e' selection_ip_3: - CommandLine|re: https?://[0-9]{1,3}\.[0-9]{1,3}\.0[0-9]{3,4} - CommandLine|re: https?://[0-9]{1,3}\.0[0-9]{3,7} - CommandLine|re: https?://0[0-9]{3,11} - CommandLine|re: https?://(?:0[0-9]{1,11}\.){3}0[0-9]{1,11} - CommandLine|re: https?://0[0-9]{1,11} - CommandLine|re: ' [0-7]{7,13}' filter_main_valid_ip: CommandLine|re: https?://(?:(?:25[0-5]|(?:2[0-4]|1\d|[1-9])?\d)(?:\.|\b)){4} condition: selection_command and 1 of selection_ip_* and not 1 of filter_main_* falsepositives: - Unknown level: medium
Query: exploit Multiple cross-site scripting (XSS) vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to inject arbitrary web script or HTML via vectors re
Matching passage: CVE-2015-4072. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to inject arbitrary web script or HTML via vectors related to name and message.
Near-miss passage: CVE-2015-9282. CWE: CWE-79. CVSS: 6.099999904632568. The Pie Chart Panel plugin through 2019-01-02 for Grafana is vulnerable to XSS via legend data or tooltip data. When a chart is included in a Grafana dashboard, this vulnerability could allow an attacker to gain remote unauthenticated access to the dashboard.
Query: patch priority for CVE-2015-8716
Matching passage: CVE-2015-8716. CWE: CWE-20. CVSS: 5.5. The init_t38_info_conv function in epan/dissectors/packet-t38.c in the T.38 dissector in Wireshark 1.12.x before 1.12.9 does not ensure that a conversation exists, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Near-miss passage: CVE-2015-8670. CWE: CWE-20. CVSS: 6.5. Huawei LogCenter V100R001C10 could allow an authenticated attacker to add abnormal device information to the log collection module, causing denial of service.
Query: secure coding against External Initialization of Trusted Variables or Data Stores
Matching passage: CWE-454 External Initialization of Trusted Variables or Data Stores. The product initializes critical internal variables or data stores using inputs that can be modified by untrusted actors.
Near-miss passage: CWE-682 Incorrect Calculation. The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.
Query: describe CVE-2015-3334
Matching passage: CVE-2015-3334. CWE: CWE-17. CVSS: 4.300000190734863. browser/ui/website_settings/website_settings.cc in Google Chrome before 42.0.2311.90 does not always display "Media: Allowed by you" in a Permissions table after the user has granted camera permission to a web site, which might make it easier for user-assisted remote attackers to obtain sensitive video data from a device's physical environment via a crafted web site that turns on the camera at a time when the user believes that camera access is prohibited.
Near-miss passage: CVE-2015-2738. CWE: CWE-17. CVSS: 10.0. The YCbCrImageDataDeserializer::ToDataSourceSurface function in the YCbCr implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 reads data from uninitialized memory locations, which has unspecified impact and attack vectors.
Query: describe CVE-2015-3170
Matching passage: CVE-2015-3170. CWE: CWE-254. CVSS: 5.5. selinux-policy when sysctl fs.protected_hardlinks are set to 0 allows local users to cause a denial of service (SSH login prevention) by creating a hardlink to /etc/passwd from a directory named .config, and updating selinux-policy.
Near-miss passage: CVE-2015-5856. CWE: CWE-254. CVSS: 4.300000190734863. The Application Store component in Apple iOS before 9 allows remote attackers to cause a denial of service to an enterprise-signed app via a crafted ITMS URL.