alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated administrators to gain root privileges via unspecified vectors, a different 
Matching passage: CVE-2015-4649. CWE: CWE-284. CVSS: 7.199999809265137. Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated administrators to gain root privileges via unspecified vectors, a different vulnerability than CVE-2015-3654.
Near-miss passage: CVE-2015-5826. CWE: CWE-284. CVSS: 4.300000190734863. WebKit in Apple iOS before 9 does not properly select the cases in which a Cascading Style Sheets (CSS) document is required to have the text/css content type, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
Query: Suspicious Data from Information Repositories execution detected on endpoint
Matching passage: T1213 Data from Information Repositories. Tactics: collection. Description: Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, such as Credential Access, Lateral Movement, or Defense Evasion, or direct access to the target information. Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization (i.e., [Transfer Data to Cloud Account](https://attack.mitre.org/techniques/T1537)). The following is a brief list of example information that may hold potential value to an adversary and may also be found on an information repository: * Policies, procedures, and standards * Physical / logical network diagrams * System architecture diagrams * Technical system documentation * Testing / development credentials (i.e., [Unsecured Credentials](https://attack.mitre.org/techniques/T1552)) * Work / project schedules * Source code snippets * Links to network shares and other internal resources * Contact or other sensitive information about business partners and customers, including personally identifiable information (PII) Information stored in a repository may vary based on the specific instance or environment. Specific common information repositories include the following: * Storage services such as IaaS databases, enterprise databases, and more specialized platforms such as customer relationship management (CRM) databases * Collaboration platforms such as SharePoint, Confluence, and code repositories * Messaging platforms such as Slack and Microsoft Teams In some cases, information repositories have been improperly secured, typically by unintentionally allowing for overly-broad access by all users or even public access to unauthenticated users. This is particularly common with cloud-native or cloud-hosted services, such as AWS Relat
Near-miss passage: T1213.001 Confluence. Tactics: collection. Description: Adversaries may leverage Confluence repositories to mine valuable information. Often found in development environments alongside Atlassian JIRA, Confluence is generally used to store development-related documentation, however, in general may contain more diverse categories of useful information, such as: * Policies, procedures, and standards * Physical / logical network diagrams * System architecture diagrams * Technical system documentation * Testing / development credentials (i.e., [Unsecured Credentials](https://attack.mitre.org/techniques/T1552)) * Work / project schedules * Source code snippets * Links to network shares and other internal resources
Query: patch priority for CVE-2015-6317
Matching passage: CVE-2015-6317. CWE: CWE-284. CVSS: 6.5. Cisco Identity Services Engine (ISE) before 2.0 allows remote authenticated users to bypass intended web-resource access restrictions via a direct request, aka Bug ID CSCuu45926.
Near-miss passage: CVE-2015-0694. CWE: CWE-284. CVSS: 5.0. Cisco ASR 9000 devices with software 5.3.0.BASE do not recognize that certain ACL entries have a single-host constraint, which allows remote attackers to bypass intended network-resource access restrictions by using an address that was not supposed to have been allowed, aka Bug ID CSCur28806.
Query: Sigma rule for Detects suspicious command lines that look as if they would create symbolic links to /etc/passwd
Matching passage: Sigma rule: Detects suspicious command lines that look as if they would create symbolic links to /etc/passwd. Logsource: linux. Rule: title: Symlink Etc Passwd id: c67fc22a-0be5-4b4f-aad5-2b32c4b69523 status: test description: Detects suspicious command lines that look as if they would create symbolic links to /etc/passwd references: - https://www.qualys.com/2021/05/04/21nails/21nails.txt author: Florian Roth (Nextron Systems) date: 2019-04-05 modified: 2021-11-27 tags: - attack.t1204.001 - attack.execution logsource: product: linux detection: keywords: - ln -s -f /etc/passwd - ln -s /etc/passwd condition: keywords falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when the Microsoft Management Console (MMC) loads the DLL libraries like vbscript, jscript etc which might indic. Logsource: windows / image_load. Rule: title: MMC Loading Script Engines DLLs id: a9c73e8b-3b2d-4c45-8ef2-5f9a9c9998ad status: experimental description: 'Detects when the Microsoft Management Console (MMC) loads the DLL libraries like vbscript, jscript etc which might indicate an attempt to execute malicious scripts within a trusted system process for bypassing application whitelisting or defense evasion. ' references: - https://tria.ge/241015-l98snsyeje/behavioral2 - https://www.elastic.co/security-labs/grimresource author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-02-05 tags: - attack.execution - attack.stealth - attack.t1059.005 - attack.t1218.014 logsource: category: image_load product: windows detection: selection: Image|endswith: \mmc.exe ImageLoaded|endswith: - \vbscript.dll - \jscript.dll - \jscript9.dll condition: selection falsepositives: - Legitimate MMC operations or extensions loading these libraries level: medium
Query: patch priority for CVE-2015-5942
Matching passage: CVE-2015-5942. CWE: CWE-119. CVSS: 6.800000190734863. FontParser in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-5927.
Near-miss passage: CVE-2015-5830. CWE: CWE-119. CVSS: 7.199999809265137. The Intel Graphics Driver component in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5877.
Query: incident response steps for Encoded PowerShell / command-line abuse matching Network Provider DLL
Matching passage: Playbook for T1556.008 Network Provider DLL. 1) Validate alert telemetry against T1556.008. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: defense impairment, persistence, credential access. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may register malicious network provider dynamic link libraries (DLLs) to capture cleartext user credentials during the authentication process. Network provider DLLs allow Windows to interface with specific network protocols and can also support add-on credential management functions.(Citation: Network Provider API) During the logon process, Winlogon (the interactive logon module) sends
Near-miss passage: Playbook for T1556.006 Multi-Factor Authentication. Different response path focused on defense impairment, persistence, credential access.
Query: describe CVE-2015-9020
Matching passage: CVE-2015-9020. CWE: CWE-476. CVSS: 7.800000190734863. In all Android releases from CAF using the Linux kernel, an untrusted pointer dereference vulnerability exists in the unlocking of memory.
Near-miss passage: CVE-2015-9072. CWE: CWE-476. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, an untrusted pointer dereference can occur in a TrustZone syscall.
Query: patch priority for CVE-2015-8059
Matching passage: CVE-2015-8059. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Near-miss passage: CVE-2015-1650. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, and Office Web Apps Server 2010 SP2 and 2013 SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Component Use After Free Vulnerability."
Query: alert when Use of the commandline to shutdown or reboot windows
Matching passage: Sigma rule: Use of the commandline to shutdown or reboot windows. Logsource: windows / process_creation. Rule: title: Suspicious Execution of Shutdown id: 34ebb878-1b15-4895-b352-ca2eeb99b274 status: test description: Use of the commandline to shutdown or reboot windows references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1529/T1529.md - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/shutdown author: frack113 date: 2022-01-01 tags: - attack.impact - attack.t1529 logsource: category: process_creation product: windows detection: selection: Image|endswith: \shutdown.exe CommandLine|contains: - '/r ' - '/s ' condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent. RMM tools suc. Logsource: windows / process_creation. Rule: title: Remote Access Tool - Renamed MeshAgent Execution - Windows id: b471f462-eb0d-4832-be35-28d94bdb4780 related: - id: bd3b5eaa-439d-4a42-8f35-a49f5c8a2582 type: similar - id: 2fbbe9ff-0afc-470b-bdc0-592198339968 type: derived status: experimental description: 'Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent. RMM tools such as MeshAgent are commonly utilized by IT administrators for legitimate remote support and system management. However, malicious actors may exploit these tools by renaming them to bypass detection mechanisms, enabling unauthorized access and control over compromised systems. ' references: - https://www.huntress.com/blog/know-thy-enemy-a-novel-november-case-on-persistent-remote-access - https://thecyberexpress.com/ukraine-hit-by-meshagent-malware-campaign/ - https://wazuh.com/blog/how-to-detect-meshagent-with-wazuh/ - https://www.security.com/threat-intelligence/medusa-ransomware-attacks author: Norbert Jaśniewicz (AlphaSOC) date: 2025-05-19 tags: - attack.command-and-control - attack.stealth - attack.t1219.002 - attack.t1036.003 logsource: category: process_creation product: windows detection: selection_meshagent: - CommandLine|contains: --meshServiceName - OriginalFileName|contains: meshagent filter_main_legitimate: Image|endswith: \meshagent.exe condition: selection_meshagent and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: telemetry for T1567
Matching passage: T1567 Exfiltration Over Web Service. Tactics: exfiltration. Description: Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services. Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Near-miss passage: T1567.002 Exfiltration to Cloud Storage. Tactics: exfiltration. Description: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet. Examples of cloud storage services include Dropbox and Google Docs. Exfiltration to these cloud storage services can provide a significant amount of cover to the adversary if hosts within the network are already communicating with the service.
Query: Persistence mechanism resembling Stored Data Manipulation
Matching passage: T1565.001 Stored Data Manipulation. Tactics: impact. Description: Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating stored data, adversaries may attempt to affect a business process, organizational understanding, and decision making. Stored data could include a variety of file formats, such as Office files, databases, stored emails, and custom file formats. The type of modification and the impact it will have depends on the type of data as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
Near-miss passage: T1565.002 Transmitted Data Manipulation. Tactics: impact. Description: Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating transmitted data, adversaries may attempt to affect a business process, organizational understanding, and decision making. Manipulation may be possible over a network connection or between system processes where there is an opportunity deploy a tool that will intercept and change information. The type of modification and the impact it will have depends on the target transmission mechanism as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
Query: exploit Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10, Excel 
Matching passage: CVE-2015-2423. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10, Excel 2007 SP3, PowerPoint 2007 SP3, Visio 2007 SP3, Word 2007 SP3, Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Visio 2010 SP2, Word 2010 SP2, Excel 2013 SP1, PowerPoint 2013 SP1, Visio 2013 SP1, Word 2013 SP1, Excel 2013 RT SP1, PowerPoint 2013 RT SP1, Visio 2013 RT SP1, Word 2013 RT SP1, and Internet Explorer 7 through 11 allow remote attackers to gain privileges and obtain sensitive information via a crafted command-line parameter to an Office application or Notepad, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "Unsafe Command Line Parameter Passing Vulnerability."
Near-miss passage: CVE-2015-2058. CWE: CWE-200. CVSS: 6.5. c2s/c2s.c in Jabber Open Source Server 2.3.2 and earlier truncates data without ensuring it remains valid UTF-8, which allows remote authenticated users to read system memory or possibly have other unspecified impact via a crafted JID.
Query: explain CWE-594
Matching passage: CWE-594 J2EE Framework: Saving Unserializable Objects to Disk. When the J2EE container attempts to write unserializable objects to disk there is no guarantee that the process will complete successfully.
Near-miss passage: CWE-451 User Interface (UI) Misrepresentation of Critical Information. The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.
Query: detect Detects UTF-8 and UTF-16 Base64 encoded powershell 'Invoke-' calls in logs
Matching passage: Sigma rule: Detects UTF-8 and UTF-16 Base64 encoded powershell 'Invoke-' calls. Logsource: windows / process_creation. Rule: title: PowerShell Base64 Encoded Invoke Keyword id: 6385697e-9f1b-40bd-8817-f4a91f40508e related: - id: fd6e2919-3936-40c9-99db-0aa922c356f7 type: obsolete status: test description: Detects UTF-8 and UTF-16 Base64 encoded powershell 'Invoke-' calls references: - https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/ author: pH-T (Nextron Systems), Harjot Singh, @cyb3rjy0t date: 2022-05-20 modified: 2023-04-06 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1027 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_cli_enc: CommandLine|contains: ' -e' selection_cli_invoke: CommandLine|contains: - SQBuAHYAbwBrAGUALQ - kAbgB2AG8AawBlAC0A - JAG4AdgBvAGsAZQAtA - SW52b2tlL - ludm9rZS - JbnZva2Ut condition: all of selection_* falsepositives: - Unknown level: high simulation: - type: atomic red team name: Create a Process using WMI Query and an Encoded Command technique: T1047 atomic_guid: 7db7a7f9-9531-4840-9b30-46220135441c regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_powershell_base64_invoke/info.yml
Near-miss passage: Sigma rule: Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing wh. Logsource: windows / process_creation. Rule: title: Python Function Execution Security Warning Disabled In Excel id: 023c654f-8f16-44d9-bb2b-00ff36a62af9 related: - id: 17e53739-a1fc-4a62-b1b9-87711c2d5e44 type: similar status: test description: 'Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed. Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet. ' references: - https://support.microsoft.com/en-us/office/data-security-and-python-in-excel-33cc88a4-4a87-485e-9ff9-f35958278327 author: '@Kostastsale' date: 2023-08-22 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - \Microsoft\Office\ - \Excel\Security - PythonFunctionWarnings CommandLine|contains: ' 0' condition: selection falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-3135
Matching passage: CVE-2015-3135. CWE: CWE-119. CVSS: 10.0. Heap-based buffer overflow in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-4432 and CVE-2015-5118.
Near-miss passage: CVE-2015-5934. CWE: CWE-119. CVSS: 6.800000190734863. Audio in Apple OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file, a different vulnerability than CVE-2015-5933.
Query: CVE similar to CVE-2015-9343
Matching passage: CVE-2015-9343. CWE: CWE-352. CVSS: 8.800000190734863. The wp-rollback plugin before 1.2.3 for WordPress has CSRF.
Near-miss passage: CVE-2015-5534. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in Oxwall before 1.8 allow remote attackers to hijack the authentication of administrators for requests that (1) put the website under maintenance via the maintenance_enable parameter or (2) conduct cross-site scripting (XSS) attacks via the maintenance_text parameter to admin/pages/maintenance.
Query: describe CVE-2015-6290
Matching passage: CVE-2015-6290. CWE: CWE-119. CVSS: 4.300000190734863. Cisco Web Security Appliance (WSA) 8.0.7 allows remote HTTP servers to cause a denial of service (memory consumption from stale TCP connections) via crafted responses, aka Bug ID CSCuw10426.
Near-miss passage: CVE-2015-3632. CWE: CWE-119. CVSS: 4.300000190734863. Foxit Reader, Enterprise Reader, and PhantomPDF before 7.1.5 allow remote attackers to cause a denial of service (memory corruption and crash) via a crafted GIF in a PDF file.