alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: patch priority for CVE-2015-5100
Matching passage: CVE-2015-5100. CWE: CWE-119. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3095, CVE-2015-5087, CVE-2015-5094, CVE-2015-5102, CVE-2015-5103, CVE-2015-5104, and CVE-2015-5115.
Near-miss passage: CVE-2015-6068. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6072, CVE-2015-6073, CVE-2015-6075, CVE-2015-6077, CVE-2015-6079, CVE-2015-6080, and CVE-2015-6082.
Query: vulnerability: HP ArcSight SmartConnectors before 7.1.6 do not verify X.509 certificates from Logger devices, which allows man-in-the-middle attackers to spoof devices and obtain sensitive inform
Matching passage: CVE-2015-2902. CWE: CWE-310. CVSS: 6.800000190734863. HP ArcSight SmartConnectors before 7.1.6 do not verify X.509 certificates from Logger devices, which allows man-in-the-middle attackers to spoof devices and obtain sensitive information via a crafted certificate.
Near-miss passage: CVE-2015-4550. CWE: CWE-310. CVSS: 4.300000190734863. The Cavium cryptographic-module firmware on Cisco Adaptive Security Appliance (ASA) devices with software 9.3(3) and 9.4(1.1) does not verify the AES-GCM Integrity Check Value (ICV) octets, which makes it easier for man-in-the-middle attackers to spoof IPSec and IKEv2 traffic by modifying packet data, aka Bug ID CSCuu66218.
Query: CVE similar to CVE-2015-7654
Matching passage: CVE-2015-7654. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via crafted attachSound arguments, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.
Near-miss passage: CVE-2015-1921. CWE: UNKNOWN. CVSS: 6.400000095367432. Open redirect vulnerability in IBM WebSphere Portal 8.0.0 before 8.0.0.1 CF17 and 8.5.0 before CF06 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL.
Query: CVE similar to CVE-2015-1198
Matching passage: CVE-2015-1198. CWE: CWE-22. CVSS: 7.5. Multiple directory traversal vulnerabilities in ha 0.999p+dfsg-5.
Near-miss passage: CVE-2015-1195. CWE: CWE-22. CVSS: 6.5. The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a filesystem: URL in the image location property. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9493.
Query: CVE similar to CVE-2015-8738
Matching passage: CVE-2015-8738. CWE: CWE-20. CVSS: 5.5. The s7comm_decode_ud_cpu_szl_subfunc function in epan/dissectors/packet-s7comm_szl_ids.c in the S7COMM dissector in Wireshark 2.0.x before 2.0.1 does not validate the list count in an SZL response, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted packet.
Near-miss passage: CVE-2015-1102. CWE: CWE-20. CVSS: 7.099999904632568. The kernel in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 does not properly handle TCP headers, which allows man-in-the-middle attackers to cause a denial of service via unspecified vectors.
Query: EDR alert: possible PowerShell Profile (T1546.013)
Matching passage: T1546.013 PowerShell Profile. Tactics: privilege escalation, persistence. Description: Adversaries may gain persistence and elevate privileges by executing malicious content triggered by PowerShell profiles. A PowerShell profile (<code>profile.ps1</code>) is a script that runs when [PowerShell](https://attack.mitre.org/techniques/T1059/001) starts and can be used as a logon script to customize user environments. [PowerShell](https://attack.mitre.org/techniques/T1059/001) supports several profiles depending on the user or host program. For example, there can be different profiles for [PowerShell](https://attack.mitre.org/techniques/T1059/001) host programs such as the PowerShell console, PowerShell ISE or Visual Studio Code. An administrator can also configure a profile that applies to all users and host programs on the local computer. (Citation: Microsoft About Profiles) Adversaries may modify these profiles to include arbitrary commands, functions, modules, and/or [PowerShell](https://attack.mitre.org/techniques/T1059/001) drives to gain persistence. Every time a user opens a [PowerShell](https://attack.mitre.org/techniques/T1059/001) session the modified script will be executed unless the <code>-NoProfile</code> flag is used when it is launched. (Citation: ESET Turla PowerShell May 2019) An adversary may also be able to escalate privileges if a script in a PowerShell profile is loaded and executed by an account with higher privileges, such as a domain administrator. (Citation: Wits End and Shady PowerShell Profiles)
Near-miss passage: T1546.006 LC_LOAD_DYLIB Addition. Tactics: privilege escalation, persistence. Description: Adversaries may establish persistence by executing malicious content triggered by the execution of tainted binaries. Mach-O binaries have a series of headers that are used to perform certain operations when a binary is loaded. The LC_LOAD_DYLIB header in a Mach-O binary tells macOS and OS X which dynamic libraries (dylibs) to load during execution time. These can be added ad-hoc to the compiled binary as long as adjustments are made to the rest of the fields and dependencies.(Citation: Writing Bad Malware for OSX) There are tools available to perform these changes. Adversaries may modify Mach-O binary headers to load and execute malicious dylibs every time the binary is executed. Although any changes will invalidate digital signatures on binaries because the binary is being modified, this can be remediated by simply removing the LC_CODE_SIGNATURE command from the binary so that the signature isn’t checked at load time.(Citation: Malware Persistence on OS X)
Query: describe CVE-2015-3991
Matching passage: CVE-2015-3991. CWE: CWE-19. CVSS: 9.800000190734863. strongSwan 5.2.2 and 5.3.0 allows remote attackers to cause a denial of service (daemon crash) or execute arbitrary code.
Near-miss passage: CVE-2015-0819. CWE: CWE-19. CVSS: 4.300000190734863. The UITour::onPageEvent function in Mozilla Firefox before 36.0 does not ensure that an API call originates from a foreground tab, which allows remote attackers to conduct spoofing and clickjacking attacks by leveraging access to a UI Tour web site.
Query: exploit The dissect_dcom_OBJREF function in epan/dissectors/packet-dcom.c in the DCOM dissector in Wireshark 1.12.x before 1.12.9 does not initialize a certain IPv4 data structure, which a
Matching passage: CVE-2015-8714. CWE: CWE-20. CVSS: 5.5. The dissect_dcom_OBJREF function in epan/dissectors/packet-dcom.c in the DCOM dissector in Wireshark 1.12.x before 1.12.9 does not initialize a certain IPv4 data structure, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Near-miss passage: CVE-2015-8476. CWE: CWE-20. CVSS: 5.0. Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP commands via CRLF sequences in an (1) email address to the validateAddress function in class.phpmailer.php or (2) SMTP command to the sendCommand function in class.smtp.php, a different vulnerability than CVE-2012-0796.
Query: patch priority for CVE-2015-4607
Matching passage: CVE-2015-4607. CWE: UNKNOWN. CVSS: 7.5. Unrestricted file upload vulnerability in the Frontend User Upload (feupload) extension 0.5.0 and earlier for TYPO3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension using a frontend form, then accessing it via a direct request to the file in the fileadmin folder.
Near-miss passage: CVE-2015-3131. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3118, CVE-2015-3124, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, CVE-2015-4430, and CVE-2015-5117.
Query: describe CVE-2015-8797
Matching passage: CVE-2015-8797. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in webapp/web/js/scripts/plugins.js in the stats page in the Admin UI in Apache Solr before 5.3.1 allows remote attackers to inject arbitrary web script or HTML via the entry parameter to a plugins/cache URI.
Near-miss passage: CVE-2015-7365. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the plugin upgrade form in Revive Adserver before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via the filename of an uploaded file containing errors.
Query: exploit pax 1:20140703 allows remote attackers to write to arbitrary files via a symlink attack in an archive.
Matching passage: CVE-2015-1194. CWE: CWE-59. CVSS: 4.300000190734863. pax 1:20140703 allows remote attackers to write to arbitrary files via a symlink attack in an archive.
Near-miss passage: CVE-2015-1331. CWE: CWE-59. CVSS: 4.900000095367432. lxclock.c in LXC 1.1.2 and earlier allows local users to create arbitrary files via a symlink attack on /run/lock/lxc/*.
Query: EDR alert: possible Search Threat Vendor Data (T1681)
Matching passage: T1681 Search Threat Vendor Data. Tactics: reconnaissance. Description: Threat actors may seek information/indicators from closed or open threat intelligence sources gathered about their own campaigns, as well as those conducted by other adversaries that may align with their target industries, capabilities/objectives, or other operational concerns. These reports may include descriptions of behavior, detailed breakdowns of attacks, atomic indicators such as malware hashes or IP addresses, timelines of a group’s activity, and more. Adversaries may change their behavior when planning their future operations. Adversaries have been observed replacing atomic indicators mentioned in blog posts in under a week.(Citation: Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023) Adversaries have also been seen searching for their own domain names in threat vendor data and then taking them down, likely to avoid seizure or further investigation.(Citation: Sentinel One Contagious Interview ClickFix September 2025) This technique is distinct from [Threat Intel Vendors](https://attack.mitre.org/techniques/T1597/001) in that it describes threat actors performing reconnaissance on their own activity, not in search of victim information.
Near-miss passage: T1590.005 IP Addresses. Tactics: reconnaissance. Description: Adversaries may gather the victim's IP addresses that can be used during targeting. Public IP addresses may be allocated to organizations by block, or a range of sequential addresses. Information about assigned IP addresses may include a variety of details, such as which IP addresses are in use. IP addresses may also enable an adversary to derive other details about a victim, such as organizational size, physical location(s), Internet service provider, and or where/how their publicly-facing infrastructure is hosted. Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about assigned IP addresses may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: Circl Passive DNS) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133)).
Query: detect Detects scenarios where one can control another users or computers account without having to use their credentials. in logs
Matching passage: Sigma rule: Detects scenarios where one can control another users or computers account without having to use their credentials.. Logsource: windows / security. Rule: title: Active Directory User Backdoors id: 300bac00-e041-4ee2-9c36-e262656a6ecc status: test description: Detects scenarios where one can control another users or computers account without having to use their credentials. references: - https://msdn.microsoft.com/en-us/library/cc220234.aspx - https://adsecurity.org/?p=3466 - https://blog.harmj0y.net/redteaming/another-word-on-delegation/ author: '@neu5ron' date: 2017-04-13 modified: 2024-02-26 tags: - attack.privilege-escalation - attack.t1098 - attack.persistence logsource: product: windows service: security definition: 'Requirements: Audit Policy : Account Management > Audit User Account Management, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management\Audit User Account Management, DS Access > Audit Directory Service Changes, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\DS Access\Audit Directory Service Changes' detection: selection1: EventID: 4738 filter_empty: AllowedToDelegateTo: - '' - '-' filter_null: AllowedToDelegateTo: null selection_5136_1: EventID: 5136 AttributeLDAPDisplayName: msDS-AllowedToDelegateTo selection_5136_2: EventID: 5136 ObjectClass: user AttributeLDAPDisplayName: servicePrincipalName selection_5136_3: EventID: 5136 AttributeLDAPDisplayName: msDS-AllowedToActOnBehalfOfOtherIdentity condition: (selection1 and not 1 of filter_*) or 1 of selection_5136_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects attempts to enable the root account via "dsenableroot". Logsource: macos / process_creation. Rule: title: Root Account Enable Via Dsenableroot id: 821bcf4d-46c7-4b87-bc57-9509d3ba7c11 status: test description: Detects attempts to enable the root account via "dsenableroot" references: - https://github.com/redcanaryco/atomic-red-team/blob/b27a3cb25025161d49ac861cb216db68c46a3537/atomics/T1078.003/T1078.003.md - https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/persistence_enable_root_account.toml - https://ss64.com/osx/dsenableroot.html author: Sohan G (D4rkCiph3r) date: 2023-08-22 tags: - attack.privilege-escalation - attack.stealth - attack.t1078 - attack.t1078.001 - attack.t1078.003 - attack.initial-access - attack.persistence logsource: category: process_creation product: macos detection: selection: Image|endswith: /dsenableroot filter_main_disable: CommandLine|contains: ' -d ' condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Query: write Sigma for Detects the creation of a file with the ".pdf" extension by the "RegEdit.exe" process. This indicates that a user is try
Matching passage: Sigma rule: Detects the creation of a file with the ".pdf" extension by the "RegEdit.exe" process. This indicates that a user is try. Logsource: windows / file_event. Rule: title: PDF File Created By RegEdit.EXE id: 145095eb-e273-443b-83d0-f9b519b7867b status: test description: 'Detects the creation of a file with the ".pdf" extension by the "RegEdit.exe" process. This indicates that a user is trying to print/save a registry key as a PDF in order to potentially extract sensitive information and bypass defenses. ' references: - https://sensepost.com/blog/2024/dumping-lsa-secrets-a-story-about-task-decorrelation/ author: Nasreddine Bencherchali (Nextron Systems) date: 2024-07-08 tags: - attack.stealth logsource: category: file_event product: windows detection: selection: Image|endswith: \regedit.exe TargetFilename|endswith: .pdf condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects changes to the NGenAssemblyUsageLog registry key. .NET Usage Log output location can be controlled by setting th. Logsource: windows / registry_set. Rule: title: NET NGenAssemblyUsageLog Registry Key Tamper id: 28036918-04d3-423d-91c0-55ecf99fb892 status: test description: 'Detects changes to the NGenAssemblyUsageLog registry key. .NET Usage Log output location can be controlled by setting the NGenAssemblyUsageLog CLR configuration knob in the Registry or by configuring an environment variable (as described in the next section). By simplify specifying an arbitrary value (e.g. fake output location or junk data) for the expected value, a Usage Log file for the .NET execution context will not be created. ' references: - https://bohops.com/2021/03/16/investigating-net-clr-usage-log-tampering-techniques-for-edr-evasion/ author: frack113 date: 2022-11-18 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: registry_set detection: selection: TargetObject|endswith: SOFTWARE\Microsoft\.NETFramework\NGenAssemblyUsageLog condition: selection falsepositives: - Unknown level: high
Query: what is T1037
Matching passage: T1037 Boot or Logon Initialization Scripts. Tactics: persistence, privilege escalation. Description: Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.(Citation: Mandiant APT29 Eye Spy Email Nov 22)(Citation: Anomali Rocke March 2019) Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating system and whether applied locally or remotely. Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary. An adversary may also be able to escalate their privileges since some boot or logon initialization scripts run with higher privileges.
Near-miss passage: T1037.002 Login Hook. Tactics: persistence, privilege escalation. Description: Adversaries may use a Login Hook to establish persistence executed upon user logon. A login hook is a plist file that points to a specific script to execute with root privileges upon user logon. The plist file is located in the <code>/Library/Preferences/com.apple.loginwindow.plist</code> file and can be modified using the <code>defaults</code> command-line utility. This behavior is the same for logout hooks where a script can be executed upon user logout. All hooks require administrator permissions to modify or create hooks.(Citation: Login Scripts Apple Dev)(Citation: LoginWindowScripts Apple Dev) Adversaries can add or insert a path to a malicious script in the <code>com.apple.loginwindow.plist</code> file, using the <code>LoginHook</code> or <code>LogoutHook</code> key-value pair. The malicious script is executed upon the next user login. If a login hook already exists, adversaries can add additional commands to an existing login hook. There can be only one login and logout hook on a system at a time.(Citation: S1 macOs Persistence)(Citation: Wardle Persistence Chapter) **Note:** Login hooks were deprecated in 10.11 version of macOS in favor of [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) and [Launch Agent](https://attack.mitre.org/techniques/T1543/001)
Query: Sigma rule for Detects activity when a member is removed from a security-enabled global group
Matching passage: Sigma rule: Detects activity when a member is removed from a security-enabled global group. Logsource: windows / security. Rule: title: A Member Was Removed From a Security-Enabled Global Group id: 02c39d30-02b5-45d2-b435-8aebfe5a8629 related: - id: 9cf01b6c-e723-4841-a868-6d7f8245ca6e type: obsolete status: stable description: Detects activity when a member is removed from a security-enabled global group references: - https://www.cisecurity.org/controls/cis-controls-list/ - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4729 - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=633 author: Alexandr Yampolskyi, SOC Prime date: 2023-04-26 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: product: windows service: security detection: selection: EventID: - 633 - 4729 condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects enumeration of local network configuration. Logsource: macos / process_creation. Rule: title: System Network Discovery - macOS id: 58800443-f9fc-4d55-ae0c-98a3966dfb97 status: test description: Detects enumeration of local network configuration references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md author: remotephone, oscd.community date: 2020-10-06 modified: 2024-08-29 tags: - attack.discovery - attack.t1016 logsource: product: macos category: process_creation detection: selection_1: Image|endswith: - /arp - /ifconfig - /netstat - /networksetup - /socketfilterfw selection_2: Image: /usr/bin/defaults CommandLine|contains|all: - /Library/Preferences/com.apple.alf - read filter_main_wifivelocityd: ParentImage|endswith: /wifivelocityd condition: 1 of selection_* and not 1 of filter_main_* falsepositives: - Legitimate administration activities level: informational