alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-5551
Matching passage: CVE-2015-5551. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5556, CVE-2015-5557, CVE-2015-5559, CVE-2015-5561, CVE-2015-5563, CVE-2015-5564, and CVE-2015-5565.
Near-miss passage: CVE-2015-0405. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.6.22 and earlier allows remote authenticated users to affect availability via unknown vectors related to XA.
Query: describe CVE-2015-4304
Matching passage: CVE-2015-4304. CWE: CWE-264. CVSS: 9.0. The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended access restrictions, and create administrative accounts or read data from arbitrary tenant domains, via a crafted URL, aka Bug IDs CSCus62671 and CSCus62652.
Near-miss passage: CVE-2015-4165. CWE: CWE-264. CVSS: 7.5. The snapshot API in Elasticsearch before 1.6.0 when another application exists on the system that can read Lucene files and execute code from them, is accessible by the attacker, and the Java VM on which Elasticsearch is running can write to a location that the other application can read and execute from, allows remote authenticated users to write to and create arbitrary snapshot metadata files, and potentially execute arbitrary code.
Query: risk of The Mobile and Remote Access (MRA) services implementation in Cisco Unified Communications Manager mishandles edge-device identity validation, which allows remote attackers to bypa
Matching passage: CVE-2015-6410. CWE: CWE-20. CVSS: 4.0. The Mobile and Remote Access (MRA) services implementation in Cisco Unified Communications Manager mishandles edge-device identity validation, which allows remote attackers to bypass intended call-reception and call-setup restrictions by spoofing a user, aka Bug ID CSCuu97283.
Near-miss passage: CVE-2015-1942. CWE: CWE-20. CVSS: 9.300000190734863. The server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to write to arbitrary files, and subsequently execute these files, via a crafted TCP packet to an unspecified port.
Query: exploit SQL injection vulnerability in the get_hash_graph_template function in lib/functions.php in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via the gr
Matching passage: CVE-2015-4454. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the get_hash_graph_template function in lib/functions.php in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via the graph_template_id parameter to graph_templates.php.
Near-miss passage: CVE-2015-6516. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in cygnux.org sysPass 1.0.9 and earlier allows remote authenticated users to execute arbitrary SQL commands via the search parameter to ajax/ajax_search.php.
Query: patch priority for CVE-2015-7808
Matching passage: CVE-2015-7808. CWE: CWE-20. CVSS: 7.5. The vB_Api_Hook::decodeArguments method in vBulletin 5 Connect 5.1.2 through 5.1.9 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object in the arguments parameter to ajax/api/hook/decodeArguments.
Near-miss passage: CVE-2015-0638. CWE: CWE-20. CVSS: 7.099999904632568. Cisco IOS 12.2, 12.4, 15.0, 15.2, and 15.3, when a VRF interface is configured, allows remote attackers to cause a denial of service (interface queue wedge) via crafted ICMPv4 packets, aka Bug ID CSCsi02145.
Query: Sigma rule for Detects the execution of the PurpleSharp adversary simulation tool
Matching passage: Sigma rule: Detects the execution of the PurpleSharp adversary simulation tool. Logsource: windows / process_creation. Rule: title: HackTool - PurpleSharp Execution id: ff23ffbc-3378-435e-992f-0624dcf93ab4 status: test description: Detects the execution of the PurpleSharp adversary simulation tool references: - https://github.com/mvelazc0/PurpleSharp author: Florian Roth (Nextron Systems) date: 2021-06-18 modified: 2023-02-05 tags: - attack.t1587 - attack.resource-development logsource: category: process_creation product: windows detection: selection_img: - Image|contains: \purplesharp - OriginalFileName: PurpleSharp.exe selection_cli: CommandLine|contains: - xyz123456.exe - PurpleSharp condition: 1 of selection_* falsepositives: - Unlikely level: critical
Near-miss passage: Sigma rule: Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where t. Logsource: windows / powershell-classic. Rule: title: Zip A Folder With PowerShell For Staging In Temp - PowerShell id: 71ff406e-b633-4989-96ec-bc49d825a412 related: - id: daf7eb81-35fd-410d-9d7a-657837e602bb type: similar - id: b7a3c9a3-09ea-4934-8864-6a32cacd98d9 type: similar - id: 85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98 type: similar status: test description: 'Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration. An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1074.001/T1074.001.md - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2021-07-20 modified: 2023-12-18 tags: - attack.collection - attack.t1074.001 logsource: product: windows service: powershell-classic detection: selection: Data|contains: - Compress-Archive -Path*-DestinationPath $env:TEMP - Compress-Archive -Path*-DestinationPath*\AppData\Local\Temp\ - Compress-Archive -Path*-DestinationPath*:\Windows\Temp\ condition: selection falsepositives: - Unknown level: medium
Query: campaign using Power Settings
Matching passage: T1653 Power Settings. Tactics: persistence. Description: Adversaries may impair a system's ability to hibernate, reboot, or shut down in order to extend access to infected machines. When a computer enters a dormant state, some or all software and hardware may cease to operate which can disrupt malicious activity.(Citation: Sleep, shut down, hibernate) Adversaries may abuse system utilities and configuration settings to maintain access by preventing machines from entering a state, such as standby, that can terminate malicious activity.(Citation: Microsoft: Powercfg command-line options)(Citation: systemdsleep Linux) For example, `powercfg` controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.(Citation: Two New Monero Malware Attacks Target Windows and Android Users) Adversaries may also extend system lock screen timeout settings.(Citation: BATLOADER: The Evasive Downloader Malware) Other relevant settings, such as disk and hibernate timeout, can be similarly abused to keep the infected machine running even if no user is active.(Citation: CoinLoader: A Sophisticated Malware Loader Campaign) Aware that some malware cannot survive system reboots, adversaries may entirely delete files used to invoke system shut down or reboot.(Citation: Condi-Botnet-binaries)
Near-miss passage: T1078.003 Local Accounts. Tactics: stealth, persistence, privilege escalation, initial access. Description: Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. Local Accounts may also be abused to elevate privileges and harvest credentials through [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). Password reuse may allow the abuse of local accounts across a set of machines on a network for the purposes of Privilege Escalation and Lateral Movement.
Query: describe CVE-2015-1476
Matching passage: CVE-2015-1476. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in xlinkerz ecommerceMajor allow remote attackers to execute arbitrary SQL commands via the (1) productbycat parameter to product.php, or (2) username or (3) password parameter to __admin/index.php.
Near-miss passage: CVE-2015-1055. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the Photo Gallery plugin 1.2.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the order_by parameter in a GalleryBox action to wp-admin/admin-ajax.php.
Query: alert when Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe". Various threat actors and malware have
Matching passage: Sigma rule: Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe". Various threat actors and malware have. Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE id: d2451be2-b582-4e15-8701-4196ac180260 related: - id: ca5583e9-8f80-46ac-ab91-7f314d13b984 type: similar status: test description: 'Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe". Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe". ' references: - https://thehackernews.com/2024/03/two-chinese-apt-groups-ramp-up-cyber.html - https://csirt-cti.net/2024/02/01/stately-taurus-continued-new-information-on-cyberespionage-attacks-against-myanmar-military-junta/ - https://bazaar.abuse.ch/sample/5cb9876681f78d3ee8a01a5aaa5d38b05ec81edc48b09e3865b75c49a2187831/ - https://twitter.com/Max_Mal_/status/1775222576639291859 - https://twitter.com/DTCERT/status/1712785426895839339 author: Swachchhanda Shrawan Poudel date: 2024-04-15 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: Image|endswith: - \KeyScrambler.exe - \KeyScramblerLogon.exe ImageLoaded|endswith: \KeyScramblerIE.dll filter_main_legitimate_path: Image|contains: - C:\Program Files (x86)\KeyScrambler\ - C:\Program Files\KeyScrambler\ ImageLoaded|contains: - C:\Program Files (x86)\KeyScrambler\ - C:\Program Files\KeyScrambler\ filter_main_signature: Signature: QFX Software Corporation SignatureStatus: Valid condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious Speech Runtime Binary Execution by monitoring its child processes. Child processes spawned by SpeechR. Logsource: windows / process_creation. Rule: title: Suspicious Speech Runtime Binary Child Process id: 78f10490-f2f4-4d19-a75b-4e0683bf3b8d status: experimental description: 'Detects suspicious Speech Runtime Binary Execution by monitoring its child processes. Child processes spawned by SpeechRuntime.exe could indicate an attempt for lateral movement via COM & DCOM hijacking. ' references: - https://github.com/rtecCyberSec/SpeechRuntimeMove author: andrewdanis date: 2025-10-23 logsource: category: process_creation product: windows tags: - attack.lateral-movement - attack.stealth - attack.t1021.003 - attack.t1218 detection: selection: ParentImage|endswith: \SpeechRuntime.exe condition: selection falsepositives: - Unlikely. level: high
Query: Sigma YAML for windows / security
Matching passage: Sigma rule: This detection uses Windows security events to detect suspicious access attempts to the registry key values and sub-keys. Logsource: windows / security. Rule: title: Azure AD Health Service Agents Registry Keys Access id: 1d2ab8ac-1a01-423b-9c39-001510eae8e8 status: test description: 'This detection uses Windows security events to detect suspicious access attempts to the registry key values and sub-keys of Azure AD Health service agents (e.g AD FS). Information from AD Health service agents can be used to potentially abuse some of the features provided by those services in the cloud (e.g. Federation). This detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object: HKLM:\SOFTWARE\Microsoft\ADHealthAgent. Make sure you set the SACL to propagate to its sub-keys. ' references: - https://o365blog.com/post/hybridhealthagent/ - https://github.com/OTRF/Set-AuditRule/blob/c3dec5443414231714d850565d364ca73475ade5/rules/registry/aad_connect_health_service_agent.yml author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC date: 2021-08-26 modified: 2022-10-09 tags: - attack.discovery - attack.t1012 logsource: product: windows service: security detection: selection: EventID: - 4656 - 4663 ObjectType: Key ObjectName: \REGISTRY\MACHINE\SOFTWARE\Microsoft\ADHealthAgent filter: ProcessName|contains: - Microsoft.Identity.Health.Adfs.DiagnosticsAgent.exe - Microsoft.Identity.Health.Adfs.InsightsService.exe - Microsoft.Identity.Health.Adfs.MonitoringAgent.Startup.exe - Microsoft.Identity.Health.Adfs.PshSurrogate.exe - Microsoft.Identity.Health.Common.Clients.ResourceMonitor.exe condition: selection and not filter falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the use of the PhoneDeepLink parameter to potentially sideload a DLL file that does not exist. This non-existent. Logsource: windows / process_creation. Rule: title: Potential DLL Sideloading Via DeviceEnroller.EXE id: e173ad47-4388-4012-ae62-bd13f71c18a8 related: - id: ee4c5d06-3abc-48cc-8885-77f1c20f4451 type: similar status: test description: 'Detects the use of the PhoneDeepLink parameter to potentially sideload a DLL file that does not exist. This non-existent DLL file is named "ShellChromeAPI.dll". Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter ' references: - https://mobile.twitter.com/0gtweet/status/1564131230941122561 - https://strontic.github.io/xcyclopedia/library/DeviceEnroller.exe-24BEF0D6B0ECED36BB41831759FDE18D.html author: '@gott_cyber' date: 2022-08-29 modified: 2023-02-04 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \deviceenroller.exe - OriginalFileName: deviceenroller.exe selection_cli: CommandLine|contains: /PhoneDeepLink condition: all of selection_* falsepositives: - Unknown level: medium
Query: exploit Cisco WebEx Meeting Center allows remote attackers to activate disabled meeting attributes, and consequently obtain sensitive information, by providing crafted parameters during a 
Matching passage: CVE-2015-0590. CWE: CWE-200. CVSS: 5.0. Cisco WebEx Meeting Center allows remote attackers to activate disabled meeting attributes, and consequently obtain sensitive information, by providing crafted parameters during a meeting-join action, aka Bug ID CSCuo34165.
Near-miss passage: CVE-2015-1323. CWE: CWE-200. CVSS: 5.5. The simulate dbus method in aptdaemon before 1.1.1+bzr982-0ubuntu3.1 as packaged in Ubuntu 15.04, before 1.1.1+bzr980-0ubuntu1.1 as packaged in Ubuntu 14.10, before 1.1.1-1ubuntu5.2 as packaged in Ubuntu 14.04 LTS, before 0.43+bzr805-0ubuntu10 as packaged in Ubuntu 12.04 LTS allows local users to obtain sensitive information, or access files with root permissions.
Query: vulnerability: The ReadbackResultWriterD3D11::Run function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 misinterprets the return value of a function call, which might allow rem
Matching passage: CVE-2015-7180. CWE: CWE-119. CVSS: 7.5. The ReadbackResultWriterD3D11::Run function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 misinterprets the return value of a function call, which might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors.
Near-miss passage: CVE-2015-9062. CWE: CWE-119. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, an integer overflow to buffer overflow vulnerability exists when loading an ELF file.
Query: incident response steps for Encoded PowerShell / command-line abuse matching Social Media Accounts
Matching passage: Playbook for T1586.001 Social Media Accounts. 1) Validate alert telemetry against T1586.001. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: resource development. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may compromise social media accounts that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important. Rather than creating and cultivating social media profiles (i.e. [Social Media Accounts](https://attack.mitre.org/techniques/T1585/001)), adversaries may compromise existing social media accounts. Utilizing an ex
Near-miss passage: Playbook for T1586.002 Email Accounts. Different response path focused on resource development.
Query: vulnerability: Stack-based buffer overflow in the FastBackMount process in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.11.1 allows local users to gain privileges via unspecified vectors, a
Matching passage: CVE-2015-1898. CWE: CWE-119. CVSS: 7.199999809265137. Stack-based buffer overflow in the FastBackMount process in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.11.1 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-1897.
Near-miss passage: CVE-2015-9181. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, and SD 835, in a crypto API function, a buffer over-read can occur.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in the amoCRM module 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified HTTP 
Matching passage: CVE-2015-7304. CWE: CWE-79. CVSS: 2.5999999046325684. Cross-site scripting (XSS) vulnerability in the amoCRM module 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified HTTP POST data.
Near-miss passage: CVE-2015-6387. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Cisco Unified Computing System (UCS) Central Software 1.3(0.1) allows remote attackers to inject arbitrary web script or HTML via a crafted value in a URL, aka Bug ID CSCux33573.
Query: campaign using Remote Email Collection
Matching passage: T1114.002 Remote Email Collection. Tactics: collection. Description: Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens. Tools such as [MailSniper](https://attack.mitre.org/software/S0413) can be used to automate searches for specific keywords.
Near-miss passage: T1114.001 Local Email Collection. Tactics: collection. Description: Adversaries may target user email on local systems to collect sensitive information. Files containing email data can be acquired from a user’s local system, such as Outlook storage or cache files. Outlook stores data locally in offline data files with an extension of .ost. Outlook 2010 and later supports .ost file sizes up to 50GB, while earlier versions of Outlook support up to 20GB.(Citation: Outlook File Sizes) IMAP accounts in Outlook 2013 (and earlier) and POP accounts use Outlook Data Files (.pst) as opposed to .ost, whereas IMAP accounts in Outlook 2016 (and later) use .ost files. Both types of Outlook data files are typically stored in `C:\Users\<username>\Documents\Outlook Files` or `C:\Users\<username>\AppData\Local\Microsoft\Outlook`.(Citation: Microsoft Outlook Files)
Query: patch priority for CVE-2015-3610
Matching passage: CVE-2015-3610. CWE: CWE-310. CVSS: 5.400000095367432. The Siemens HomeControl for Room Automation application before 2.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information or modify data via a crafted certificate.
Near-miss passage: CVE-2015-0941. CWE: CWE-310. CVSS: 4.300000190734863. The Inetc plugin for Nullsoft Scriptable Install System (NSIS), as used in CERT/CC Failure Observation Engine (FOE) and other products, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and possibly execute arbitrary code by sending a crafted certificate in a download session for Windows executable files.
Query: patch priority for CVE-2015-1489
Matching passage: CVE-2015-1489. CWE: CWE-264. CVSS: 8.5. The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP1 allows remote authenticated users to gain privileges via unspecified vectors.
Near-miss passage: CVE-2015-3246. CWE: CWE-264. CVSS: 7.199999809265137. libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.
Query: vulnerability: Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before
Matching passage: CVE-2015-3084. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-3077 and CVE-2015-3086.
Near-miss passage: CVE-2015-8630. CWE: UNKNOWN. CVSS: 7.5. The (1) kadm5_create_principal_3 and (2) kadm5_modify_principal functions in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.4 and 1.14.x before 1.14.1 allow remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by specifying KADM5_POLICY with a NULL policy name.
Query: CVE similar to CVE-2015-7407
Matching passage: CVE-2015-7407. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in Lotus Mashups in IBM Mashup Center 3.0.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Near-miss passage: CVE-2015-9432. CWE: CWE-352. CVSS: 6.5. The alpine-photo-tile-for-instagram plugin before 1.2.7.6 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=alpine-photo-tile-for-instagram-settings tab parameter.