alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection rule: Detects a highly relevant Antivirus alert that reports APT malware. This event must not be ignored just because the AV h
Matching passage: Sigma rule: Detects a highly relevant Antivirus alert that reports APT malware. This event must not be ignored just because the AV h. Logsource: antivirus. Rule: title: Antivirus - APT Malware Signature id: 101a1877-2cf4-474d-abfd-7f6ac4788d1a status: experimental description: 'Detects a highly relevant Antivirus alert that reports APT malware. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place. ' references: - https://www.nextron-systems.com/?s=antivirus author: Arnim Rupp (Nextron Systems) date: 2026-06-15 tags: - attack.execution - attack.t1203 - attack.command-and-control - attack.t1219.002 logsource: category: antivirus detection: selection: - Signature|re: - APT\d - ATK\d - UNC\d - UAC\d - Signature|contains: - '[APT]' - APT_ - APT- - BackOrder - BlindingCan - Blizzard - Chollima - Cleaver - Cobra - DarkHotel - Dragon - DTrack - Equation - GiftedCrook - GraphSteel - GreyEnergy - GEnergy - GrimPlant - Hydra - Jackal - Kitten - Kimsuky - Lazar - LightRail - Lotus - Luminous - LumiMoth - Nimbus - Manticore - MiniBike - MiniBrowse - MiniBus - MiniFast - MiniJuke - MiniUpdate - MuddyWater - NukeSped - OilRig - Panda - Sandstorm - SandWorm - Seamonkey - Sleet - SlugResin - SnailResin - Snake - Tempest - Tsunami - Turla - Typhoon - UAC_ - UAC- - UNC_ - UNC- - VinoSiren - Winnti condition: selection falsepositives: - Unlikely level: critical
Near-miss passage: Sigma rule: Detects file access requests to potentially sensitive files hosted on the Windows Sysvol share.. Logsource: windows / file_access. Rule: title: Access To Potentially Sensitive Sysvol Files By Uncommon Applications id: d51694fe-484a-46ac-92d6-969e76d60d10 related: - id: 8344c19f-a023-45ff-ad63-a01c5396aea0 type: derived status: test description: Detects file access requests to potentially sensitive files hosted on the Windows Sysvol share. references: - https://github.com/vletoux/pingcastle author: frack113 date: 2023-12-21 modified: 2024-07-29 tags: - attack.credential-access - attack.t1552.006 logsource: category: file_access product: windows definition: 'Requirements: Microsoft-Windows-Kernel-File ETW provider' detection: selection: FileName|startswith: \\ FileName|contains|all: - \sysvol\ - \Policies\ FileName|endswith: - audit.csv - Files.xml - GptTmpl.inf - groups.xml - Registry.pol - Registry.xml - scheduledtasks.xml - scripts.ini - services.xml filter_main_generic: Image|startswith: - C:\Program Files (x86)\ - C:\Program Files\ - C:\Windows\system32\ - C:\Windows\SysWOW64\ filter_main_explorer: Image: C:\Windows\explorer.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Query: exploit Cross-site scripting (XSS) vulnerability in Notes in Apple OS X before 10.11 allows local users to inject arbitrary web script or HTML via crafted text.
Matching passage: CVE-2015-5875. CWE: CWE-79. CVSS: 2.0999999046325684. Cross-site scripting (XSS) vulnerability in Notes in Apple OS X before 10.11 allows local users to inject arbitrary web script or HTML via crafted text.
Near-miss passage: CVE-2015-8006. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the PageTriage toolbar in the PageTriage extension for MediWiki allows remote attackers to inject arbitrary web script or HTML via the page title.
Query: risk of Stack-based buffer overflow in the get_matching_model_microcode function in arch/x86/kernel/cpu/microcode/intel_early.c in the Linux kernel before 4.0 allows context-dependent atta
Matching passage: CVE-2015-2666. CWE: CWE-119. CVSS: 6.900000095367432. Stack-based buffer overflow in the get_matching_model_microcode function in arch/x86/kernel/cpu/microcode/intel_early.c in the Linux kernel before 4.0 allows context-dependent attackers to gain privileges by constructing a crafted microcode header and leveraging root privileges for write access to the initrd.
Near-miss passage: CVE-2015-1098. CWE: CWE-119. CVSS: 7.300000190734863. iWork in Apple iOS before 8.3 and Apple OS X before 10.10.3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted iWork file.
Query: patch priority for CVE-2015-0666
Matching passage: CVE-2015-0666. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in the fmserver servlet in Cisco Prime Data Center Network Manager (DCNM) before 7.1(1) allows remote attackers to read arbitrary files via a crafted pathname, aka Bug ID CSCus00241.
Near-miss passage: CVE-2015-4616. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in includes/MapPinImageSave.php in the Easy2Map plugin before 1.2.5 for WordPress allows remote attackers to create arbitrary files via a .. (dot dot) in the map_id parameter.
Query: detect Detects the use of "DumpMinitool.exe" a tool that allows the dump of process memory via the use of the "MiniDumpWriteDum in logs
Matching passage: Sigma rule: Detects the use of "DumpMinitool.exe" a tool that allows the dump of process memory via the use of the "MiniDumpWriteDum. Logsource: windows / process_creation. Rule: title: DumpMinitool Execution id: dee0a7a3-f200-4112-a99b-952196d81e42 status: test description: Detects the use of "DumpMinitool.exe" a tool that allows the dump of process memory via the use of the "MiniDumpWriteDump" references: - https://twitter.com/mrd0x/status/1511415432888131586 - https://twitter.com/mrd0x/status/1511489821247684615 - https://lolbas-project.github.io/lolbas/OtherMSBinaries/DumpMinitool/ - https://gist.github.com/nasbench/6d58c3c125e2fa1b8f7a09754c1b087f author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems) date: 2022-04-06 modified: 2023-04-12 tags: - attack.stealth - attack.t1036 - attack.t1003.001 - attack.credential-access logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \DumpMinitool.exe - \DumpMinitool.x86.exe - \DumpMinitool.arm64.exe - OriginalFileName: - DumpMinitool.exe - DumpMinitool.x86.exe - DumpMinitool.arm64.exe selection_cli: CommandLine|contains: - ' Full' - ' Mini' - ' WithHeap' condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects encoded base64 MZ header in the commandline. Logsource: windows / process_creation. Rule: title: Base64 MZ Header In CommandLine id: 22e58743-4ac8-4a9f-bf19-00a0428d8c5f status: test description: Detects encoded base64 MZ header in the commandline references: - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-12 tags: - attack.execution logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - TVqQAAMAAAAEAAAA - TVpQAAIAAAAEAA8A - TVqAAAEAAAAEABAA - TVoAAAAAAAAAAAAA - TVpTAQEAAAAEAAAA condition: selection falsepositives: - Unlikely level: high
Query: threat report mentioning Deploy Container
Matching passage: T1610 Deploy Container. Tactics: execution. Description: Adversaries may deploy a container into an environment to facilitate execution or evade defenses. In some cases, adversaries may deploy a new container to execute processes associated with a particular image or deployment, such as processes that execute or download malware. In others, an adversary may deploy a new container configured without network rules, user limitations, etc. to bypass existing defenses within the environment. In Kubernetes environments, an adversary may attempt to deploy a privileged or vulnerable container into a specific node in order to [Escape to Host](https://attack.mitre.org/techniques/T1611) and access other containers running on the node. (Citation: AppSecco Kubernetes Namespace Breakout 2020) Containers can be deployed by various means, such as via Docker's <code>create</code> and <code>start</code> APIs or via a web application such as the Kubernetes dashboard or Kubeflow. (Citation: Docker Container)(Citation: Kubernetes Dashboard)(Citation: Kubeflow Pipelines) In Kubernetes environments, containers may be deployed through workloads such as ReplicaSets or DaemonSets, which can allow containers to be deployed across multiple nodes.(Citation: Kubernetes Workload Management) Adversaries may deploy containers based on retrieved or built malicious images or from benign images that download and execute malicious payloads at runtime.(Citation: Aqua Build Images on Hosts)
Near-miss passage: T1153 Source. Tactics: execution. Description: **This technique has been deprecated and should no longer be used.** The <code>source</code> command loads functions into the current shell or executes files in the current context. This built-in command can be run in two different ways <code>source /path/to/filename [arguments]</code> or <code>.**This technique has been deprecated and should no longer be used.** /path/to/filename [arguments]</code>. Take note of the space after the ".". Without a space, a new shell is created that runs the program instead of running the program within the current context. This is often used to make certain features or functions available to a shell or to update a specific shell's environment.(Citation: Source Manual) Adversaries can abuse this functionality to execute programs. The file executed with this technique does not need to be marked executable beforehand.
Query: explain CWE-347
Matching passage: CWE-347 Improper Verification of Cryptographic Signature. The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Near-miss passage: CWE-908 Use of Uninitialized Resource. The product uses or accesses a resource that has not been initialized.
Query: describe CVE-2015-1147
Matching passage: CVE-2015-1147. CWE: CWE-200. CVSS: 5.0. Open Directory Client in Apple OS X before 10.10.3 sends unencrypted password-change requests in certain circumstances involving missing certificates, which allows remote attackers to obtain sensitive information by sniffing the network.
Near-miss passage: CVE-2015-6626. CWE: CWE-200. CVSS: 5.0. libstagefright in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 24310423.
Query: describe CVE-2015-3323
Matching passage: CVE-2015-3323. CWE: CWE-20. CVSS: 5.0. The ThinkServer System Manager (TSM) Baseboard Management Controller before firmware 1.27.73476 for ThinkServer RD350, RD450, RD550, RD650, and TD350 allows remote attackers to cause a denial of service (web interface crash) via a malformed HTTP request during authentication.
Near-miss passage: CVE-2015-7847. CWE: CWE-20. CVSS: 5.5. Huawei MBB (Mobile Broadband) product E3272s with software versions earlier than E3272s-153TCPU-V200R002B491D09SP00C00 has a Denial of Service (DoS) vulnerability. An attacker could send a malicious packet to the Common Gateway Interface (CGI) of a target device and make it fail while setting the port attribute, which causes a DoS attack.
Query: risk of fontd in Apple Type Services (ATS) in Apple OS X before 10.10.3 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-1131, CVE-201
Matching passage: CVE-2015-1135. CWE: CWE-20. CVSS: 7.199999809265137. fontd in Apple Type Services (ATS) in Apple OS X before 10.10.3 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-1131, CVE-2015-1132, CVE-2015-1133, and CVE-2015-1134.
Near-miss passage: CVE-2015-4276. CWE: CWE-20. CVSS: 6.5. Cisco WebEx Meetings Server 2.5MR1 allows remote authenticated users to execute arbitrary code via a crafted command parameter, aka Bug ID CSCus56138.
Query: risk of Saia Burgess PCD1.M0xx0, PCD1.M2xx0, PCD2.M5xx0, PCD3.Mxx60, PCD3.Mxxx0, PCD7.D4xxD, PCD7.D4xxV, PCD7.D4xxWTPF, and PCD7.D4xxxT5F devices before 1.24.50 and PCD3.T665 and PCD3.T666
Matching passage: CVE-2015-7911. CWE: CWE-255. CVSS: 9.100000381469727. Saia Burgess PCD1.M0xx0, PCD1.M2xx0, PCD2.M5xx0, PCD3.Mxx60, PCD3.Mxxx0, PCD7.D4xxD, PCD7.D4xxV, PCD7.D4xxWTPF, and PCD7.D4xxxT5F devices before 1.24.50 and PCD3.T665 and PCD3.T666 devices before 1.24.41 have hardcoded credentials, which allows remote attackers to obtain administrative access via an FTP session.
Near-miss passage: CVE-2015-7280. CWE: CWE-255. CVSS: 9.800000190734863. The web administration interface on ReadyNet WRT300N-DD devices with firmware 1.0.26 has a default password of admin for the admin account, which allows remote attackers to obtain administrative privileges by leveraging a LAN session.
Query: exploit The link-log plugin before 2.0 for WordPress has HTTP Response Splitting.
Matching passage: CVE-2015-9345. CWE: CWE-20. CVSS: 7.5. The link-log plugin before 2.0 for WordPress has HTTP Response Splitting.
Near-miss passage: CVE-2015-1303. CWE: CWE-20. CVSS: 7.5. bindings/core/v8/V8DOMWrapper.h in Blink, as used in Google Chrome before 45.0.2454.101, does not perform a rethrow action to propagate information about a cross-context exception, which allows remote attackers to bypass the Same Origin Policy via a crafted HTML document containing an IFRAME element.
Query: SIEM correlation: discovery activity consistent with Container and Resource Discovery
Matching passage: T1613 Container and Resource Discovery. Tactics: discovery. Description: Adversaries may attempt to discover containers and other resources that are available within a containers environment. Other resources may include images, deployments, pods, nodes, and other information such as the status of a cluster. These resources can be viewed within web applications such as the Kubernetes dashboard or can be queried via the Docker and Kubernetes APIs.(Citation: Docker API)(Citation: Kubernetes API) In Docker, logs may leak information about the environment, such as the environment’s configuration, which services are available, and what cloud provider the victim may be utilizing. The discovery of these resources may inform an adversary’s next steps in the environment, such as how to perform lateral movement and which methods to utilize for execution.
Near-miss passage: T1680 Local Storage Discovery. Tactics: discovery. Description: Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number. This can be done to prepare for ransomware-related encryption, to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0109), or as a precursor to [Direct Volume Access](https://attack.mitre.org/techniques/T1006). On ESXi systems, adversaries may use [Hypervisor CLI](https://attack.mitre.org/techniques/T1059/012) commands such as `esxcli` to list storage connected to the host as well as `.vmdk` files.(Citation: TrendMicro)(Citation: TrendMicro ESXI Ransomware) On Windows systems, adversaries can use `wmic logicaldisk get` to find information about local network drives. They can also use `Get-PSDrive` in PowerShell to retrieve drives and may additionally use Windows API functions such as `GetDriveType`.(Citation: Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024)(Citation: Volexity) Linux has commands such as `parted`, `lsblk`, `fdisk`, `lshw`, and `df` that can list information about disk partitions such as size, type, file system types, and free space. The command `diskutil` on MacOS can be used to list disks while `system_profiler SPStorageDataType` can additionally show information such as a volume’s mount path, file system, and the type of drive in the system. Infrastructure as a Service (IaaS) cloud providers also have commands for storage discovery such as `describe volume` in AWS, `gcloud compute disks list` in GCP, and `az disk list` in Azure.(Citation: AWS docs describe volumes)(Citation: GCP gcloud compute disks list)(Citation: azure az disk)
Query: exploit The Red Hat module-setup.sh script for kexec-tools, as distributed in the kexec-tools before 2.0.7-19 packages in Red Hat Enterprise Linux, allows local users to write to arbitrary
Matching passage: CVE-2015-0267. CWE: UNKNOWN. CVSS: 3.5999999046325684. The Red Hat module-setup.sh script for kexec-tools, as distributed in the kexec-tools before 2.0.7-19 packages in Red Hat Enterprise Linux, allows local users to write to arbitrary files via a symlink attack on a temporary file.
Near-miss passage: CVE-2015-4116. CWE: UNKNOWN. CVSS: 9.800000190734863. Use-after-free vulnerability in the spl_ptr_heap_insert function in ext/spl/spl_heap.c in PHP before 5.5.27 and 5.6.x before 5.6.11 allows remote attackers to execute arbitrary code by triggering a failed SplMinHeap::compare operation.
Query: risk of Cross-site request forgery (CSRF) vulnerability in the Banner Effect Header plugin 1.2.6 for WordPress allows remote attackers to hijack the authentication of administrators for re
Matching passage: CVE-2015-0920. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Banner Effect Header plugin 1.2.6 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the banner_effect_email parameter in the BannerEffectOptions page to wp-admin/options-general.php.
Near-miss passage: CVE-2015-2134. CWE: CWE-352. CVSS: 6.0. Cross-site request forgery (CSRF) vulnerability in HP System Management Homepage (SMH) before 7.5.0 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.
Query: vulnerability: Multiple cross-site scripting (XSS) vulnerabilities in open-flash-chart.swf in Open Flash Chart 2, as used in the VideoAds plugin in Revive Adserver before 3.2.2 and CA Release Aut
Matching passage: CVE-2015-7370. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in open-flash-chart.swf in Open Flash Chart 2, as used in the VideoAds plugin in Revive Adserver before 3.2.2 and CA Release Automation (formerly LISA Release Automation) 5.0.2 before 5.0.2-227, 5.5.1 before 5.5.1-1616, 5.5.2 before 5.5.2-434, and 6.1.0 before 6.1.0-1026, allow remote attackers to inject arbitrary web script or HTML via the (1) id or (2) data-file parameter.
Near-miss passage: CVE-2015-1050. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in F5 BIG-IP Application Security Manager (ASM) before 11.6 allows remote attackers to inject arbitrary web script or HTML via the Response Body field when creating a new user account.
Query: CVE similar to CVE-2015-4893
Matching passage: CVE-2015-4893. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4803 and CVE-2015-4911.
Near-miss passage: CVE-2015-4754. CWE: UNKNOWN. CVSS: 6.900000095367432. Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-2583, CVE-2015-2624, CVE-2015-2626, CVE-2015-2640, CVE-2015-2654, CVE-2015-2656, CVE-2015-4764, CVE-2015-4775, CVE-2015-4776, CVE-2015-4777, CVE-2015-4778, CVE-2015-4780, CVE-2015-4781, CVE-2015-4782, CVE-2015-4783, CVE-2015-4784, CVE-2015-4785, CVE-2015-4786, CVE-2015-4787, CVE-2015-4789, and CVE-2015-4790.
Query: describe CVE-2015-9356
Matching passage: CVE-2015-9356. CWE: CWE-79. CVSS: 6.099999904632568. The wp-vipergb plugin before 1.3.16 for WordPress has XSS via add_query_arg() and remove_query_arg(), a different issue than CVE-2014-9460.
Near-miss passage: CVE-2015-3443. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the basic dashboard in Thycotic Secret Server 8.6.x, 8.7.x, and 8.8.x before 8.8.000005 allows remote authenticated users to inject arbitrary web script or HTML via a password entry, which is not properly handled when toggling the password mask.
Query: explain CWE-785
Matching passage: CWE-785 Use of Path Manipulation Function without Maximum-sized Buffer. The product invokes a function for normalizing paths or file names, but it provides an output buffer that is smaller than the maximum possible size, such as PATH_MAX.
Near-miss passage: CWE-468 Incorrect Pointer Scaling. In C and C++, one may often accidentally refer to the wrong memory due to the semantics of when math operations are implicitly scaled.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in the Site Documentation module before 6.x-1.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary w
Matching passage: CVE-2015-4370. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Site Documentation module before 6.x-1.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to taxonomy terms.
Near-miss passage: CVE-2015-1640. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Microsoft Project Server 2010 SP2 and 2013 SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted request, aka "Microsoft SharePoint XSS Vulnerability."
Query: exploit mediaserver in Android before 5.1.1 LMY48T allows attackers to gain privileges via a crafted application, aka internal bugs 20731946 and 20719651, a different vulnerability than CV
Matching passage: CVE-2015-6596. CWE: CWE-264. CVSS: 9.300000190734863. mediaserver in Android before 5.1.1 LMY48T allows attackers to gain privileges via a crafted application, aka internal bugs 20731946 and 20719651, a different vulnerability than CVE-2015-7717.
Near-miss passage: CVE-2015-3761. CWE: CWE-264. CVSS: 7.199999809265137. The kernel in Apple OS X before 10.10.5 does not properly validate pathnames in the environment, which allows local users to gain privileges via unspecified vectors.
Query: describe CVE-2015-0880
Matching passage: CVE-2015-0880. CWE: CWE-119. CVSS: 6.800000190734863. Buffer overflow in CREAR AL-Mail32 before 1.13d allows remote attackers to execute arbitrary code via a long filename of an attachment.
Near-miss passage: CVE-2015-8999. CWE: CWE-119. CVSS: 7.800000190734863. In TrustZone a buffer overflow vulnerability can potentially occur in all Android releases from CAF using the Linux kernel while loading an ELF file.
Query: patch priority for CVE-2015-0797
Matching passage: CVE-2015-0797. CWE: UNKNOWN. CVSS: 6.800000190734863. GStreamer before 1.4.5, as used in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 on Linux, allows remote attackers to cause a denial of service (buffer over-read and application crash) or possibly execute arbitrary code via crafted H.264 video data in an m4v file.
Near-miss passage: CVE-2015-6662. CWE: UNKNOWN. CVSS: 6.800000190734863. XML external entity (XXE) vulnerability in SAP NetWeaver Portal 7.4 allows remote attackers to read arbitrary files and possibly have other unspecified impact via crafted XML data, aka SAP Security Note 2168485.
Query: CVE similar to CVE-2015-2125
Matching passage: CVE-2015-2125. CWE: CWE-611. CVSS: 4.0. Unspecified vulnerability in HP WebInspect 7.x through 10.4 before 10.4 update 1 allows remote authenticated users to bypass intended access restrictions via unknown vectors.
Near-miss passage: CVE-2015-3907. CWE: CWE-611. CVSS: 9.800000190734863. CodeIgniter Rest Server (aka codeigniter-restserver) 2.7.1 allows XXE attacks.