alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: adversary uses Disable or Modify System Firewall
Matching passage: T1686 Disable or Modify System Firewall. Tactics: defense impairment. Description: Adversaries may disable or modify host-based or network firewalls to impair defensive mechanisms and enable further action. Once an adversary has gathered sufficient privileges, they can tamper with firewall services, policies, or rule sets to remove restrictions on inbound or outbound traffic. For example, this may include turning off firewall profiles, altering existing rules to permit previously blocked ports or protocols, or adding new rules that create covert communication paths (e.g., adding a new firewall rule for a well-known protocol (such as RDP) using a non-traditional and potentially less securitized port.(Citation: change_rdp_port_conti) Adversaries may disable or modify firewalls using different behaviors, depending on the platform. For example, in ESXi, firewall rules may be modified directly via the esxcli (e.g., via esxcli network firewall set) or via the vCenter user interface.(Citation: Broadcom ESXi Firewall)(Citation: Trellix Rnasomhouse 2024)
Near-miss passage: T1686.002 Network Device Firewall. Tactics: defense impairment. Description: Adversaries may disable network device-based firewall mechanisms entirely or add, delete, or modify particular rules in order to bypass controls limiting network usage. Adversaries may obtain access to devices such as routers, switches, or other perimeter/network devices and change access control lists (ACLs), security zones, or policy rules to permit otherwise blocked traffic. For example, adversaries may add new network firewall rules to allow access to all internal network subnets without restrictions. Allowing access to internal network subsets may enable unrestricted inbound/outbound connectivity or open paths for command and control and lateral movement. Adversaries may obtain access to network device management interfaces via [Valid Accounts](https://attack.mitre.org/techniques/T1078) or by exploiting vulnerabilities. In some cases, threat actors may target firewalls and other network infrastructure that are exposed to the internet by leveraging weaknesses in public-facing applications ([Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)).(Citation: CVE-2024-55591 Detail) Adversaries may also modify host networking configurations that indirectly manipulate system firewalls, such as adjusting interface bandwidth or network connection request thresholds.
Query: risk of Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1 and 8.2 allows remote attackers to affect integrity via unknown vectors related to Portal Fr
Matching passage: CVE-2015-0502. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1 and 8.2 allows remote attackers to affect integrity via unknown vectors related to Portal Framework.
Near-miss passage: CVE-2015-7663. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.
Query: patch priority for CVE-2015-9334
Matching passage: CVE-2015-9334. CWE: CWE-89. CVSS: 9.800000190734863. The email-newsletter plugin through 20.15 for WordPress has SQL injection.
Near-miss passage: CVE-2015-1441. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in Piwigo before 2.5.6, 2.6.x before 2.6.5, and 2.7.x before 2.7.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Query: exploit Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to Server : 
Matching passage: CVE-2015-4815. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to Server : DDL.
Near-miss passage: CVE-2015-0376. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 11.1.1.8.0 allows remote attackers to affect integrity via unknown vectors related to Content Server.
Query: CVE similar to CVE-2015-2028
Matching passage: CVE-2015-2028. CWE: UNKNOWN. CVSS: 4.300000190734863. CRLF injection vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL.
Near-miss passage: CVE-2015-2767. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in Websense TRITON AP-EMAIL before 8.0.0 has unknown impact and attack vectors, related to "Autocomplete Enabled."
Query: describe CVE-2015-2753
Matching passage: CVE-2015-2753. CWE: CWE-20. CVSS: 6.800000190734863. FreeXL before 1.0.0i allows remote attackers to cause a denial of service (stack corruption) or possibly execute arbitrary code via a crafted sector in a workbook.
Near-miss passage: CVE-2015-6241. CWE: CWE-20. CVSS: 4.300000190734863. The proto_tree_add_bytes_item function in epan/proto.c in the protocol-tree implementation in Wireshark 1.12.x before 1.12.7 does not properly terminate a data structure after a failure to locate a number within a string, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Query: exploit The uninstall plugin before 1.2 for WordPress has CSRF to delete all tables via the wp-admin/admin-ajax.php?action=uninstall URI.
Matching passage: CVE-2015-9332. CWE: CWE-352. CVSS: 6.5. The uninstall plugin before 1.2 for WordPress has CSRF to delete all tables via the wp-admin/admin-ajax.php?action=uninstall URI.
Near-miss passage: CVE-2015-2905. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability on Actiontec GT784WN modems with firmware before NCS01-1.0.13 allows remote attackers to hijack the authentication or intranet connectivity of arbitrary users.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to inject arbitrary web script or HTML via the playlistname field when crea
Matching passage: CVE-2015-8310. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to inject arbitrary web script or HTML via the playlistname field when creating a new playlist.
Near-miss passage: CVE-2015-1041. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in e107_admin/filemanager.php in e107 1.0.4 allows remote attackers to inject arbitrary web script or HTML via the e107_files/ file path in the QUERY_STRING.
Query: risk of Cross-site scripting (XSS) vulnerability in Reviewer in EMC SourceOne Email Supervisor before 7.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vec
Matching passage: CVE-2015-6844. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Reviewer in EMC SourceOne Email Supervisor before 7.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-0668. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the administration portal in Cisco WebEx Meetings Server 2.5 and 2.5.99.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCuq66737.
Query: describe CVE-2015-7961
Matching passage: CVE-2015-7961. CWE: CWE-264. CVSS: 7.800000190734863. SafeNet Authentication Service Remote Web Workplace Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module.
Near-miss passage: CVE-2015-6101. CWE: CWE-264. CVSS: 6.900000095367432. The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Windows Kernel Memory Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-6100.
Query: Sigma YAML for windows / dns-client
Matching passage: Sigma rule: Detects DNS resolution of an .onion address related to Tor routing networks. Logsource: windows / dns-client. Rule: title: Query Tor Onion Address - DNS Client id: 8384bd26-bde6-4da9-8e5d-4174a7a47ca2 related: - id: b55ca2a3-7cff-4dda-8bdd-c7bfa63bf544 type: similar - id: a8322756-015c-42e7-afb1-436e85ed3ff5 type: similar status: test description: Detects DNS resolution of an .onion address related to Tor routing networks references: - https://www.logpoint.com/en/blog/detecting-tor-use-with-logpoint/ - https://github.com/Azure/Azure-Sentinel/blob/f99542b94afe0ad2f19a82cc08262e7ac8e1428e/Detections/ASimDNS/imDNS_TorProxies.yaml author: Nasreddine Bencherchali (Nextron Systems) date: 2022-02-20 modified: 2025-09-12 tags: - attack.command-and-control - attack.t1090.003 logsource: product: windows service: dns-client definition: 'Requirements: Microsoft-Windows-DNS Client Events/Operational Event Log must be enabled/collected in order to receive the events.' detection: selection: EventID: 3008 QueryName|endswith: - .hiddenservice.net - .onion.ca - .onion.cab - .onion.casa - .onion.city - .onion.direct - .onion.dog - .onion.glass - .onion.gq - .onion.guide - .onion.in.net - .onion.ink - .onion.it - .onion.link - .onion.lt - .onion.lu - .onion.ly - .onion.mn - .onion.network - .onion.nu - .onion.pet - .onion.plus - .onion.pt - .onion.pw - .onion.rip - .onion.sh - .onion.si - .onion.to - .onion.top - .onion.ws - .onion - .s1.tor-gateways.de - .s2.tor-gateways.de - .s3.tor-gateways.de - .s4.tor-gateways.de - .s5.tor-gateways.de - .t2w.pw - .tor2web.ae.org - .tor2web.blutmagie.de - .tor2web.com - .tor2web.fi - .tor2web.io - .tor2web.org - .tor2web.xyz - .torlink.co condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH". Logsource: windows / process_creation. Rule: title: Add Windows Capability Via PowerShell Cmdlet id: b36d01a3-ddaf-4804-be18-18a6247adfcd related: - id: 155c7fd5-47b4-49b2-bbeb-eb4fab335429 type: similar status: test description: Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH" and others. references: - https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse?tabs=powershell - https://www.virustotal.com/gui/file/af1c82237b6e5a3a7cdbad82cc498d298c67845d92971bada450023d1335e267/content author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-22 modified: 2023-05-09 tags: - attack.execution logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_cmdlet: CommandLine|contains: Add-WindowsCapability selection_capa: CommandLine|contains: OpenSSH. condition: all of selection_* falsepositives: - Legitimate usage of the capabilities by administrators or users. Add additional filters accordingly. level: medium
Query: risk of The hamgr service in the IPv6 Proxy Mobile (PM) implementation in Cisco StarOS 18.1.0.59776 on ASR 5000 devices allows remote attackers to cause a denial of service (service reload
Matching passage: CVE-2015-0711. CWE: CWE-399. CVSS: 5.0. The hamgr service in the IPv6 Proxy Mobile (PM) implementation in Cisco StarOS 18.1.0.59776 on ASR 5000 devices allows remote attackers to cause a denial of service (service reload and call-processing outage) via malformed PM packets, aka Bug ID CSCut94711.
Near-miss passage: CVE-2015-0064. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applications 2010 SP2, Word Viewer, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Office Remote Code Execution Vulnerability."
Query: vulnerability: A vulnerability was found in ritterim definely. It has been classified as problematic. Affected is an unknown function of the file src/database.js. The manipulation leads to cross 
Matching passage: CVE-2015-10021. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability was found in ritterim definely. It has been classified as problematic. Affected is an unknown function of the file src/database.js. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is b31a022ba4d8d17148445a13ebb5a42ad593dbaa. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217608.
Near-miss passage: CVE-2015-0156. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.6.0 and WebSphere Lombardi Edition (WLE) 7.2.x through 7.2.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Query: common weakness: Exposure of Resource to Wrong Sphere
Matching passage: CWE-668 Exposure of Resource to Wrong Sphere. The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Near-miss passage: CWE-1236 Improper Neutralization of Formula Elements in a CSV File. The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
Query: explain CWE-1204
Matching passage: CWE-1204 Generation of Weak Initialization Vector (IV). The product uses a cryptographic primitive that uses an Initialization Vector (IV), but the product does not generate IVs that are sufficiently unpredictable or unique according to the expected cryptographic requirements for that primitive.
Near-miss passage: CWE-131 Incorrect Calculation of Buffer Size. The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.
Query: weakness ASP.NET Misconfiguration: Not Using Input Validation Framework
Matching passage: CWE-554 ASP.NET Misconfiguration: Not Using Input Validation Framework. The ASP.NET application does not use an input validation framework.
Near-miss passage: CWE-472 External Control of Assumed-Immutable Web Parameter. The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.
Query: describe CVE-2015-9263
Matching passage: CVE-2015-9263. CWE: CWE-434. CVSS: 9.800000190734863. An issue was discovered in post2file.php in Up.Time Monitoring Station 7.5.0 (build 16) and 7.4.0 (build 13). It allows an attacker to upload an arbitrary file, such as a .php file that can execute arbitrary OS commands.
Near-miss passage: CVE-2015-5601. CWE: CWE-434. CVSS: 8.800000190734863. edx-platform before 2015-07-20 allows code execution by privileged users because the course import endpoint mishandles .tar.gz files.
Query: Sigma rule for Detects execution of "certutil" with the "addstore" flag in order to install a new certificate on the system. Adversarie
Matching passage: Sigma rule: Detects execution of "certutil" with the "addstore" flag in order to install a new certificate on the system. Adversarie. Logsource: windows / process_creation. Rule: title: New Root Certificate Installed Via Certutil.EXE id: d2125259-ddea-4c1c-9c22-977eb5b29cf0 related: - id: 42821614-9264-4761-acfc-5772c3286f76 type: derived - id: 46591fae-7a4c-46ea-aec3-dff5e6d785dc type: obsolete status: test description: 'Detects execution of "certutil" with the "addstore" flag in order to install a new certificate on the system. Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md author: oscd.community, @redcanary, Zach Stanford @svch0st date: 2023-03-05 modified: 2024-03-05 tags: - attack.defense-impairment - attack.t1553.004 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \certutil.exe - OriginalFileName: CertUtil.exe selection_cli_add: CommandLine|contains|windash: -addstore selection_cli_store: CommandLine|contains: root condition: all of selection_* falsepositives: - Help Desk or IT may need to manually add a corporate Root CA on occasion. Need to test if GPO push doesn't trigger FP level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_certificate_installation/info.yml
Near-miss passage: Sigma rule: Detects logons using NTLM to hosts that are potentially not part of the domain.. Logsource: windows / ntlm. Rule: title: Potential Remote Desktop Connection to Non-Domain Host id: ce5678bb-b9aa-4fb5-be4b-e57f686256ad status: test description: Detects logons using NTLM to hosts that are potentially not part of the domain. references: - n/a author: James Pemberton date: 2020-05-22 modified: 2021-11-27 tags: - attack.command-and-control - attack.t1219.002 logsource: product: windows service: ntlm definition: Requires events from Microsoft-Windows-NTLM/Operational detection: selection: EventID: 8001 TargetName|startswith: TERMSRV condition: selection falsepositives: - Host connections to valid domains, exclude these. - Host connections not using host FQDN. - Host connections to external legitimate domains. level: medium
Query: exploit Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.
Matching passage: CVE-2015-2955. CWE: CWE-78. CVSS: 7.5. Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.
Near-miss passage: CVE-2015-8557. CWE: CWE-78. CVSS: 9.0. The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.
Query: secure coding against Improper Handling of Additional Special Element
Matching passage: CWE-167 Improper Handling of Additional Special Element. The product receives input from an upstream component, but it does not handle or incorrectly handles when an additional unexpected special element is provided.
Near-miss passage: CWE-498 Cloneable Class Containing Sensitive Information. The code contains a class with sensitive data, but the class is cloneable. The data can then be accessed by cloning the class.
Query: explain CWE-909
Matching passage: CWE-909 Missing Initialization of Resource. The product does not initialize a critical resource.
Near-miss passage: CWE-297 Improper Validation of Certificate with Host Mismatch. The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.
Query: alert when An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, Amm
Matching passage: Sigma rule: An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, Amm. Logsource: windows / process_creation. Rule: title: Remote Access Tool - LogMeIn Execution id: d85873ef-a0f8-4c48-a53a-6b621f11729d status: test description: 'An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-3---logmein-files-detected-test-on-windows author: frack113 date: 2022-02-11 modified: 2023-03-05 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: windows detection: selection: - Description: LMIGuardianSvc - Product: LMIGuardianSvc - Company: LogMeIn, Inc. condition: selection falsepositives: - Legitimate use level: medium
Near-miss passage: Sigma rule: Detects command that type the content of ntdll.dll to a different file or a pipe in order to evade AV / EDR detection. A. Logsource: windows / process_creation. Rule: title: NtdllPipe Like Activity Execution id: bbc865e4-7fcd-45a6-8ff1-95ced28ec5b2 status: test description: Detects command that type the content of ntdll.dll to a different file or a pipe in order to evade AV / EDR detection. As seen being used in the POC NtdllPipe references: - https://web.archive.org/web/20220306121156/https://www.x86matthew.com/view_post?id=ntdll_pipe author: Florian Roth (Nextron Systems) date: 2022-03-05 modified: 2023-03-07 tags: - attack.defense-impairment logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - type %windir%\system32\ntdll.dll - type %systemroot%\system32\ntdll.dll - type c:\windows\system32\ntdll.dll - \\ntdll.dll > \\\\.\\pipe\\ condition: selection falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-6736
Matching passage: CVE-2015-6736. CWE: CWE-17. CVSS: 5.0. The Quiz extension for MediaWiki allows remote attackers to cause a denial of service via regex metacharacters in a regular expression.
Near-miss passage: CVE-2015-4943. CWE: CWE-17. CVSS: 5.300000190734863. IBM WebSphere MQ Light 1.x before 1.0.2 allows remote attackers to cause a denial of service (MQXR service crash) via a series of connect and disconnect actions, a different vulnerability than CVE-2015-4942.