alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection engineering for Scheduled Task/Job
Matching passage: T1053 Scheduled Task/Job. Tactics: execution, persistence, privilege escalation. Description: Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.(Citation: TechNet Task Scheduler Security) Adversaries may use task scheduling to execute programs at system startup or on a scheduled basis for persistence. These mechanisms can also be abused to run a process under the context of a specified account (such as one with elevated permissions/privileges). Similar to [System Binary Proxy Execution](https://attack.mitre.org/techniques/T1218), adversaries have also abused task scheduling to potentially mask one-time execution under a trusted system process.(Citation: ProofPoint Serpent)
Near-miss passage: T1053.004 Launchd. Tactics: execution, persistence, privilege escalation. Description: This technique is deprecated due to the inaccurate usage. The report cited did not provide technical detail as to how the malware interacted directly with launchd rather than going through known services. Other system services are used to interact with launchd rather than launchd being used by itself. Adversaries may abuse the <code>Launchd</code> daemon to perform task scheduling for initial or recurring execution of malicious code. The <code>launchd</code> daemon, native to macOS, is responsible for loading and maintaining services within the operating system. This process loads the parameters for each launch-on-demand system-level daemon from the property list (plist) files found in <code>/System/Library/LaunchDaemons</code> and <code>/Library/LaunchDaemons</code> (Citation: AppleDocs Launch Agent Daemons). These LaunchDaemons have property list files which point to the executables that will be launched (Citation: Methods of Mac Malware Persistence). An adversary may use the <code>launchd</code> daemon in macOS environments to schedule new executables to run at system startup or on a scheduled basis for persistence. <code>launchd</code> can also be abused to run a process under the context of a specified account. Daemons, such as <code>launchd</code>, run with the permissions of the root user account, and will operate regardless of which user account is logged in.
Query: risk of An issue was discovered in Open-Xchange Guard before 2.2.0-rev8. The "getprivkeybyid" API call is used to download a PGP Private Key for a specific user after providing authenticat
Matching passage: CVE-2015-8542. CWE: CWE-320. CVSS: 8.800000190734863. An issue was discovered in Open-Xchange Guard before 2.2.0-rev8. The "getprivkeybyid" API call is used to download a PGP Private Key for a specific user after providing authentication credentials. Clients provide the "id" and "cid" parameter to specify the current user by its user- and context-ID. The "auth" parameter contains a hashed password string which gets created by the client by asking the user to enter his or her OX Guard password. This parameter is used as single point of authentication when accessing PGP Private Keys. In case a user has set the same password as another user, it is possible to download another user's PGP Private Key by iterating the "id" and "cid" parameters. This kind of attack would also be able by brute-forcing login credentials, but since the "id" and "cid" parameters are sequential they are much easier to predict than a user's login name. At the same time, there are some obvious insecure standard passwords that are widely used. A attacker could send the hashed representation of typically weak passwords and randomly fetch Private Key of matching accounts. The attack can be executed by both internal users and "guests" which use the external mail reader.
Near-miss passage: CVE-2015-1316. CWE: CWE-320. CVSS: 7.5. Juju Core's Joyent provider before version 1.25.5 uploads the user's private ssh key.
Query: risk of Research Artisan Lite before 1.18 does not ensure that a user has authenticated, which allows remote attackers to perform unspecified actions via unknown vectors.
Matching passage: CVE-2015-2975. CWE: UNKNOWN. CVSS: 5.0. Research Artisan Lite before 1.18 does not ensure that a user has authenticated, which allows remote attackers to perform unspecified actions via unknown vectors.
Near-miss passage: CVE-2015-2016. CWE: UNKNOWN. CVSS: 9.0. Unspecified vulnerability in IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitrary commands with root privileges via unknown vectors.
Query: CVE similar to CVE-2015-2273
Matching passage: CVE-2015-2273. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in mod/quiz/report/statistics/statistics_question_table.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the student role for a crafted quiz response.
Near-miss passage: CVE-2015-2220. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the Ninja Forms plugin before 2.8.9 for WordPress allow (1) remote attackers to inject arbitrary web script or HTML via the ninja_forms_field_1 parameter in a ninja_forms_ajax_submit action to wp-admin/admin-ajax.php or (2) remote administrators to inject arbitrary web script or HTML via the fields[1] parameter to wp-admin/post.php.
Query: SIEM correlation: persistence activity consistent with RC Scripts
Matching passage: T1037.004 RC Scripts. Tactics: persistence, privilege escalation. Description: Adversaries may establish persistence by modifying RC scripts, which are executed during a Unix-like system’s startup. These files allow system administrators to map and start custom services at startup for different run levels. RC scripts require root privileges to modify. Adversaries may establish persistence by adding a malicious binary path or shell commands to <code>rc.local</code>, <code>rc.common</code>, and other RC scripts specific to the Unix-like distribution.(Citation: IranThreats Kittens Dec 2017)(Citation: Intezer HiddenWasp Map 2019) Upon reboot, the system executes the script's contents as root, resulting in persistence. Adversary abuse of RC scripts is especially effective for lightweight Unix-like distributions using the root user as default, such as ESXi hypervisors, IoT, or embedded systems.(Citation: intezer-kaiji-malware) As ESXi servers store most system files in memory and therefore discard changes on shutdown, leveraging `/etc/rc.local.d/local.sh` is one of the few mechanisms for enabling persistence across reboots.(Citation: Juniper Networks ESXi Backdoor 2022) Several Unix-like systems have moved to Systemd and deprecated the use of RC scripts. This is now a deprecated mechanism in macOS in favor of Launchd.(Citation: Apple Developer Doco Archive Launchd)(Citation: Startup Items) This technique can be used on Mac OS X Panther v10.3 and earlier versions which still execute the RC scripts.(Citation: Methods of Mac Malware Persistence) To maintain backwards compatibility some systems, such as Ubuntu, will execute the RC scripts if they exist with the correct file permissions.(Citation: Ubuntu Manpage systemd rc)
Near-miss passage: T1037.005 Startup Items. Tactics: persistence, privilege escalation. Description: Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.(Citation: Startup Items) This is technically a deprecated technology (superseded by [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)), and thus the appropriate folder, <code>/Library/StartupItems</code> isn’t guaranteed to exist on the system by default, but does appear to exist by default on macOS Sierra. A startup item is a directory whose executable and configuration property list (plist), <code>StartupParameters.plist</code>, reside in the top-level directory. An adversary can create the appropriate folders/files in the StartupItems directory to register their own persistence mechanism.(Citation: Methods of Mac Malware Persistence) Additionally, since StartupItems run during the bootup phase of macOS, they will run as the elevated root user.
Query: describe CVE-2015-3290
Matching passage: CVE-2015-3290. CWE: CWE-264. CVSS: 7.199999809265137. arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform improperly relies on espfix64 during nested NMI processing, which allows local users to gain privileges by triggering an NMI within a certain instruction window.
Near-miss passage: CVE-2015-7597. CWE: CWE-264. CVSS: 7.800000190734863. SafeNet Authentication Service IIS Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module.
Query: vulnerability: The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on 
Matching passage: CVE-2015-7576. CWE: CWE-254. CVSS: 3.700000047683716. The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to bypass authentication by measuring timing differences.
Near-miss passage: CVE-2015-1281. CWE: CWE-254. CVSS: 4.300000190734863. core/loader/ImageLoader.cpp in Blink, as used in Google Chrome before 44.0.2403.89, does not properly determine the V8 context of a microtask, which allows remote attackers to bypass Content Security Policy (CSP) restrictions by providing an image from an unintended source.
Query: CVE similar to CVE-2015-2189
Matching passage: CVE-2015-2189. CWE: CWE-189. CVSS: 5.0. Off-by-one error in the pcapng_read function in wiretap/pcapng.c in the pcapng file parser in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via an invalid Interface Statistics Block (ISB) interface ID in a crafted packet.
Near-miss passage: CVE-2015-4022. CWE: CWE-189. CVSS: 7.5. Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command, leading to a heap-based buffer overflow.
Query: alert when Detects the use of the PhoneDeepLink parameter to potentially sideload a DLL file that does not exist. This non-existent
Matching passage: Sigma rule: Detects the use of the PhoneDeepLink parameter to potentially sideload a DLL file that does not exist. This non-existent. Logsource: windows / process_creation. Rule: title: Potential DLL Sideloading Via DeviceEnroller.EXE id: e173ad47-4388-4012-ae62-bd13f71c18a8 related: - id: ee4c5d06-3abc-48cc-8885-77f1c20f4451 type: similar status: test description: 'Detects the use of the PhoneDeepLink parameter to potentially sideload a DLL file that does not exist. This non-existent DLL file is named "ShellChromeAPI.dll". Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter ' references: - https://mobile.twitter.com/0gtweet/status/1564131230941122561 - https://strontic.github.io/xcyclopedia/library/DeviceEnroller.exe-24BEF0D6B0ECED36BB41831759FDE18D.html author: '@gott_cyber' date: 2022-08-29 modified: 2023-02-04 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \deviceenroller.exe - OriginalFileName: deviceenroller.exe selection_cli: CommandLine|contains: /PhoneDeepLink condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects attempts to discover the files with setuid/setgid capability on them. That would allow adversary to escalate the. Logsource: linux / auditd. Rule: title: Linux Capabilities Discovery id: fe10751f-1995-40a5-aaa2-c97ccb4123fe status: test description: Detects attempts to discover the files with setuid/setgid capability on them. That would allow adversary to escalate their privileges. references: - https://man7.org/linux/man-pages/man8/getcap.8.html - https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/ - https://mn3m.info/posts/suid-vs-capabilities/ - https://int0x33.medium.com/day-44-linux-capabilities-privilege-escalation-via-openssl-with-selinux-enabled-and-enforced-74d2bec02099 author: Pawel Mazur date: 2021-11-28 modified: 2022-12-25 tags: - attack.discovery - attack.privilege-escalation - attack.t1083 - attack.t1548 logsource: product: linux service: auditd detection: selection: type: EXECVE a0: getcap a1: -r a2: / condition: selection falsepositives: - Unknown level: low
Query: Sigma YAML for windows / raw_access_thread
Matching passage: Sigma rule: Detects raw disk access using uncommon tools or tools that are located in suspicious locations (heavy filtering is requi. Logsource: windows / raw_access_thread. Rule: title: Potential Defense Evasion Via Raw Disk Access By Uncommon Tools id: db809f10-56ce-4420-8c86-d6a7d793c79c status: test description: Detects raw disk access using uncommon tools or tools that are located in suspicious locations (heavy filtering is required), which could indicate possible defense evasion attempts references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment author: Teymur Kheirkhabarov, oscd.community date: 2019-10-22 modified: 2025-12-03 tags: - attack.stealth - attack.t1006 logsource: product: windows category: raw_access_thread detection: filter_main_floppy: Device|contains: floppy filter_main_generic: Image|startswith: - C:\$WINDOWS.~BT\ - C:\Program Files (x86)\ - C:\Program Files\ - C:\Windows\CCM\ - C:\Windows\explorer.exe - C:\Windows\servicing\ - C:\Windows\SoftwareDistribution\ - C:\Windows\System32\ - C:\Windows\SystemApps\ - C:\Windows\SysWOW64\ - C:\Windows\uus\ - C:\Windows\WinSxS\ filter_main_system_images: Image: - Registry - System filter_main_windefender: Image|startswith: C:\ProgramData\Microsoft\Windows Defender\Platform\ Image|endswith: - \MsMpEng.exe - \MpDefenderCoreService.exe filter_main_microsoft_appdata: Image|startswith: C:\Users\ Image|contains|all: - \AppData\ - \Microsoft\ filter_main_ssd_nvme: Image|startswith: C:\Windows\Temp\ Image|endswith: - \Executables\SSDUpdate.exe - \HostMetadata\NVMEHostmetadata.exe filter_main_null: Image: null filter_main_systemsettings: Image: C:\Windows\ImmersiveControlPanel\SystemSettings.exe filter_main_update: Image|startswith: C:\$WinREAgent\Scratch\ filter_optional_github_desktop: Image|startswith: C:\Users\ Image|contains: \AppData\Local\GitHubDesktop\app- Image|endswith: \resources\app\git\mingw64\bin\git.exe filter_optional_nextron: Image|startswith: C:\Windows\Temp\asgard2-agent\ Image|endswith: \thor.exe filter_optional_Keybase: Image|startswith: C:\Users\ Image|contains: \AppData\Local\Keybase\upd.exe condition: not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Likely level: low
Near-miss passage: Sigma rule: Detects extracting of zip file from image file. Logsource: linux / auditd. Rule: title: Steganography Unzip Hidden Information From Picture File id: edd595d7-7895-4fa7-acb3-85a18a8772ca status: test description: Detects extracting of zip file from image file references: - https://zerotoroot.me/steganography-hiding-a-zip-in-a-jpeg-file/ author: Pawel Mazur date: 2021-09-09 modified: 2022-10-09 tags: - attack.stealth - attack.t1027.003 logsource: product: linux service: auditd detection: commands: type: EXECVE a0: unzip a1: a1|endswith: - .jpg - .png condition: commands and a1 falsepositives: - Unknown level: low
Query: risk of The Web Console in Red Hat Enterprise Application Platform (EAP) before 6.4.4 and WildFly (formerly JBoss Application Server) allows remote attackers to cause a denial of service (
Matching passage: CVE-2015-5220. CWE: CWE-119. CVSS: 5.0. The Web Console in Red Hat Enterprise Application Platform (EAP) before 6.4.4 and WildFly (formerly JBoss Application Server) allows remote attackers to cause a denial of service (memory consumption) via a large request header.
Near-miss passage: CVE-2015-3036. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in the run_init_sbus function in the KCodes NetUSB module for the Linux kernel, as used in certain NETGEAR products, TP-LINK products, and other products, allows remote attackers to execute arbitrary code by providing a long computer name in a session on TCP port 20005.
Query: vulnerability: IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.x through 7.0.0.2 CF29, 8.0.x before 8.0.0.1 CF17, and 8.5.0 before CF06 allows remote attacker
Matching passage: CVE-2015-1943. CWE: CWE-399. CVSS: 7.800000190734863. IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.x through 7.0.0.2 CF29, 8.0.x before 8.0.0.1 CF17, and 8.5.0 before CF06 allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted request.
Near-miss passage: CVE-2015-0830. CWE: CWE-399. CVSS: 5.0. The WebGL implementation in Mozilla Firefox before 36.0 does not properly allocate memory for copying an unspecified string to a shader's compilation log, which allows remote attackers to cause a denial of service (application crash) via crafted WebGL content.
Query: exploit Use-after-free vulnerability in the MovieClip object implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.
Matching passage: CVE-2015-8449. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in the MovieClip object implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via a crafted lineTo method call, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Near-miss passage: CVE-2015-2590. CWE: UNKNOWN. CVSS: 9.800000190734863. Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-4732.
Query: CVE similar to CVE-2015-7228
Matching passage: CVE-2015-7228. CWE: UNKNOWN. CVSS: 5.0. The RESTful module 7.x-1.x before 7.x-1.3 for Drupal does not properly cache pages of authenticated users when using non-cookie authentication providers, which allows remote attackers to obtain sensitive information via unspecified vectors.
Near-miss passage: CVE-2015-5652. CWE: UNKNOWN. CVSS: 7.199999809265137. Untrusted search path vulnerability in python.exe in Python through 3.5.0 on Windows allows local users to gain privileges via a Trojan horse readline.pyd file in the current working directory. NOTE: the vendor says "It was determined that this is a longtime behavior of Python that cannot really be altered at this point."
Query: vulnerability: Report Builder in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 allows man-in-the-middle attackers to obtain sens
Matching passage: CVE-2015-7470. CWE: CWE-200. CVSS: 7.5. Report Builder in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors, as demonstrated by login information.
Near-miss passage: CVE-2015-5576. CWE: CWE-200. CVSS: 5.0. Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors.
Query: risk of Multiple cross-site scripting (XSS) vulnerabilities in Apache Sling API before 2.2.2 and Apache Sling Servlets Post before 2.1.2 allow remote attackers to inject arbitrary web scri
Matching passage: CVE-2015-2944. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Apache Sling API before 2.2.2 and Apache Sling Servlets Post before 2.1.2 allow remote attackers to inject arbitrary web script or HTML via the URI, related to (1) org/apache/sling/api/servlets/HtmlResponse and (2) org/apache/sling/servlets/post/HtmlResponse.
Near-miss passage: CVE-2015-7349. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the sample feedback.inc file in VASCO DIGIPASS authentication plug-in for Citrix Web Interface allows remote attackers to inject arbitrary web script or HTML via the failmessage parameter.
Query: risk of Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explo
Matching passage: CVE-2015-1736. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1731, CVE-2015-1737, and CVE-2015-1755.
Near-miss passage: CVE-2015-1819. CWE: CWE-399. CVSS: 5.0. The xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data, related to an XML Entity Expansion (XEE) attack.
Query: weakness Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Matching passage: CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'). The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
Near-miss passage: CWE-419 Unprotected Primary Channel. The product uses a primary channel for administration or restricted functionality, but it does not properly protect the channel.