alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: The history implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to bypass the Same Origin Policy and rea
Matching passage: CVE-2015-1155. CWE: CWE-264. CVSS: 4.300000190734863. The history implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to bypass the Same Origin Policy and read arbitrary files via a crafted web site.
Near-miss passage: CVE-2015-8951. CWE: CWE-264. CVSS: 7.800000190734863. Multiple use-after-free vulnerabilities in sound/soc/msm/qdsp6v2/msm-lsm-client.c in the Qualcomm sound driver in Android before 2016-10-05 on Nexus 5X, Nexus 6P, and Android One devices allow attackers to gain privileges via a crafted application, aka Android internal bug 30142668 and Qualcomm internal bug CR 948902.
Query: Outbound C2 pattern associated with One-Way Communication
Matching passage: T1102.003 One-Way Communication. Tactics: command and control. Description: Adversaries may use an existing, legitimate external Web service as a means for sending commands to a compromised system without receiving return output over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems may opt to send the output from those commands back over a different C2 channel, including to another distinct Web service. Alternatively, compromised systems may return no output at all in cases where adversaries want to send instructions to systems and do not want a response. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Near-miss passage: T1102 Web Service. Tactics: command and control. Description: Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise.(Citation: Broadcom BirdyClient Microsoft Graph API 2024) Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).
Query: CVE similar to CVE-2015-8223
Matching passage: CVE-2015-8223. CWE: CWE-275. CVSS: 5.5. Huawei P7 before P7-L00C17B851, P7-L05C00B851, and P7-L09C92B85, and P8 ALE-UL00 before ALE-UL00B211 allows local users to cause a denial of service (OS crash) by leveraging camera permissions and via crafted input to the camera driver.
Near-miss passage: CVE-2015-7842. CWE: CWE-275. CVSS: 7.099999904632568. Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with software before V100R003C00SPC503, XH628 V3 with software before V100R003C00SPC602, RH1288 V3 with software before V100R003C00SPC602, RH2288A V2 with software before V100R002C00SPC701, RH1288A V2 with software before V100R002C00SPC502, RH8100 V3 with software before V100R003C00SPC110, CH222 V3 with software before V100R001C00SPC161, CH220 V3 with software before V100R001C00SPC161, and CH121 V3 with software before V100R001C00SPC161 allow remote authenticated operators to change server information by leveraging failure to verify user permissions.
Query: alert when Detects the import of an alternate data stream with regini.exe, regini.exe can be used to modify registry keys.
Matching passage: Sigma rule: Detects the import of an alternate data stream with regini.exe, regini.exe can be used to modify registry keys.. Logsource: windows / process_creation. Rule: title: Suspicious Registry Modification From ADS Via Regini.EXE id: 77946e79-97f1-45a2-84b4-f37b5c0d8682 related: - id: 5f60740a-f57b-4e76-82a1-15b6ff2cb134 type: derived status: test description: Detects the import of an alternate data stream with regini.exe, regini.exe can be used to modify registry keys. references: - https://lolbas-project.github.io/lolbas/Binaries/Regini/ - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/regini author: Eli Salem, Sander Wiebing, oscd.community date: 2020-10-12 modified: 2023-02-08 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \regini.exe - OriginalFileName: REGINI.EXE selection_re: CommandLine|re: :[^ \\] condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects usage of the Chisel tunneling tool via the commandline arguments. Logsource: windows / process_creation. Rule: title: PUA - Chisel Tunneling Tool Execution id: 8b0e12da-d3c3-49db-bb4f-256703f380e5 related: - id: cf93e05e-d798-4d9e-b522-b0248dc61eaf type: similar status: test description: Detects usage of the Chisel tunneling tool via the commandline arguments references: - https://github.com/jpillora/chisel/ - https://arcticwolf.com/resources/blog/lorenz-ransomware-chiseling-in/ - https://blog.sekoia.io/lucky-mouse-incident-response-to-detection-engineering/ author: Florian Roth (Nextron Systems) date: 2022-09-13 modified: 2023-02-13 tags: - attack.command-and-control - attack.t1090.001 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \chisel.exe selection_param1: CommandLine|contains: - 'exe client ' - 'exe server ' selection_param2: CommandLine|contains: - -socks5 - -reverse - ' r:' - ':127.0.0.1:' - '-tls-skip-verify ' - :socks condition: selection_img or all of selection_param* falsepositives: - Some false positives may occur with other tools with similar commandlines level: high
Query: SOC alert related to Code Repositories
Matching passage: T1593.003 Code Repositories. Tactics: reconnaissance. Description: Adversaries may search public code repositories for information about victims that can be used during targeting. Victims may store code in repositories on various third-party websites such as GitHub, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git. Adversaries may search various public code repositories for various information about a victim. Public code repositories can often be a source of various general information about victims, such as commonly used programming languages and libraries as well as the names of employees. Adversaries may also identify more sensitive data, including accidentally leaked credentials or API keys.(Citation: GitHub Cloud Service Credentials) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Valid Accounts](https://attack.mitre.org/techniques/T1078) or [Phishing](https://attack.mitre.org/techniques/T1566)). **Note:** This is distinct from [Code Repositories](https://attack.mitre.org/techniques/T1213/003), which focuses on [Collection](https://attack.mitre.org/tactics/TA0009) from private and internally hosted code repositories.
Near-miss passage: T1593.001 Social Media. Tactics: reconnaissance. Description: Adversaries may search social media for information about victims that can be used during targeting. Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff. Adversaries may search in different social media sites depending on what information they seek to gather. Threat actors may passively harvest data from these sites, as well as use information gathered to create fake profiles/groups to elicit victim’s into revealing specific information (i.e. [Spearphishing Service](https://attack.mitre.org/techniques/T1598/001)).(Citation: Cyware Social Media) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003)).
Query: exploit The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold a
Matching passage: CVE-2015-2517. CWE: CWE-264. CVSS: 6.900000095367432. The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka "Win32k Memory Corruption Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2511, CVE-2015-2518, and CVE-2015-2546.
Near-miss passage: CVE-2015-2481. CWE: CWE-264. CVSS: 9.300000190734863. The RyuJIT compiler in Microsoft .NET Framework 4.6 produces incorrect code during an attempt at optimization, which allows remote attackers to execute arbitrary code via a crafted .NET application, aka "RyuJIT Optimization Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2479 and CVE-2015-2480.
Query: exploit The CPDF_Document::GetPage function in fpdfapi/fpdf_parser/fpdf_parser_document.cpp in PDFium, as used in Google Chrome before 46.0.2490.71, does not properly perform a cast of a d
Matching passage: CVE-2015-6758. CWE: CWE-17. CVSS: 6.800000190734863. The CPDF_Document::GetPage function in fpdfapi/fpdf_parser/fpdf_parser_document.cpp in PDFium, as used in Google Chrome before 46.0.2490.71, does not properly perform a cast of a dictionary object, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document.
Near-miss passage: CVE-2015-7045. CWE: CWE-17. CVSS: 5.0. Keychain Access in Apple OS X before 10.11.2 and tvOS before 9.1 improperly interacts with Keychain Agent, which allows attackers to spoof the Keychain Server via unspecified vectors.
Query: vulnerability: IBM Capacity Management Analytics 2.1.0.0 allows local users to discover encrypted usernames and passwords by leveraging access to the CMA install machine. IBM X-Force ID: 107863.
Matching passage: CVE-2015-7434. CWE: CWE-200. CVSS: 7.800000190734863. IBM Capacity Management Analytics 2.1.0.0 allows local users to discover encrypted usernames and passwords by leveraging access to the CMA install machine. IBM X-Force ID: 107863.
Near-miss passage: CVE-2015-3277. CWE: CWE-200. CVSS: 7.5. The mod_nss module before 1.0.11 in Fedora allows remote attackers to obtain cipher lists due to incorrect parsing of multi-keyword cipherstring.
Query: exploit The administrative web interface on Moxa EDS-405A and EDS-408A switches with firmware before 3.6 allows remote authenticated users to bypass a read-only protection mechanism by usi
Matching passage: CVE-2015-6464. CWE: UNKNOWN. CVSS: 8.5. The administrative web interface on Moxa EDS-405A and EDS-408A switches with firmware before 3.6 allows remote authenticated users to bypass a read-only protection mechanism by using Firefox with a web-developer plugin.
Near-miss passage: CVE-2015-2629. CWE: UNKNOWN. CVSS: 9.0. Unspecified vulnerability in the Java VM component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-0457.
Query: describe CVE-2015-8990
Matching passage: CVE-2015-8990. CWE: CWE-254. CVSS: 7.5. Detection bypass vulnerability in Intel Security Advanced Threat Defense (ATD) 3.4.6 and earlier allows malware samples to bypass ATD detection via renaming the malware.
Near-miss passage: CVE-2015-0599. CWE: CWE-254. CVSS: 4.300000190734863. The web interface in Cisco Integrated Management Controller in Cisco Unified Computing System (UCS) on C-Series Rack Servers does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting (XFS)" issue, aka Bug ID CSCuf50138.
Query: detect Identifies when a suppression rule is created in Azure. Adversary's could attempt this to evade detection. in logs
Matching passage: Sigma rule: Identifies when a suppression rule is created in Azure. Adversary's could attempt this to evade detection.. Logsource: azure / activitylogs. Rule: title: Azure Suppression Rule Created id: 92cc3e5d-eb57-419d-8c16-5c63f325a401 status: test description: Identifies when a suppression rule is created in Azure. Adversary's could attempt this to evade detection. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer date: 2021-08-16 modified: 2022-08-23 tags: - attack.impact logsource: product: azure service: activitylogs detection: selection: operationName: MICROSOFT.SECURITY/ALERTSSUPPRESSIONRULES/WRITE condition: selection falsepositives: - Suppression Rule being created may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Suppression Rule created from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects the execution of a binary from the Linux shared memory directory /dev/shm. This directory is a tmpfs mount backe. Logsource: linux / process_creation. Rule: title: Process Execution From Shared Memory Directory id: 5cd16c8f-44a6-4654-81e7-a84d6db507d4 status: experimental description: 'Detects the execution of a binary from the Linux shared memory directory /dev/shm. This directory is a tmpfs mount backed entirely by RAM and is abused by attackers for fileless malware staging because files written there never touch physical disk and may evade disk-based detection. ' references: - https://www.sysdig.com/blog/containers-read-only-fileless-malware - https://unfinished.bike/fun-with-the-new-bpfdoor-2023 - https://asiapacificdefencereporter.com/wp-content/uploads/2023/08/Final-CRWD-2023-Threat-Hunting-Report.pdf - https://www.crowdstrike.com/en-us/blog/how-to-hunt-for-decisivearchitect-and-justforfun-implant/ - https://www.linkedin.com/posts/avradeep_malware-apt-infostealer-activity-7373203959697719296-JR-7 - https://www.stormshield.com/news/orbit-analysis-of-a-linux-dedicated-malware/ author: Stan Beukers date: 2026-06-20 tags: - attack.stealth - attack.execution - attack.t1027.011 logsource: category: process_creation product: linux detection: selection: Image|startswith: /dev/shm/ condition: selection falsepositives: - Unlikely in production environments; some container runtimes or IPC frameworks may use /dev/shm for inter-process communication but should not spawn executables. level: high
Query: CVE similar to CVE-2015-2016
Matching passage: CVE-2015-2016. CWE: UNKNOWN. CVSS: 9.0. Unspecified vulnerability in IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitrary commands with root privileges via unknown vectors.
Near-miss passage: CVE-2015-2473. CWE: UNKNOWN. CVSS: 9.300000190734863. Untrusted search path vulnerability in the client in Remote Desktop Protocol (RDP) through 8.1 in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .rdp file, aka "Remote Desktop Protocol DLL Planting Remote Code Execution Vulnerability."
Query: vulnerability: Cross-site scripting (XSS) vulnerability in Foreman 1.7.0 and after.
Matching passage: CVE-2015-5282. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Foreman 1.7.0 and after.
Near-miss passage: CVE-2015-7879. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in the Stickynote module 7.x before 7.x-1.3 for Drupal allows remote authenticated users with permission to create or edit a stickynote to inject arbitrary web script or HTML via note text on the admin listing page.
Query: actor TTPs: Purchase Technical Data
Matching passage: T1597.002 Purchase Technical Data. Tactics: reconnaissance. Description: Adversaries may purchase technical information about victims that can be used during targeting. Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets. Adversaries may purchase information about their already identified targets, or use purchased data to discover opportunities for successful breaches. Threat actors may gather various technical details from purchased data, including but not limited to employee contact information, credentials, or specifics regarding a victim’s infrastructure.(Citation: ZDNET Selling Data) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).
Near-miss passage: T1597.001 Threat Intel Vendors. Tactics: reconnaissance. Description: Adversaries may search private data from threat intelligence vendors for information that can be used during targeting. Threat intelligence vendors may offer paid feeds or portals that offer more data than what is publicly reported. Although sensitive details (such as customer names and other identifiers) may be redacted, this information may contain trends regarding breaches such as target industries, attribution claims, and successful TTPs/countermeasures.(Citation: D3Secutrity CTI Feeds) Adversaries may search in private threat intelligence vendor data to gather actionable information. If a threat actor is searching for information on their own activities, that falls under [Search Threat Vendor Data](https://attack.mitre.org/techniques/T1681). Information reported by vendors may also reveal opportunities other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190) or [External Remote Services](https://attack.mitre.org/techniques/T1133)).
Query: patch priority for CVE-2015-4004
Matching passage: CVE-2015-4004. CWE: CWE-119. CVSS: 8.5. The OZWPAN driver in the Linux kernel through 4.0.5 relies on an untrusted length field during packet parsing, which allows remote attackers to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read and system crash) via a crafted packet.
Near-miss passage: CVE-2015-5380. CWE: CWE-119. CVSS: 7.5. The Utf8DecoderBase::WriteUtf16Slow function in unicode-decoder.cc in Google V8, as used in Node.js before 0.12.6, io.js before 1.8.3 and 2.x before 2.3.3, and other products, does not verify that there is memory available for a UTF-16 surrogate pair, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted byte sequence.
Query: vulnerability: rubygem-openshift-origin-console in Red Hat OpenShift 2.2 allows remote authenticated users to execute arbitrary commands via a crafted request to the Broker.
Matching passage: CVE-2015-5274. CWE: CWE-77. CVSS: 6.5. rubygem-openshift-origin-console in Red Hat OpenShift 2.2 allows remote authenticated users to execute arbitrary commands via a crafted request to the Broker.
Near-miss passage: CVE-2015-6971. CWE: CWE-77. CVSS: 7.800000190734863. Lenovo System Update (formerly ThinkVantage System Update) before 5.07.0013 allows local users to submit commands to the System Update service (SUService.exe) and gain privileges by launching signed Lenovo executables.
Query: describe CVE-2015-5783
Matching passage: CVE-2015-5783. CWE: CWE-119. CVSS: 9.300000190734863. IOGraphics in Apple OS X before 10.10.5 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2015-3770.
Near-miss passage: CVE-2015-3723. CWE: CWE-119. CVSS: 6.800000190734863. CoreGraphics in Apple iOS before 8.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted ICC profile in a PDF document, a different vulnerability than CVE-2015-3724.