alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the 
Matching passage: CVE-2015-5688. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the PATH_INFO to the default URI.
Near-miss passage: CVE-2015-7888. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in the WifiHs20UtilityService on the Samsung S6 Edge LRX22G.G925VVRU1AOE2 allows remote attackers to overwrite or create arbitrary files as the system-level user via a .. (dot dot) in the name of a file, compressed into a zipped file named cred.zip, and downloaded to /sdcard/Download.
Query: risk of Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Fire
Matching passage: CVE-2015-4769. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Firewall, a different vulnerability than CVE-2015-4767.
Near-miss passage: CVE-2015-4748. CWE: UNKNOWN. CVSS: 7.599999904632568. Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and Embedded 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Security.
Query: mitigate Credentials in Registry
Matching passage: T1552.002 Credentials in Registry. Tactics: credential access. Description: Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons. Example commands to find Registry keys related to password information: (Citation: Pentestlab Stored Credentials) * Local Machine Hive: <code>reg query HKLM /f password /t REG_SZ /s</code> * Current User Hive: <code>reg query HKCU /f password /t REG_SZ /s</code>
Near-miss passage: T1552.007 Container API. Tactics: credential access. Description: Adversaries may gather credentials via APIs within a containers environment. APIs in these environments, such as the Docker API and Kubernetes APIs, allow a user to remotely manage their container resources and cluster components.(Citation: Docker API)(Citation: Kubernetes API) An adversary may access the Docker API to collect logs that contain credentials to cloud, container, and various other resources in the environment.(Citation: Unit 42 Unsecured Docker Daemons) An adversary with sufficient permissions, such as via a pod's service account, may also use the Kubernetes API to retrieve credentials from the Kubernetes API server. These credentials may include those needed for Docker API authentication or secrets from Kubernetes cluster components.
Query: alert when Detects a network connection initiated by Cmstp.EXE Its uncommon for "cmstp.exe" to initiate an outbound network connect
Matching passage: Sigma rule: Detects a network connection initiated by Cmstp.EXE Its uncommon for "cmstp.exe" to initiate an outbound network connect. Logsource: windows / network_connection. Rule: title: Outbound Network Connection Initiated By Cmstp.EXE id: efafe0bf-4238-479e-af8f-797bd3490d2d status: test description: 'Detects a network connection initiated by Cmstp.EXE Its uncommon for "cmstp.exe" to initiate an outbound network connection. Investigate the source of such requests to determine if they are malicious. ' references: - https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-30 modified: 2024-05-31 tags: - attack.stealth - attack.t1218.003 logsource: category: network_connection product: windows detection: selection: Image|endswith: \cmstp.exe Initiated: 'true' filter_main_local_ranges: DestinationIp|cidr: - 127.0.0.0/8 - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects instances where the ArcGIS Server process ArcSOC.exe, which hosts REST services running on an ArcGIS server, cre. Logsource: windows / file_event. Rule: title: Suspicious File Created by ArcSOC.exe id: e890acee-d488-420e-8f20-d9b19b3c3d43 status: experimental description: 'Detects instances where the ArcGIS Server process ArcSOC.exe, which hosts REST services running on an ArcGIS server, creates a file with suspicious file type, indicating that it may be an executable, script file, or otherwise unusual. ' references: - https://reliaquest.com/blog/threat-spotlight-inside-flax-typhoons-arcgis-compromise/ - https://enterprise.arcgis.com/en/server/12.0/administer/windows/inside-an-arcgis-server-site.htm author: Micah Babinski date: 2025-11-25 tags: - attack.command-and-control - attack.persistence - attack.initial-access - attack.execution - attack.stealth - attack.t1127 - attack.t1105 - attack.t1133 logsource: category: file_event product: windows detection: selection: Image|endswith: \ArcSOC.exe TargetFilename|endswith: - .ahk - .aspx - .au3 - .bat - .cmd - .dll - .exe - .hta - .js - .ps1 - .py - .vbe - .vbs - .wsf condition: selection falsepositives: - Unlikely level: high
Query: CVE similar to CVE-2015-8733
Matching passage: CVE-2015-8733. CWE: CWE-20. CVSS: 5.5. The ngsniffer_process_record function in wiretap/ngsniffer.c in the Sniffer file parser in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate the relationships between record lengths and record header lengths, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file.
Near-miss passage: CVE-2015-6369. CWE: CWE-20. CVSS: 4.900000095367432. The USB driver in Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices allows physically proximate attackers to cause a denial of service via a crafted USB device that triggers invalid USB commands, aka Bug ID CSCux10531.
Query: detection rule: Detects the use of tools that copy files from or to remote systems
Matching passage: Sigma rule: Detects the use of tools that copy files from or to remote systems. Logsource: linux. Rule: title: Remote File Copy id: 7a14080d-a048-4de8-ae58-604ce58a795b status: stable description: Detects the use of tools that copy files from or to remote systems references: - https://www.cisa.gov/stopransomware/ransomware-guide author: Ömer Günal date: 2020-06-18 tags: - attack.command-and-control - attack.lateral-movement - attack.t1105 logsource: product: linux detection: tools: - 'scp ' - 'rsync ' - 'sftp ' filter: - '@' - ':' condition: tools and filter falsepositives: - Legitimate administration activities level: low
Near-miss passage: Sigma rule: Detects suspicious Plink tunnel port forwarding to a local port. Logsource: windows / process_creation. Rule: title: Suspicious Plink Port Forwarding id: 48a61b29-389f-4032-b317-b30de6b95314 status: test description: Detects suspicious Plink tunnel port forwarding to a local port references: - https://www.real-sec.com/2019/04/bypassing-network-restrictions-through-rdp-tunneling/ - https://medium.com/@informationsecurity/remote-ssh-tunneling-with-plink-exe-7831072b3d7d author: Florian Roth (Nextron Systems) date: 2021-01-19 modified: 2022-10-09 tags: - attack.command-and-control - attack.t1572 - attack.lateral-movement - attack.t1021.001 logsource: category: process_creation product: windows detection: selection: Description: Command-line SSH, Telnet, and Rlogin client CommandLine|contains: ' -R ' condition: selection falsepositives: - Administrative activity using a remote port forwarding to a local port level: high
Query: CWE for Incomplete Documentation of Program Execution
Matching passage: CWE-1112 Incomplete Documentation of Program Execution. The document does not fully define all mechanisms that are used to control or influence how product-specific programs are executed.
Near-miss passage: CWE-676 Use of Potentially Dangerous Function. The product invokes a potentially dangerous function that could introduce a vulnerability if it is used incorrectly, but the function can also be used safely.
Query: CVE similar to CVE-2015-5703
Matching passage: CVE-2015-5703. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the public key discovery API call in Open-Xchange OX Guard before 2.0.0-rev8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-10014. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability classified as critical has been found in arekk uke. This affects an unknown part of the file lib/uke/finder.rb. The manipulation leads to sql injection. The identifier of the patch is 52fd3b2d0bc16227ef57b7b98a3658bb67c1833f. It is recommended to apply a patch to fix this issue. The identifier VDB-217485 was assigned to this vulnerability.
Query: exploit Buffer overflow in the Telnet service in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Window
Matching passage: CVE-2015-0014. CWE: CWE-119. CVSS: 10.0. Buffer overflow in the Telnet service in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows Telnet Service Buffer Overflow Vulnerability."
Near-miss passage: CVE-2015-4486. CWE: CWE-119. CVSS: 10.0. The decrease_ref_count function in libvpx in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via malformed WebM video data.
Query: patch priority for CVE-2015-1887
Matching passage: CVE-2015-1887. CWE: CWE-200. CVSS: 5.0. IBM WebSphere Portal 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF17, and 8.5.0 before CF06 allows remote attackers to obtain sensitive Java Content Repository (JCR) information via a crafted request.
Near-miss passage: CVE-2015-5859. CWE: CWE-200. CVSS: 4.300000190734863. The CFNetwork HTTPProtocol component in Apple iOS before 9 and OS X before 10.11 does not properly recognize the HSTS preload list during a Safari private-browsing session, which makes it easier for remote attackers to obtain sensitive information by sniffing the network.
Query: describe CVE-2015-0433
Matching passage: CVE-2015-0433. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote authenticated users to affect availability via vectors related to InnoDB : DML.
Near-miss passage: CVE-2015-4146. CWE: UNKNOWN. CVSS: 5.0. The EAP-pwd peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not clear the L (Length) and M (More) flags before determining if a response should be fragmented, which allows remote attackers to cause a denial of service (crash) via a crafted message.
Query: describe CVE-2015-3725
Matching passage: CVE-2015-3725. CWE: CWE-399. CVSS: 4.300000190734863. MobileInstallation in Apple iOS before 8.4 does not ensure the uniqueness of Watch bundle IDs, which allows attackers to cause a denial of service (ID collision and Watch launch outage) via a crafted universal provisioning profile app.
Near-miss passage: CVE-2015-6994. CWE: CWE-399. CVSS: 7.099999904632568. The kernel in Apple iOS before 9.1 and OS X before 10.11.1 mishandles reuse of virtual memory, which allows attackers to cause a denial of service via a crafted app.
Query: describe CVE-2015-8759
Matching passage: CVE-2015-8759. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in the typoLink function in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote authenticated editors to inject arbitrary web script or HTML via a link field.
Near-miss passage: CVE-2015-0265. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the Policy Admin Tool in Apache Ranger before 0.5.0 allows remote attackers to inject arbitrary web script or HTML via the HTTP User-Agent header.
Query: risk of libxml2 in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (memory corruptio
Matching passage: CVE-2015-3807. CWE: CWE-119. CVSS: 4.300000190734863. libxml2 in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (memory corruption) via a crafted XML document.
Near-miss passage: CVE-2015-7730. CWE: CWE-119. CVSS: 10.0. SAP BusinessObjects BI Platform 4.1, BusinessObjects Edge 4.0, and BusinessObjects XI (BOXI) 3.1 R3 allow remote attackers to cause a denial of service (out-of-bounds read and listener crash) via a crafted GIOP packet, aka SAP Security Note 2001108.
Query: Sigma rule for Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as
Matching passage: Sigma rule: Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as. Logsource: windows / image_load. Rule: title: Time Travel Debugging Utility Usage - Image id: e76c8240-d68f-4773-8880-5c6f63595aaf status: test description: Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as lsass.exe, via tttracer.exe. references: - https://lolbas-project.github.io/lolbas/Binaries/Tttracer/ - https://twitter.com/mattifestation/status/1196390321783025666 - https://twitter.com/oulusoyum/status/1191329746069655553 author: Ensar Şamil, @sblmsrsn, @oscd_initiative date: 2020-10-06 modified: 2022-12-02 tags: - attack.credential-access - attack.stealth - attack.t1218 - attack.t1003.001 logsource: product: windows category: image_load detection: selection: ImageLoaded|endswith: - \ttdrecord.dll - \ttdwriter.dll - \ttdloader.dll condition: selection falsepositives: - Legitimate usage by software developers/testers level: high
Near-miss passage: Sigma rule: Detects a failed installation of a Exchange Transport Agent. Logsource: windows / msexchange-management. Rule: title: Failed MSExchange Transport Agent Installation id: c7d16cae-aaf3-42e5-9c1c-fb8553faa6fa status: test description: Detects a failed installation of a Exchange Transport Agent references: - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=8 author: Tobias Michalski (Nextron Systems) date: 2021-06-08 modified: 2022-07-12 tags: - attack.persistence - attack.t1505.002 logsource: service: msexchange-management product: windows detection: selection: EventID: 6 Data|contains: Install-TransportAgent condition: selection falsepositives: - Legitimate installations of exchange TransportAgents. AssemblyPath is a good indicator for this. level: high
Query: risk of Use-after-free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers t
Matching passage: CVE-2015-0358. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0349, CVE-2015-0351, and CVE-2015-3039.
Near-miss passage: CVE-2015-0392. CWE: UNKNOWN. CVSS: 4.599999904632568. Unspecified vulnerability in the Siebel Core - Server BizLogic Script component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Config - Scripting.
Query: vulnerability: D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which allows local users to cause a
Matching passage: CVE-2015-0245. CWE: CWE-362. CVSS: 1.899999976158142. D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which allows local users to cause a denial of service (activation failure error returned) by leveraging a race condition involving sending an ActivationFailure signal before systemd responds.
Near-miss passage: CVE-2015-8839. CWE: CWE-362. CVSS: 5.099999904632568. Multiple race conditions in the ext4 filesystem implementation in the Linux kernel before 4.5 allow local users to cause a denial of service (disk corruption) by writing to a page that is associated with a different user's file after unsynchronized hole punching and page-fault handling.
Query: exploit The LDAP Authentication functionality in Foreman might allow remote attackers with knowledge of old passwords to gain access via vectors involving the password lifetime period in A
Matching passage: CVE-2015-5246. CWE: CWE-254. CVSS: 8.100000381469727. The LDAP Authentication functionality in Foreman might allow remote attackers with knowledge of old passwords to gain access via vectors involving the password lifetime period in Active Directory.
Near-miss passage: CVE-2015-5857. CWE: CWE-254. CVSS: 5.0. Mail in Apple iOS before 9 allows remote attackers to use an address-book contact as a spoofed e-mail sender address via unspecified vectors.
Query: patch priority for CVE-2015-6388
Matching passage: CVE-2015-6388. CWE: UNKNOWN. CVSS: 5.0. Cisco Unified Computing System (UCS) Central software 1.3(0.1) allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted request, aka Bug ID CSCux33575.
Near-miss passage: CVE-2015-5359. CWE: UNKNOWN. CVSS: 7.099999904632568. Juniper Junos OS 12.1X44 before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R9, 12.3X48 before 12.3X48-D10, 13.2 before 13.2R7, 13.3 before 13.3R5, 14.1R3 before 14.1R3-S2, 14.1 before 14.1R4, 14.2 before 14.2R2, and 15.1 before 15.1R1 allows remote attackers to cause a denial of service (NULL pointer dereference and RDP crash) via a large number of BGP-VPLS advertisements with updated BGP local preference values.
Query: describe CVE-2015-6769
Matching passage: CVE-2015-6769. CWE: CWE-264. CVSS: 7.5. The provisional-load commit implementation in WebKit/Source/bindings/core/v8/WindowProxy.cpp in Google Chrome before 47.0.2526.73 allows remote attackers to bypass the Same Origin Policy by leveraging a delay in window proxy clearing.
Near-miss passage: CVE-2015-1904. CWE: CWE-264. CVSS: 3.5. IBM Business Process Manager (BPM) 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0, when external Enterprise Content Management (ECM) integration is enabled with a certain technical system account configuration, allows remote authenticated users to bypass intended document-access restrictions via a (1) upload or (2) download action.
Query: rule covering Detects successful code compilation via Visual Basic Command Line Compiler that utilizes Windows Resource to Object Conv
Matching passage: Sigma rule: Detects successful code compilation via Visual Basic Command Line Compiler that utilizes Windows Resource to Object Conv. Logsource: windows / process_creation. Rule: title: Visual Basic Command Line Compiler Usage id: 7b10f171-7f04-47c7-9fa2-5be43c76e535 status: test description: Detects successful code compilation via Visual Basic Command Line Compiler that utilizes Windows Resource to Object Converter. references: - https://lolbas-project.github.io/lolbas/Binaries/Vbc/ author: Ensar Şamil, @sblmsrsn, @oscd_initiative date: 2020-10-07 modified: 2021-11-27 tags: - attack.stealth - attack.t1027.004 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \vbc.exe Image|endswith: \cvtres.exe condition: selection falsepositives: - Utilization of this tool should not be seen in enterprise environment level: high
Near-miss passage: Sigma rule: Detects registry modifications that hide internal tools or functions from the user (malware like Agent Tesla, Hermetic W. Logsource: windows / registry_set. Rule: title: Registry Hide Function from User id: 5a93eb65-dffa-4543-b761-94aa60098fb6 status: test description: Detects registry modifications that hide internal tools or functions from the user (malware like Agent Tesla, Hermetic Wiper uses this technique) references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.001/T1564.001.md author: frack113 date: 2022-03-18 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection_set_1: TargetObject|endswith: - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideClock - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCANetwork - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAPower - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAVolume Details: DWORD (0x00000001) selection_set_0: TargetObject|endswith: - SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowInfoTip - SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowCompColor Details: DWORD (0x00000000) condition: 1 of selection_set_* falsepositives: - Legitimate admin script level: medium
Query: playbook for alert: Persistence mechanism resembling Search Open Technical Databases
Matching passage: Playbook for T1596 Search Open Technical Databases. 1) Validate alert telemetry against T1596. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: reconnaissance. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may search freely available technical databases for information about victims that can be used during targeting. Information about victims may be available in online databases and repositories, such as registrations of domains/certificates as well as public collections of network data/artifacts gathered from traffic and/or scans.(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: Circl
Near-miss passage: Playbook for T1596.005 Scan Databases. Different response path focused on reconnaissance.
Query: patch priority for CVE-2015-4628
Matching passage: CVE-2015-4628. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in application/controllers/admin/questiongroups.php in LimeSurvey before 2.06+ Build 150618 allows remote authenticated administrators to execute arbitrary SQL commands via the sid parameter.
Near-miss passage: CVE-2015-0919. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in the administrative backend in Sefrengo before 1.6.1 allow remote administrators to execute arbitrary SQL commands via the (1) idcat or (2) idclient parameter to backend/main.php.