alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-3252
Matching passage: CVE-2015-3252. CWE: CWE-255. CVSS: 9.800000190734863. Apache CloudStack before 4.5.2 does not properly preserve VNC passwords when migrating KVM virtual machines, which allows remote attackers to gain access by connecting to the VNC server.
Near-miss passage: CVE-2015-8675. CWE: CWE-255. CVSS: 6.199999809265137. Huawei S5300 Campus Series switches with software before V200R005SPH008 do not mask the password when uploading files, which allows physically proximate attackers to obtain sensitive password information by reading the display.
Query: vulnerability: Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote attackers to obtain sensitive debugging information by entering a crafted URL to trigger a
Matching passage: CVE-2015-7900. CWE: CWE-200. CVSS: 4.300000190734863. Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote attackers to obtain sensitive debugging information by entering a crafted URL to trigger an exception, and then visiting a certain status page.
Near-miss passage: CVE-2015-3195. CWE: CWE-200. CVSS: 5.300000190734863. The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application.
Query: risk of Cross-site scripting (XSS) vulnerability in IBM Tivoli Federated Identity Manager (TFIM) 6.2.2 before FP16 allows remote attackers to inject arbitrary web script or HTML via a craf
Matching passage: CVE-2015-4959. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in IBM Tivoli Federated Identity Manager (TFIM) 6.2.2 before FP16 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-7536. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to workspaces and archived artifacts.
Query: describe CVE-2015-4277
Matching passage: CVE-2015-4277. CWE: CWE-399. CVSS: 4.900000095367432. The global-configuration implementation on Cisco ASR 9000 devices with software 5.1.3 and 5.3.0 improperly closes vty sessions after a commit/end operation, which allows local users to cause a denial of service (tmp/*config file creation, memory consumption, and device hang) via unspecified vectors, aka Bug ID CSCut93842.
Near-miss passage: CVE-2015-2170. CWE: CWE-399. CVSS: 5.0. The upx decoder in ClamAV before 0.98.7 allows remote attackers to cause a denial of service (crash) via a crafted file.
Query: risk of In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 410/12, SD 617, SD 650/52, SD 800, SD 808, and SD 810, missing of return value check i
Matching passage: CVE-2015-9173. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 410/12, SD 617, SD 650/52, SD 800, SD 808, and SD 810, missing of return value check in memscpy can cause memory corruption in TQS App.
Near-miss passage: CVE-2015-6145. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 7 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6146.
Query: Multiple failed authentications followed by Match Legitimate Resource Name or Location
Matching passage: T1036.005 Match Legitimate Resource Name or Location. Tactics: stealth. Description: Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: `svchost.exe`). Alternatively, a Windows Registry key may be given a close approximation to a key used by a legitimate program. In containerized environments, a threat actor may create a resource in a trusted namespace or one that matches the naming convention of a container pod or cluster.(Citation: Aquasec Kubernetes Backdoor 2023)
Near-miss passage: T1036.003 Rename Legitimate Utilities. Tactics: stealth. Description: Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for legitimate utilities adversaries are capable of abusing, including both built-in binaries and tools such as PSExec, AutoHotKey, and IronPython.(Citation: LOLBAS Main Site)(Citation: Huntress Python Malware 2025)(Citation: The DFIR Report AutoHotKey 2023)(Citation: Splunk Detect Renamed PSExec) It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename <code>rundll32.exe</code>).(Citation: Elastic Masquerade Ball) An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on these utilities executing from non-standard paths.(Citation: F-Secure CozyDuke)
Query: detect Sharepoint
Matching passage: T1213.002 Sharepoint. Tactics: collection. Description: Adversaries may leverage the SharePoint repository as a source to mine valuable information. SharePoint will often contain useful information for an adversary to learn about the structure and functionality of the internal network and systems. For example, the following is a list of example information that may hold potential value to an adversary and may also be found on SharePoint: * Policies, procedures, and standards * Physical / logical network diagrams * System architecture diagrams * Technical system documentation * Testing / development credentials (i.e., [Unsecured Credentials](https://attack.mitre.org/techniques/T1552)) * Work / project schedules * Source code snippets * Links to network shares and other internal resources
Near-miss passage: T1213 Data from Information Repositories. Tactics: collection. Description: Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, such as Credential Access, Lateral Movement, or Defense Evasion, or direct access to the target information. Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization (i.e., [Transfer Data to Cloud Account](https://attack.mitre.org/techniques/T1537)). The following is a brief list of example information that may hold potential value to an adversary and may also be found on an information repository: * Policies, procedures, and standards * Physical / logical network diagrams * System architecture diagrams * Technical system documentation * Testing / development credentials (i.e., [Unsecured Credentials](https://attack.mitre.org/techniques/T1552)) * Work / project schedules * Source code snippets * Links to network shares and other internal resources * Contact or other sensitive information about business partners and customers, including personally identifiable information (PII) Information stored in a repository may vary based on the specific instance or environment. Specific common information repositories include the following: * Storage services such as IaaS databases, enterprise databases, and more specialized platforms such as customer relationship management (CRM) databases * Collaboration platforms such as SharePoint, Confluence, and code repositories * Messaging platforms such as Slack and Microsoft Teams In some cases, information repositories have been improperly secured, typically by unintentionally allowing for overly-broad access by all users or even public access to unauthenticated users. This is particularly common with cloud-native or cloud-hosted services, such as AWS Relat
Query: exploit Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux does not properly restrict discovery of memory add
Matching passage: CVE-2015-3040. CWE: CWE-200. CVSS: 5.0. Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux does not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors, a different vulnerability than CVE-2015-0357.
Near-miss passage: CVE-2015-8095. CWE: CWE-200. CVSS: 5.0. The recycle bin feature in the Monster Menus module 7.x-1.21 before 7.x-1.24 for Drupal does not properly remove nodes from view, which allows remote attackers to obtain sensitive information via an unspecified URL pattern.
Query: incident response steps for Lateral movement indicators for Group Policy Preferences
Matching passage: Playbook for T1552.006 Group Policy Preferences. 1) Validate alert telemetry against T1552.006. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: credential access. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may attempt to find unsecured credentials in Group Policy Preferences (GPP). GPP are tools that allow administrators to create domain policies with embedded credentials. These policies allow administrators to set local accounts.(Citation: Microsoft GPP 2016) These group policies are stored in SYSVOL on a domain controller. This means that any domain user can view the SYSVOL share and d
Near-miss passage: Playbook for T1552.002 Credentials in Registry. Different response path focused on credential access.
Query: describe CVE-2015-8662
Matching passage: CVE-2015-8662. CWE: CWE-119. CVSS: 7.300000190734863. The ff_dwt_decode function in libavcodec/jpeg2000dwt.c in FFmpeg before 2.8.4 does not validate the number of decomposition levels before proceeding with Discrete Wavelet Transform decoding, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG 2000 data.
Near-miss passage: CVE-2015-8472. CWE: CWE-119. CVSS: 7.300000190734863. Buffer overflow in the png_set_PLTE function in libpng before 1.0.65, 1.1.x and 1.2.x before 1.2.55, 1.3.x, 1.4.x before 1.4.18, 1.5.x before 1.5.25, and 1.6.x before 1.6.20 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8126.
Query: patch priority for CVE-2015-5151
Matching passage: CVE-2015-5151. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Slider Revolution (revslider) plugin 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the client_action parameter in a revslider_ajax_action action to wp-admin/admin-ajax.php.
Near-miss passage: CVE-2015-10117. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability, which was classified as problematic, was found in Gravity Forms DPS PxPay Plugin up to 1.4.2 on WordPress. Affected is an unknown function. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.4.3 is able to address this issue. The name of the patch is 5966a5e6343e3d5610bdfa126a5cfbae95e629b6. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230664.
Query: alert when Detects suspicious change of file privileges with chown and chmod commands
Matching passage: Sigma rule: Detects suspicious change of file privileges with chown and chmod commands. Logsource: linux / process_creation. Rule: title: Setuid and Setgid id: c21c4eaa-ba2e-419a-92b2-8371703cbe21 status: test description: Detects suspicious change of file privileges with chown and chmod commands references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.001/T1548.001.md author: Ömer Günal date: 2020-06-16 modified: 2022-10-05 tags: - attack.persistence - attack.privilege-escalation - attack.t1548.001 logsource: product: linux category: process_creation detection: selection_root: CommandLine|contains: chown root selection_perm: CommandLine|contains: - ' chmod u+s' - ' chmod g+s' condition: all of selection_* falsepositives: - Legitimate administration activities level: low
Near-miss passage: Sigma rule: Detects the download of suspicious file type from URLs with IP. Logsource: windows / create_stream_hash. Rule: title: Unusual File Download from Direct IP Address id: 025bd229-fd1f-4fdb-97ab-20006e1a5368 status: test description: Detects the download of suspicious file type from URLs with IP references: - https://github.com/trustedsec/SysmonCommunityGuide/blob/adcdfee20999f422b974c8d4149bf4c361237db7/chapters/file-stream-creation-hash.md - https://labs.withsecure.com/publications/detecting-onenote-abuse author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems) date: 2022-09-07 modified: 2023-02-10 tags: - attack.stealth - attack.t1564.004 logsource: product: windows category: create_stream_hash detection: selection: Contents|re: http[s]?://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3} TargetFilename|contains: - .ps1:Zone - .bat:Zone - .exe:Zone - .vbe:Zone - .vbs:Zone - .dll:Zone - .one:Zone - .cmd:Zone - .hta:Zone - .xll:Zone - .lnk:Zone condition: selection falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-3115
Matching passage: CVE-2015-3115. CWE: CWE-284. CVSS: 5.0. Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2014-0578, CVE-2015-3116, CVE-2015-3125, and CVE-2015-5116.
Near-miss passage: CVE-2015-3672. CWE: CWE-284. CVSS: 7.199999809265137. Admin Framework in Apple OS X before 10.10.4 does not properly handle authentication errors, which allows local users to obtain admin privileges via unspecified vectors.
Query: hunt for Archive Collected Data activity
Matching passage: T1560 Archive Collected Data. Tactics: collection. Description: An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network.(Citation: DOJ GRU Indictment Jul 2018) Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender. Both compression and encryption are done prior to exfiltration, and can be performed using a utility, 3rd party library, or custom method.
Near-miss passage: T1560.003 Archive via Custom Method. Tactics: collection. Description: An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival methods, such as encryption with XOR or stream ciphers implemented with no external library or utility references. Custom implementations of well-known compression algorithms have also been used.(Citation: ESET Sednit Part 2)
Query: risk of WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly perform taint checking for CANVAS ele
Matching passage: CVE-2015-3753. CWE: CWE-200. CVSS: 5.0. WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly perform taint checking for CANVAS elements, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive image data by leveraging a redirect to a data:image resource.
Near-miss passage: CVE-2015-4033. CWE: CWE-200. CVSS: 3.299999952316284. Samsung SBeam allows remote attackers to read arbitrary images by leveraging an NFC connection to access the HTTP server on port 15000.
Query: alert when Detects usage of bitsadmin downloading a file using an URL that contains an IP
Matching passage: Sigma rule: Detects usage of bitsadmin downloading a file using an URL that contains an IP. Logsource: windows / process_creation. Rule: title: Suspicious Download From Direct IP Via Bitsadmin id: 99c840f2-2012-46fd-9141-c761987550ef related: - id: 90f138c1-f578-4ac3-8c49-eecfd847c8b7 type: similar status: test description: Detects usage of bitsadmin downloading a file using an URL that contains an IP references: - https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin - https://isc.sans.edu/diary/22264 - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/ - https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/ author: Florian Roth (Nextron Systems) date: 2022-06-28 modified: 2023-02-15 tags: - attack.persistence - attack.execution - attack.stealth - attack.t1197 - attack.s0190 - attack.t1036.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \bitsadmin.exe - OriginalFileName: bitsadmin.exe selection_flags: CommandLine|contains: - ' /transfer ' - ' /create ' - ' /addfile ' selection_extension: CommandLine|contains: - ://1 - ://2 - ://3 - ://4 - ://5 - ://6 - ://7 - ://8 - ://9 filter_seven_zip: CommandLine|contains: ://7- condition: all of selection_* and not 1 of filter_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_bitsadmin_download_direct_ip/info.yml
Near-miss passage: Sigma rule: Detects the doas tool execution in linux host platform. This utility tool allow standard users to perform tasks as root,. Logsource: linux / process_creation. Rule: title: Linux Doas Tool Execution id: 067d8238-7127-451c-a9ec-fa78045b618b status: stable description: Detects the doas tool execution in linux host platform. This utility tool allow standard users to perform tasks as root, the same way sudo does. references: - https://research.splunk.com/endpoint/linux_doas_tool_execution/ - https://www.makeuseof.com/how-to-install-and-use-doas/ author: Sittikorn S, Teoderick Contreras date: 2022-01-20 tags: - attack.privilege-escalation - attack.t1548 logsource: product: linux category: process_creation detection: selection: Image|endswith: /doas condition: selection falsepositives: - Unlikely level: low
Query: describe CVE-2015-7831
Matching passage: CVE-2015-7831. CWE: CWE-269. CVSS: 8.800000190734863. In Cloudera Hue, there is privilege escalation by a read-only user when CDH 5.x brefore 5.4.9 is used.
Near-miss passage: CVE-2015-4719. CWE: CWE-269. CVSS: 9.800000190734863. The client API authentication mechanism in Pexip Infinity before 10 allows remote attackers to gain privileges via a crafted request.
Query: describe CVE-2015-4298
Matching passage: CVE-2015-4298. CWE: CWE-284. CVSS: 6.5. Cisco Unified Web and E-Mail Interaction Manager 9.0(2) and 11.0(1) improperly performs authorization, which allows remote authenticated users to read or write to stored data via unspecified vectors, aka Bug ID CSCuo89056.
Near-miss passage: CVE-2015-6984. CWE: CWE-284. CVSS: 8.800000190734863. libarchive in Apple OS X before 10.11.1 allows attackers to write to arbitrary files via a crafted app that conducts an unspecified symlink attack.
Query: patch priority for CVE-2015-4198
Matching passage: CVE-2015-4198. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the web framework on Cisco Web Security Appliance (WSA) devices with software 8.5.0-497 allows remote attackers to inject arbitrary web script or HTML via an unspecified HTTP header, aka Bug ID CSCuu24409.
Near-miss passage: CVE-2015-1952. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in IBM AppScan Enterprise Edition 9.0.x before 9.0.2 iFix 001 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 103416.
Query: write Sigma for Detects the use of DefenderCheck, a tool to evaluate the signatures used in Microsoft Defender. It can be used to figure
Matching passage: Sigma rule: Detects the use of DefenderCheck, a tool to evaluate the signatures used in Microsoft Defender. It can be used to figure. Logsource: windows / process_creation. Rule: title: PUA - DefenderCheck Execution id: f0ca6c24-3225-47d5-b1f5-352bf07ecfa7 status: test description: Detects the use of DefenderCheck, a tool to evaluate the signatures used in Microsoft Defender. It can be used to figure out the strings / byte chains used in Microsoft Defender to detect a tool and thus used for AV evasion. references: - https://github.com/matterpreter/DefenderCheck author: Florian Roth (Nextron Systems) date: 2022-08-30 modified: 2023-02-04 tags: - attack.stealth - attack.t1027.005 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \DefenderCheck.exe - Description: DefenderCheck condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: A General detection for the Get-Clipboard commands in PowerShell logs. This could be an adversary capturing clipboard co. Logsource: windows / ps_module. Rule: title: PowerShell Get Clipboard id: 4cbd4f12-2e22-43e3-882f-bff3247ffb78 status: test description: A General detection for the Get-Clipboard commands in PowerShell logs. This could be an adversary capturing clipboard contents. references: - https://github.com/OTRF/detection-hackathon-apt29/issues/16 - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/7.A.2_F4609F7E-C4DB-4327-91D4-59A58C962A02.md author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-05-02 modified: 2023-01-04 tags: - attack.collection - attack.t1115 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection: Payload|contains: Get-Clipboard condition: selection falsepositives: - Unknown level: medium
Query: vulnerability: The V8LazyEventListener::prepareListenerObject function in bindings/core/v8/V8LazyEventListener.cpp in the V8 bindings in Blink, as used in Google Chrome before 41.0.2272.76, does 
Matching passage: CVE-2015-1217. CWE: CWE-17. CVSS: 7.5. The V8LazyEventListener::prepareListenerObject function in bindings/core/v8/V8LazyEventListener.cpp in the V8 bindings in Blink, as used in Google Chrome before 41.0.2272.76, does not properly compile listeners, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion."
Near-miss passage: CVE-2015-7030. CWE: CWE-17. CVSS: 7.5. The Swift implementation in Apple Xcode before 7.1 mishandles type conversion, which has unspecified impact and attack vectors.
Query: patch priority for CVE-2015-5199
Matching passage: CVE-2015-5199. CWE: CWE-22. CVSS: 7.199999809265137. Directory traversal vulnerability in dlopen in libvdpau before 1.1.1 allows local users to gain privileges via the VDPAU_DRIVER environment variable.
Near-miss passage: CVE-2015-1830. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors.