alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit The Swift implementation in Apple Xcode before 7.1 mishandles type conversion, which has unspecified impact and attack vectors.
Matching passage: CVE-2015-7030. CWE: CWE-17. CVSS: 7.5. The Swift implementation in Apple Xcode before 7.1 mishandles type conversion, which has unspecified impact and attack vectors.
Near-miss passage: CVE-2015-1157. CWE: CWE-17. CVSS: 7.800000190734863. CoreText in Apple iOS 8.x through 8.3 allows remote attackers to cause a denial of service (reboot and messaging disruption) via crafted Unicode text that is not properly handled during display truncation in the Notifications feature, as demonstrated by Arabic characters in (1) an SMS message or (2) a WhatsApp message.
Query: patch priority for CVE-2015-5431
Matching passage: CVE-2015-5431. CWE: UNKNOWN. CVSS: 6.5. HP Matrix Operating Environment before 7.5.0 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors.
Near-miss passage: CVE-2015-2600. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in the Siebel Core - Server OM Svcs component in Oracle Siebel CRM 8.1.1, 8.2.2, and 15.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Security.
Query: write Sigma for Detects changes to the "StrongAuthenticationRequirement" value, where the state is set to "0" or "Disabled". Threat acto
Matching passage: Sigma rule: Detects changes to the "StrongAuthenticationRequirement" value, where the state is set to "0" or "Disabled". Threat acto. Logsource: azure / auditlogs. Rule: title: Multi Factor Authentication Disabled For User Account id: b18454c8-0be3-41f7-86bc-9c614611b839 status: test description: 'Detects changes to the "StrongAuthenticationRequirement" value, where the state is set to "0" or "Disabled". Threat actors were seen disabling multi factor authentication for users in order to maintain or achieve access to the account. Also see in SIM Swap attacks. ' references: - https://www.sans.org/blog/defending-against-scattered-spider-and-the-com-with-cybercrime-intelligence/ author: Harjot Singh (@cyb3rjy0t) date: 2024-08-21 tags: - attack.credential-access - attack.persistence logsource: product: azure service: auditlogs definition: 'Requirements: The TargetResources array needs to be mapped accurately in order for this rule to work' detection: selection: LoggedByService: Core Directory Category: UserManagement OperationName: Update user TargetResources.ModifiedProperties.DisplayName: StrongAuthenticationRequirement TargetResources.ModifiedProperties.NewValue|contains: State":0 condition: selection falsepositives: - Legitimate authorized activity. level: medium
Near-miss passage: Sigma rule: Detects the creation or modification of a vscode related powershell profile which could indicate suspicious activity as. Logsource: windows / file_event. Rule: title: VsCode Powershell Profile Modification id: 3a9fa2ec-30bc-4ebd-b49e-7c9cff225502 related: - id: b5b78988-486d-4a80-b991-930eff3ff8bf type: similar status: test description: Detects the creation or modification of a vscode related powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence references: - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_profiles?view=powershell-7.2 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-24 modified: 2023-01-06 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.013 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: \Microsoft.VSCode_profile.ps1 condition: selection falsepositives: - Legitimate use of the profile by developers or administrators level: medium
Query: weakness Missing Standardized Error Handling Mechanism
Matching passage: CWE-544 Missing Standardized Error Handling Mechanism. The product does not use a standardized method for handling errors throughout the code, which might introduce inconsistent error handling and resultant weaknesses.
Near-miss passage: CWE-669 Incorrect Resource Transfer Between Spheres. The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.
Query: exploit Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before
Matching passage: CVE-2015-3116. CWE: CWE-284. CVSS: 5.0. Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2014-0578, CVE-2015-3115, CVE-2015-3125, and CVE-2015-5116.
Near-miss passage: CVE-2015-9152. CWE: CWE-284. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile IPQ4019, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 800, SD 810, SD 820, SD 820A, SD 835, and Snapdragon_High_Med_2016, modem owned regions are accessible from secure side.
Query: vulnerability: The MessageBrokerServlet servlet in Moxa OnCell Central Manager before 2.2 does not require authentication, which allows remote attackers to obtain administrative access via a comm
Matching passage: CVE-2015-6480. CWE: CWE-287. CVSS: 8.300000190734863. The MessageBrokerServlet servlet in Moxa OnCell Central Manager before 2.2 does not require authentication, which allows remote attackers to obtain administrative access via a command, as demonstrated by the addUserAndGroup action.
Near-miss passage: CVE-2015-2033. CWE: CWE-287. CVSS: 10.0. Anyterm Daemon in Infoblox Network Automation NetMRI before NETMRI-23483 allows remote attackers to execute arbitrary commands with root privileges via a crafted terminal/anyterm-module request.
Query: rule covering Detects setting of a new registry value related to BgInfo configuration, which can be abused to execute custom VBScript
Matching passage: Sigma rule: Detects setting of a new registry value related to BgInfo configuration, which can be abused to execute custom VBScript. Logsource: windows / registry_set. Rule: title: New BgInfo.EXE Custom VBScript Registry Configuration id: 992dd79f-dde8-4bb0-9085-6350ba97cfb3 related: - id: cd277474-5c52-4423-a52b-ac2d7969902f type: similar status: test description: Detects setting of a new registry value related to BgInfo configuration, which can be abused to execute custom VBScript via "BgInfo.exe" references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-16 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Software\Winternals\BGInfo\UserFields\ Details|startswith: '4' condition: selection falsepositives: - Legitimate VBScript level: medium
Near-miss passage: Sigma rule: Detects creation of new Kubernetes service account, which could indicate an attacker's attempt to persist within a clust. Logsource: kubernetes / application / audit. Rule: title: New Kubernetes Service Account Created id: e31bae15-83ed-473e-bf31-faf4f8a17d36 related: - id: 12d027c3-b48c-4d9d-8bb6-a732200034b2 type: derived status: test description: 'Detects creation of new Kubernetes service account, which could indicate an attacker''s attempt to persist within a cluster. ' references: - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/container%20service%20account/ author: Leo Tsaousis (@laripping) date: 2024-03-26 tags: - attack.persistence - attack.t1136 logsource: category: application product: kubernetes service: audit detection: selection: verb: create objectRef.resource: serviceaccounts condition: selection falsepositives: - Unknown level: low
Query: alert when Detects the execution of "csvde.exe" in order to export organizational Active Directory structure.
Matching passage: Sigma rule: Detects the execution of "csvde.exe" in order to export organizational Active Directory structure.. Logsource: windows / process_creation. Rule: title: Active Directory Structure Export Via Csvde.EXE id: e5d36acd-acb4-4c6f-a13f-9eb203d50099 status: test description: Detects the execution of "csvde.exe" in order to export organizational Active Directory structure. references: - https://www.cybereason.com/blog/research/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms - https://web.archive.org/web/20180725233601/https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf - https://businessinsights.bitdefender.com/deep-dive-into-a-backdoordiplomacy-attack-a-study-of-an-attackers-toolkit - https://redcanary.com/blog/msix-installers/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-03-14 tags: - attack.exfiltration - attack.discovery - attack.t1087.002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \csvde.exe - OriginalFileName: csvde.exe selection_remote: CommandLine|contains: ' -f' filter_import: CommandLine|contains: ' -i' condition: all of selection_* and not 1 of filter_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects actions taken by Windows Defender malware detection engines. Logsource: windows / windefend. Rule: title: Windows Defender Threat Detected id: 57b649ef-ff42-4fb0-8bf6-62da243a1708 status: stable description: Detects actions taken by Windows Defender malware detection engines references: - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus author: Ján Trenčanský date: 2020-07-28 tags: - attack.execution - attack.t1059 logsource: product: windows service: windefend detection: selection: EventID: - 1006 - 1015 - 1116 - 1117 condition: selection falsepositives: - Unlikely level: high
Query: ATT&CK technique for Hypervisor
Matching passage: T1062 Hypervisor. Tactics: persistence. Description: **This technique has been deprecated and should no longer be used.** A type-1 hypervisor is a software layer that sits between the guest operating systems and system's hardware. (Citation: Wikipedia Hypervisor) It presents a virtual running environment to an operating system. An example of a common hypervisor is Xen. (Citation: Wikipedia Xen) A type-1 hypervisor operates at a level below the operating system and could be designed with [Rootkit](https://attack.mitre.org/techniques/T1014) functionality to hide its existence from the guest operating system. (Citation: Myers 2007) A malicious hypervisor of this nature could be used to persist on systems through interruption.
Near-miss passage: T1505.004 IIS Components. Tactics: persistence. Description: Adversaries may install malicious components that run on Internet Information Services (IIS) web servers to establish persistence. IIS provides several mechanisms to extend the functionality of the web servers. For example, Internet Server Application Programming Interface (ISAPI) extensions and filters can be installed to examine and/or modify incoming and outgoing IIS web requests. Extensions and filters are deployed as DLL files that export three functions: <code>Get{Extension/Filter}Version</code>, <code>Http{Extension/Filter}Proc</code>, and (optionally) <code>Terminate{Extension/Filter}</code>. IIS modules may also be installed to extend IIS web servers.(Citation: Microsoft ISAPI Extension Overview 2017)(Citation: Microsoft ISAPI Filter Overview 2017)(Citation: IIS Backdoor 2011)(Citation: Trustwave IIS Module 2013) Adversaries may install malicious ISAPI extensions and filters to observe and/or modify traffic, execute commands on compromised machines, or proxy command and control traffic. ISAPI extensions and filters may have access to all IIS web requests and responses. For example, an adversary may abuse these mechanisms to modify HTTP responses in order to distribute malicious commands/content to previously comprised hosts.(Citation: Microsoft ISAPI Filter Overview 2017)(Citation: Microsoft ISAPI Extension Overview 2017)(Citation: Microsoft ISAPI Extension All Incoming 2017)(Citation: Dell TG-3390)(Citation: Trustwave IIS Module 2013)(Citation: MMPC ISAPI Filter 2012) Adversaries may also install malicious IIS modules to observe and/or modify traffic. IIS 7.0 introduced modules that provide the same unrestricted access to HTTP requests and responses as ISAPI extensions and filters. IIS modules can be written as a DLL that exports <code>RegisterModule</code>, or as a .NET application that interfaces with ASP.NET APIs to access IIS HTTP requests.(Citation: Microsoft IIS Modules Overview 2007)(Citation: Trustwave IIS Module 2013)(Citation: ESET IIS Malware 20
Query: exploit Cross-site scripting (XSS) vulnerability in the user list table in WordPress before 4.3.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted e-m
Matching passage: CVE-2015-7989. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in the user list table in WordPress before 4.3.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted e-mail address, a different vulnerability than CVE-2015-5714.
Near-miss passage: CVE-2015-4292. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the management interface in Cisco Prime Central for Hosted Collaboration Solution (PC4HCS) 10.6(2) allows remote attackers to inject arbitrary web script or HTML via an unspecified value, aka Bug ID CSCuv45818.
Query: describe CVE-2015-2503
Matching passage: CVE-2015-2503. CWE: CWE-264. CVSS: 9.300000190734863. Microsoft Access 2007 SP3, Excel 2007 SP3, InfoPath 2007 SP3, OneNote 2007 SP3, PowerPoint 2007 SP3, Project 2007 SP3, Publisher 2007 SP3, Visio 2007 SP3, Word 2007 SP3, Office 2007 IME (Japanese) SP3, Access 2010 SP2, Excel 2010 SP2, InfoPath 2010 SP2, OneNote 2010 SP2, PowerPoint 2010 SP2, Project 2010 SP2, Publisher 2010 SP2, Visio 2010 SP2, Word 2010 SP2, Pinyin IME 2010, Access 2013 SP1, Excel 2013 SP1, InfoPath 2013 SP1, OneNote 2013 SP1, PowerPoint 2013 SP1, Project 2013 SP1, Publisher 2013 SP1, Visio 2013 SP1, Word 2013 SP1, Excel 2013 RT SP1, OneNote 2013 RT SP1, PowerPoint 2013 RT SP1, Word 2013 RT SP1, Access 2016, Excel 2016, OneNote 2016, PowerPoint 2016, Project 2016, Publisher 2016, Visio 2016, Word 2016, Skype for Business 2016, and Lync 2013 SP1 allow remote attackers to bypass a sandbox protection mechanism and gain privileges via a crafted web site that is accessed with Internet Explorer, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "Microsoft Office Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-5252. CWE: CWE-264. CVSS: 7.199999809265137. vfs.c in smbd in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, when share names with certain substring relationships exist, allows remote attackers to bypass intended file-access restrictions via a symlink that points outside of a share.
Query: Lateral movement indicators for Safe Mode Boot
Matching passage: T1688 Safe Mode Boot. Tactics: defense impairment. Description: Adversaries may abuse Windows safe mode to disable endpoint defenses. Safe mode starts up the Windows operating system with a limited set of drivers and services. Third-party security software such as endpoint detection and response (EDR) tools may not start after booting Windows in safe mode. There are two versions of safe mode: Safe Mode and Safe Mode with Networking. It is possible to start additional services after a safe mode boot.(Citation: Microsoft Windows Startup Settings)(Citation: Sophos Safe Mode Boot) Adversaries may abuse safe mode to disable endpoint defenses that may not start with a limited boot. Hosts can be forced into safe mode after the next reboot via modifications to Boot Configuration Data (BCD) stores, which are files that manage boot application settings.(Citation: Microsoft bcdedit) Adversaries may also add their malicious applications to the list of minimal services that start in safe mode by modifying relevant Registry values (i.e. [Modify Registry](https://attack.mitre.org/techniques/T1112)). Malicious [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) objects may also be registered and loaded in safe mode.(Citation: CyberArk Labs Safe Mode 2016)(Citation: Cybereason safe mode boot)(Citation: BleepingComputer REvil 2021)
Near-miss passage: T1578.005 Modify Cloud Compute Configurations. Tactics: defense impairment. Description: Adversaries may modify settings that directly affect the size, locations, and resources available to cloud compute infrastructure in order to evade defenses. These settings may include service quotas, subscription associations, tenant-wide policies, or other configurations that impact available compute. Such modifications may allow adversaries to abuse the victim’s compute resources to achieve their goals, potentially without affecting the execution of running instances and/or revealing their activities to the victim. For example, cloud providers often limit customer usage of compute resources via quotas. Customers may request adjustments to these quotas to support increased computing needs, though these adjustments may require approval from the cloud provider. Adversaries who compromise a cloud environment may similarly request quota adjustments in order to support their activities, such as enabling additional [Resource Hijacking](https://attack.mitre.org/techniques/T1496) without raising suspicion by using up a victim’s entire quota.(Citation: Microsoft Cryptojacking 2023) Adversaries may also increase allowed resource usage by modifying any tenant-wide policies that limit the sizes of deployed virtual machines.(Citation: Microsoft Azure Policy) Adversaries may also modify settings that affect where cloud resources can be deployed, such as enabling [Unused/Unsupported Cloud Regions](https://attack.mitre.org/techniques/T1535).
Query: CVE similar to CVE-2015-7835
Matching passage: CVE-2015-7835. CWE: CWE-20. CVSS: 7.199999809265137. The mod_l2_entry function in arch/x86/mm.c in Xen 3.4 through 4.6.x does not properly validate level 2 page table entries, which allows local PV guest administrators to gain privileges via a crafted superpage mapping.
Near-miss passage: CVE-2015-5765. CWE: CWE-20. CVSS: 4.300000190734863. The user interface in Safari in Apple iOS before 9 allows remote attackers to spoof URLs via unspecified vectors, a different vulnerability than CVE-2015-5764 and CVE-2015-5767.
Query: Multiple failed authentications followed by Scheduled Transfer
Matching passage: T1029 Scheduled Transfer. Tactics: exfiltration. Description: Adversaries may schedule data exfiltration to be performed only at certain times of day or at certain intervals. This could be done to blend traffic patterns with normal activity or availability. When scheduled exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as [Exfiltration Over C2 Channel](https://attack.mitre.org/techniques/T1041) or [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048).
Near-miss passage: T1041 Exfiltration Over C2 Channel. Tactics: exfiltration. Description: Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.
Query: CVE similar to CVE-2015-8984
Matching passage: CVE-2015-8984. CWE: CWE-125. CVSS: 5.900000095367432. The fnmatch function in the GNU C Library (aka glibc or libc6) before 2.22 might allow context-dependent attackers to cause a denial of service (application crash) via a malformed pattern, which triggers an out-of-bounds read.
Near-miss passage: CVE-2015-8925. CWE: CWE-125. CVSS: 5.5. The readline function in archive_read_support_format_mtree.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (invalid read) via a crafted mtree file, related to newline parsing.
Query: vulnerability: Unquoted Windows search path vulnerability in the Smart Maximize Helper (nvSmartMaxApp.exe) in the Control Panel in the NVIDIA GPU graphics driver R340 before 341.92, R352 before 3
Matching passage: CVE-2015-7866. CWE: UNKNOWN. CVSS: 7.199999809265137. Unquoted Windows search path vulnerability in the Smart Maximize Helper (nvSmartMaxApp.exe) in the Control Panel in the NVIDIA GPU graphics driver R340 before 341.92, R352 before 354.35, and R358 before 358.87 on Windows allows local users to gain privileges via a Trojan horse application, as demonstrated by C:\Program.exe.
Near-miss passage: CVE-2015-2111. CWE: UNKNOWN. CVSS: 2.0999999046325684. Unspecified vulnerability in HP Intelligent Provisioning 1.40 through 1.60 on Windows Server 2008 R2 and 2012 allows local users to obtain sensitive information via unknown vectors.
Query: Sigma YAML for azure / riskdetection
Matching passage: Sigma rule: Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also. Logsource: azure / riskdetection. Rule: title: Atypical Travel id: 1a41023f-1e70-4026-921a-4d9341a9038e status: test description: Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior. references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#atypical-travel - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-03 tags: - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation - attack.initial-access logsource: product: azure service: riskdetection detection: selection: riskEventType: unlikelyTravel condition: selection falsepositives: - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user. level: high
Near-miss passage: Sigma rule: Detects attempts to install unsigned MSIX/AppX packages using the -AllowUnsigned parameter via AppXDeployment-Server eve. Logsource: windows / appxdeployment-server. Rule: title: Windows AppX Deployment Unsigned Package Installation id: 9a025188-6f2d-42f8-bb2f-d3a83d24a5af related: - id: 37651c2a-42cd-4a69-ae0d-22a4349aa04a type: similar - id: 975b2262-9a49-439d-92a6-0709cccdf0b2 type: similar status: experimental description: Detects attempts to install unsigned MSIX/AppX packages using the -AllowUnsigned parameter via AppXDeployment-Server events references: - https://docs.microsoft.com/en-us/powershell/module/appx/add-appxpackage - https://www.splunk.com/en_us/blog/security/msix-weaponization-threat-detection-splunk.html author: Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-03 tags: - attack.execution - attack.defense-impairment - attack.t1204.002 - attack.t1553.005 logsource: product: windows service: appxdeployment-server detection: selection: EventID: 603 Flags: '8388608' condition: selection falsepositives: - Legitimate installation of unsigned packages for legitimate purposes such as development or testing level: medium