alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Outbound C2 pattern associated with XPC Services
Matching passage: T1559.003 XPC Services. Tactics: execution. Description: Adversaries can provide malicious content to an XPC service daemon for local code execution. macOS uses XPC services for basic inter-process communication between various processes, such as between the XPC Service daemon and third-party application privileged helper tools. Applications can send messages to the XPC Service daemon, which runs as root, using the low-level XPC Service <code>C API</code> or the high level <code>NSXPCConnection API</code> in order to handle tasks that require elevated privileges (such as network connections). Applications are responsible for providing the protocol definition which serves as a blueprint of the XPC services. Developers typically use XPC Services to provide applications stability and privilege separation between the application client and the daemon.(Citation: creatingXPCservices)(Citation: Designing Daemons Apple Dev) Adversaries can abuse XPC services to execute malicious content. Requests for malicious execution can be passed through the application's XPC Services handler.(Citation: CVMServer Vuln)(Citation: Learn XPC Exploitation) This may also include identifying and abusing improper XPC client validation and/or poor sanitization of input parameters to conduct [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068).
Near-miss passage: T1559 Inter-Process Communication. Tactics: execution. Description: Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. IPC is typically used by processes to share data, communicate with each other, or synchronize execution. IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern. Adversaries may abuse IPC to execute arbitrary code or commands. IPC mechanisms may differ depending on OS, but typically exists in a form accessible through programming languages/libraries or native interfaces such as Windows [Dynamic Data Exchange](https://attack.mitre.org/techniques/T1559/002) or [Component Object Model](https://attack.mitre.org/techniques/T1559/001). Linux environments support several different IPC mechanisms, two of which being sockets and pipes.(Citation: Linux IPC) Higher level execution mediums, such as those of [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)s, may also leverage underlying IPC mechanisms. Adversaries may also use [Remote Services](https://attack.mitre.org/techniques/T1021) such as [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) to facilitate remote IPC execution.(Citation: Fireeye Hunting COM June 2019)
Query: common weakness: Improper Neutralization of Multiple Internal Special Elements
Matching passage: CWE-165 Improper Neutralization of Multiple Internal Special Elements. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes multiple internal special elements that could be interpreted in unexpected ways when they are sent to a downstream component.
Near-miss passage: CWE-214 Invocation of Process Using Visible Sensitive Information. A process is invoked with sensitive command-line arguments, environment variables, or other elements that can be seen by other processes on the operating system.
Query: risk of A vulnerability was found in arnoldle submitByMailPlugin 1.0b2.9 and classified as problematic. This issue affects some unknown processing of the file edit_list.php. The manipulati
Matching passage: CVE-2015-10081. CWE: CWE-352. CVSS: 8.800000190734863. A vulnerability was found in arnoldle submitByMailPlugin 1.0b2.9 and classified as problematic. This issue affects some unknown processing of the file edit_list.php. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.0b2.9a is able to address this issue. The patch is named a739f680a1623d22f52ff1371e86ca472e63756f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-221495.
Near-miss passage: CVE-2015-7446. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in IBM Flash System V9000 7.4 before 7.4.1.4, 7.5 before 7.5.1.3, and 7.6 before 7.6.0.4 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Query: vulnerability: The MQXR service in WMQ Telemetry in IBM WebSphere MQ 7.1 before 7.1.0.7, 7.5 through 7.5.0.5, and 8.0 before 8.0.0.4 uses world-readable permissions for a cleartext file containin
Matching passage: CVE-2015-2012. CWE: CWE-200. CVSS: 4.0. The MQXR service in WMQ Telemetry in IBM WebSphere MQ 7.1 before 7.1.0.7, 7.5 through 7.5.0.5, and 8.0 before 8.0.0.4 uses world-readable permissions for a cleartext file containing the SSL keystore password, which allows local users to obtain sensitive information by reading this file.
Near-miss passage: CVE-2015-8669. CWE: CWE-200. CVSS: 5.300000190734863. libraries/config/messages.inc.php in phpMyAdmin 4.0.x before 4.0.10.12, 4.4.x before 4.4.15.2, and 4.5.x before 4.5.3.1 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message.
Query: patch priority for CVE-2015-1385
Matching passage: CVE-2015-1385. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Blubrry PowerPress Podcasting plugin before 6.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cat parameter in a powerpress-editcategoryfeed action in the powerpressadmin_categoryfeeds.php page to wp-admin/admin.php.
Near-miss passage: CVE-2015-0344. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the web app in Adobe Connect before 9.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: detection rule: Detects the enumeration of other remote systems.
Matching passage: Sigma rule: Detects the enumeration of other remote systems.. Logsource: macos / process_creation. Rule: title: Macos Remote System Discovery id: 10227522-8429-47e6-a301-f2b2d014e7ad status: test description: Detects the enumeration of other remote systems. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md author: Alejandro Ortuno, oscd.community date: 2020-10-22 modified: 2021-11-27 tags: - attack.discovery - attack.t1018 logsource: category: process_creation product: macos detection: selection_1: Image|endswith: /arp CommandLine|contains: -a selection_2: Image|endswith: /ping CommandLine|contains: - ' 10.' - ' 192.168.' - ' 172.16.' - ' 172.17.' - ' 172.18.' - ' 172.19.' - ' 172.20.' - ' 172.21.' - ' 172.22.' - ' 172.23.' - ' 172.24.' - ' 172.25.' - ' 172.26.' - ' 172.27.' - ' 172.28.' - ' 172.29.' - ' 172.30.' - ' 172.31.' - ' 127.' - ' 169.254.' condition: 1 of selection* falsepositives: - Legitimate administration activities level: informational
Near-miss passage: Sigma rule: This rule will collect the data needed to start looking into possible kerberoasting activity. Further analysis or comput. Logsource: windows / security. Rule: title: Kerberoasting Activity - Initial Query id: d04ae2b8-ad54-4de0-bd87-4bc1da66aa59 status: test description: 'This rule will collect the data needed to start looking into possible kerberoasting activity. Further analysis or computation within the query is needed focusing on requests from one specific host/IP towards multiple service names within a time period of 5 seconds. You can then set a threshold for the number of requests and time between the requests to turn this into an alert. ' references: - https://www.trustedsec.com/blog/art_of_kerberoast/ - https://adsecurity.org/?p=3513 author: '@kostastsale' date: 2022-01-21 modified: 2025-10-19 tags: - attack.credential-access - attack.t1558.003 logsource: product: windows service: security detection: selection: EventID: 4769 Status: '0x0' TicketEncryptionType: '0x17' filter_main_krbtgt: ServiceName|endswith: - krbtgt - $ filter_main_machine_accounts: TargetUserName|contains: $@ condition: selection and not 1 of filter_main_* falsepositives: - Legacy applications. level: medium
Query: patch priority for CVE-2015-2792
Matching passage: CVE-2015-2792. CWE: CWE-284. CVSS: 7.5. The WPML plugin before 3.1.9 for WordPress does not properly handle multiple actions in a request, which allows remote attackers to bypass nonce checks and perform arbitrary actions via a request containing an action POST parameter, an action GET parameter, and a valid nonce for the action GET parameter.
Near-miss passage: CVE-2015-8307. CWE: CWE-284. CVSS: 7.800000190734863. The Graphics driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230, and Mate S smartphones with software CRR-TL00 before CRR-TL00C01B160SP01, CRR-UL00 before CRR-UL00C00B160, and CRR-CL00 before CRR-CL00C92B161 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application with the graphics permission, aka an "interface access control vulnerability," a different vulnerability than CVE-2015-8680.
Query: describe CVE-2015-2388
Matching passage: CVE-2015-2388. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1738.
Near-miss passage: CVE-2015-5225. CWE: CWE-119. CVSS: 7.199999809265137. Buffer overflow in the vnc_refresh_server_surface function in the VNC display driver in QEMU before 2.4.0.1 allows guest users to cause a denial of service (heap memory corruption and process crash) or possibly execute arbitrary code on the host via unspecified vectors, related to refreshing the server display surface.
Query: exploit SQL injection vulnerability in the Group Promotions module in the admin control panel in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System befor
Matching passage: CVE-2015-8974. CWE: CWE-89. CVSS: 10.0. SQL injection vulnerability in the Group Promotions module in the admin control panel in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-9454. CWE: CWE-89. CVSS: 8.800000190734863. The smooth-slider plugin before 2.7 for WordPress has SQL Injection via the wp-admin/admin.php?page=smooth-slider-admin current_slider_id parameter.
Query: CVE similar to CVE-2015-6354
Matching passage: CVE-2015-6354. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in Cisco FireSight Management Center (MC) 5.4.1.3 and 6.0 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuv73338.
Near-miss passage: CVE-2015-7385. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Open-Xchange OX Guard before 2.0.0-rev11 allows remote attackers to inject arbitrary web script or HTML via the uid field in a PGP public key, which is not properly handled in "Guard PGP Settings."
Query: risk of Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote authenticated users to affect availability via unknown vectors related to
Matching passage: CVE-2015-0441. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Encryption.
Near-miss passage: CVE-2015-0511. CWE: UNKNOWN. CVSS: 2.799999952316284. Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : SP.
Query: explain CWE-285
Matching passage: CWE-285 Improper Authorization. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Near-miss passage: CWE-804 Guessable CAPTCHA. The product uses a CAPTCHA challenge, but the challenge can be guessed or automatically recognized by a non-human actor.
Query: vulnerability: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via unk
Matching passage: CVE-2015-4843. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.
Near-miss passage: CVE-2015-7638. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7636, CVE-2015-7637, CVE-2015-7639, CVE-2015-7640, CVE-2015-7641, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644.
Query: risk of The IP ingress packet handler on Cisco Aironet 1800 devices with software 8.1(112.3) and 8.1(112.4) allows remote attackers to cause a denial of service via a crafted header in an 
Matching passage: CVE-2015-6320. CWE: CWE-399. CVSS: 7.5. The IP ingress packet handler on Cisco Aironet 1800 devices with software 8.1(112.3) and 8.1(112.4) allows remote attackers to cause a denial of service via a crafted header in an IP packet, aka Bug ID CSCuv63138.
Near-miss passage: CVE-2015-0248. CWE: CWE-399. CVSS: 5.0. The (1) mod_dav_svn and (2) svnserve servers in Subversion 1.6.0 through 1.7.19 and 1.8.0 through 1.8.11 allow remote attackers to cause a denial of service (assertion failure and abort) via crafted parameter combinations related to dynamically evaluated revision numbers.
Query: exploit Microsoft Internet Explorer 7 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site
Matching passage: CVE-2015-6154. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 7 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6150.
Near-miss passage: CVE-2015-7010. CWE: CWE-119. CVSS: 6.800000190734863. FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976, CVE-2015-6977, CVE-2015-6978, CVE-2015-6990, CVE-2015-6991, CVE-2015-6993, CVE-2015-7008, CVE-2015-7009, and CVE-2015-7018.
Query: CVE similar to CVE-2015-6780
Matching passage: CVE-2015-6780. CWE: UNKNOWN. CVSS: 6.800000190734863. Use-after-free vulnerability in the Infobars implementation in Google Chrome before 47.0.2526.73 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted web site, related to browser/ui/views/website_settings/website_settings_popup_view.cc.
Near-miss passage: CVE-2015-0405. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.6.22 and earlier allows remote authenticated users to affect availability via unknown vectors related to XA.
Query: exploit The Firewall component in Apple OS X Server before 4.1 uses an incorrect pathname in configuration files, which allows remote attackers to bypass network-access restrictions by sen
Matching passage: CVE-2015-1150. CWE: CWE-17. CVSS: 5.0. The Firewall component in Apple OS X Server before 4.1 uses an incorrect pathname in configuration files, which allows remote attackers to bypass network-access restrictions by sending packets for which custom-rule blocking was intended.
Near-miss passage: CVE-2015-1841. CWE: CWE-17. CVSS: 3.700000047683716. The Web Admin interface in Red Hat Enterprise Virtualization Manager (RHEV-M) allows local users to bypass the timeout function by selecting a VM in the VM grid view.
Query: describe CVE-2015-2807
Matching passage: CVE-2015-2807. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in js/window.php in the Navis DocumentCloud plugin before 0.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter.
Near-miss passage: CVE-2015-0168. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Query: Sigma YAML for windows / registry_set
Matching passage: Sigma rule: Detects the abuse of the exefile handler in new file association. Used for bypass of security products.. Logsource: windows / registry_set. Rule: title: New File Association Using Exefile id: 44a22d59-b175-4f13-8c16-cbaef5b581ff status: test description: Detects the abuse of the exefile handler in new file association. Used for bypass of security products. references: - https://twitter.com/mrd0x/status/1461041276514623491 author: Andreas Hunkeler (@Karneades) date: 2021-11-19 modified: 2023-08-17 tags: - attack.stealth logsource: category: registry_set product: windows detection: selection: TargetObject|contains: Classes\. Details: exefile condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects modifications to the "Hidden" and "ShowSuperHidden" explorer registry values in order to disable showing of hidd. Logsource: windows / registry_set. Rule: title: Displaying Hidden Files Feature Disabled id: 5a5152f1-463f-436b-b2f5-8eceb3964b42 status: test description: 'Detects modifications to the "Hidden" and "ShowSuperHidden" explorer registry values in order to disable showing of hidden files and system files. This technique is abused by several malware families to hide their files from normal users. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.001/T1564.001.md#atomic-test-8---hide-files-through-registry author: frack113 date: 2022-04-02 modified: 2024-03-26 tags: - attack.stealth - attack.t1564.001 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: - \Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden - \Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden Details: DWORD (0x00000000) condition: selection falsepositives: - Unknown level: medium
Query: detection rule: Detection well-known mimikatz command line arguments
Matching passage: Sigma rule: Detection well-known mimikatz command line arguments. Logsource: windows / process_creation. Rule: title: HackTool - Mimikatz Execution id: a642964e-bead-4bed-8910-1bb4d63e3b4d status: test description: Detection well-known mimikatz command line arguments references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment - https://tools.thehacker.recipes/mimikatz/modules author: Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton date: 2019-10-22 modified: 2023-02-21 tags: - attack.credential-access - attack.t1003.001 - attack.t1003.002 - attack.t1003.004 - attack.t1003.005 - attack.t1003.006 logsource: category: process_creation product: windows detection: selection_tools_name: CommandLine|contains: - DumpCreds - mimikatz selection_function_names: CommandLine|contains: - ::aadcookie - ::detours - ::memssp - ::mflt - ::ncroutemon - ::ngcsign - ::printnightmare - ::skeleton - ::preshutdown - ::mstsc - ::multirdp selection_module_names: CommandLine|contains: - 'rpc::' - 'token::' - 'crypto::' - 'dpapi::' - 'sekurlsa::' - 'kerberos::' - 'lsadump::' - 'privilege::' - 'process::' - 'vault::' condition: 1 of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects non-system users performing privileged operation os the SCM database. Logsource: windows / security. Rule: title: SCM Database Privileged Operation id: dae8171c-5ec6-4396-b210-8466585b53e9 status: test description: Detects non-system users performing privileged operation os the SCM database references: - https://threathunterplaybook.com/hunts/windows/190826-RemoteSCMHandle/notebook.html author: Roberto Rodriguez @Cyb3rWard0g, Tim Shelton date: 2019-08-15 modified: 2022-09-18 tags: - attack.privilege-escalation - attack.t1548 logsource: product: windows service: security detection: selection: EventID: 4674 ObjectType: SC_MANAGER OBJECT ObjectName: servicesactive PrivilegeList: SeTakeOwnershipPrivilege filter: SubjectLogonId: '0x3e4' ProcessName|endswith: :\Windows\System32\services.exe condition: selection and not filter falsepositives: - Unknown level: medium
Query: exploit Zimbra Collaboration before 8.6.0 patch5 has XSS.
Matching passage: CVE-2015-2249. CWE: CWE-79. CVSS: 5.400000095367432. Zimbra Collaboration before 8.6.0 patch5 has XSS.
Near-miss passage: CVE-2015-3386. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Node Access Product module for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a node title.
Query: secure coding against Improper Authorization
Matching passage: CWE-285 Improper Authorization. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Near-miss passage: CWE-358 Improperly Implemented Security Check for Standard. The product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique.
Query: describe CVE-2015-3709
Matching passage: CVE-2015-3709. CWE: CWE-362. CVSS: 6.900000095367432. Race condition in kext tools in Apple OS X before 10.10.4 allows local users to bypass intended signature requirements for kernel extensions by leveraging improper pathname validation.
Near-miss passage: CVE-2015-1200. CWE: CWE-362. CVSS: 2.0999999046325684. Race condition in pxz 4.999.99 Beta 3 uses weak file permissions for the output file when compressing a file before changing the permission to match the original file, which allows local users to bypass the intended access restrictions.
Query: patch priority for CVE-2015-7602
Matching passage: CVE-2015-7602. CWE: CWE-22. CVSS: 7.800000190734863. Directory traversal vulnerability in BisonWare BisonFTP 3.5 allows remote attackers to read arbitrary files via a ../ (dot dot slash) in a RETR command.
Near-miss passage: CVE-2015-5322. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to list directory contents and read arbitrary files in the Jenkins servlet resources via directory traversal sequences in a request to jnlpJars/.