alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: CVE similar to CVE-2015-8113
Matching passage: CVE-2015-8113. CWE: UNKNOWN. CVSS: 7.199999809265137. Untrusted search path vulnerability in the client in Symantec Endpoint Protection (SEP) 12.1 before 12.1-RU6-MP3 allows local users to gain privileges via a Trojan horse DLL in a client install package. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1492.
Near-miss passage: CVE-2015-8401. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the execution of the builtin "copy" command that targets a shadow copy (sometimes used to copy registry hives th. Logsource: windows / process_creation. Rule: title: Copy From VolumeShadowCopy Via Cmd.EXE id: c73124a7-3e89-44a3-bdc1-25fe4df754b1 status: test description: Detects the execution of the builtin "copy" command that targets a shadow copy (sometimes used to copy registry hives that are in use) references: - https://twitter.com/vxunderground/status/1423336151860002816?s=20 - https://www.virustotal.com/gui/file/03e9b8c2e86d6db450e5eceec057d7e369ee2389b9daecaf06331a95410aa5f8/detection - https://pentestlab.blog/2018/07/04/dumping-domain-password-hashes/ author: Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems) date: 2021-08-09 modified: 2023-03-07 tags: - attack.impact - attack.t1490 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - 'copy ' - \\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy condition: selection falsepositives: - Backup scenarios using the commandline level: high
Near-miss passage: Sigma rule: Detects a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to loca. Logsource: windows / security. Rule: title: Potential Privilege Escalation via Local Kerberos Relay over LDAP id: 749c9f5e-b353-4b90-a9c1-05243357ca4b status: test description: 'Detects a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to localhost, and the target user SID is the built-in local Administrator account. This may indicate an attempt to leverage a Kerberos relay attack variant that can be used to elevate privilege locally from a domain joined limited user to local System privileges. ' references: - https://twitter.com/sbousseaden/status/1518976397364056071?s=12&t=qKO5eKHvWhAP19a50FTZ7g - https://github.com/elastic/detection-rules/blob/5fe7833312031a4787e07893e27e4ea7a7665745/rules/_deprecated/privilege_escalation_krbrelayup_suspicious_logon.toml#L38 author: Elastic, @SBousseaden date: 2022-04-27 modified: 2024-08-13 tags: - attack.privilege-escalation - attack.credential-access - attack.t1548 logsource: product: windows service: security detection: selection: EventID: 4624 LogonType: 3 AuthenticationPackageName: Kerberos IpAddress: 127.0.0.1 TargetUserSid|startswith: S-1-5-21- TargetUserSid|endswith: '-500' filter_main_ip_null: IpPort: '0' condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-0916
Matching passage: CVE-2015-0916. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in graph.php in Cacti before 0.8.6f allows remote authenticated users to execute arbitrary SQL commands via the local_graph_id parameter, a different vulnerability than CVE-2007-6035.
Near-miss passage: CVE-2015-10122. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability was found in wp-donate Plugin up to 1.4 on WordPress. It has been classified as critical. This affects an unknown part of the file includes/donate-display.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. Upgrading to version 1.5 is able to address this issue. The identifier of the patch is 019114cb788d954c5d1b36d6c62418619e93a757. It is recommended to upgrade the affected component. The identifier VDB-234249 was assigned to this vulnerability.
Query: describe CVE-2015-2655
Matching passage: CVE-2015-2655. CWE: UNKNOWN. CVSS: 5.5. Unspecified vulnerability in the Application Express component in Oracle Database Server before 4.2.3.00.08 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
Near-miss passage: CVE-2015-7042. CWE: UNKNOWN. CVSS: 4.300000190734863. The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to cause a denial of service via a crafted app, a different vulnerability than CVE-2015-7040, CVE-2015-7041, and CVE-2015-7043.
Query: describe CVE-2015-6688
Matching passage: CVE-2015-6688. CWE: CWE-416. CVSS: 6.800000190734863. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via a crafted Optional Content Groups (OCG) object in a WillSave document action, a different vulnerability than CVE-2015-5586, CVE-2015-6683, CVE-2015-6684, CVE-2015-6687, CVE-2015-6689, CVE-2015-6690, CVE-2015-6691, CVE-2015-7615, CVE-2015-7617, and CVE-2015-7621.
Near-miss passage: CVE-2015-6690. CWE: CWE-416. CVSS: 6.800000190734863. Use-after-free vulnerability in the popUpMenuEx method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via crafted arguments, a different vulnerability than CVE-2015-5586, CVE-2015-6683, CVE-2015-6684, CVE-2015-6687, CVE-2015-6688, CVE-2015-6689, CVE-2015-6691, CVE-2015-7615, CVE-2015-7617, and CVE-2015-7621.
Query: describe CVE-2015-0896
Matching passage: CVE-2015-0896. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in eXtplorer before 2.1.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-6518. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in phpLiteAdmin 1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO, (2) droptable parameter, or (3) table parameter to phpliteadmin.php.
Query: discovery using System Information Discovery
Matching passage: T1082 System Information Discovery. Tactics: discovery. Description: An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from [Local Storage Discovery](https://attack.mitre.org/techniques/T1680) which is an adversary's discovery of local drive, disks and/or volumes. Tools such as [Systeminfo](https://attack.mitre.org/software/S0096) can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the <code>systemsetup</code> configuration tool on macOS. Adversaries may leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather detailed system information (e.g. <code>show version</code>).(Citation: US-CERT-TA18-106A) On ESXi servers, threat actors may gather system information from various esxcli utilities, such as `system hostname get` and `system version get`.(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)(Citation: Varonis) Infrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine.(Citation: Amazon Describe Instance)(Citation: Google Instances Resource)(Citation: Microsoft Virutal Machine API) [System Information Discovery](https://attack.mitre.org/techniques/T1082) combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.(Citation: OSX.FairyTale)(Citation: 20 macOS Common Tools and Techniques)
Near-miss passage: T1069.002 Domain Groups. Tactics: discovery. Description: Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators. Commands such as <code>net group /domain</code> of the [Net](https://attack.mitre.org/software/S0039) utility, <code>dscacheutil -q group</code> on macOS, and <code>ldapsearch</code> on Linux can list domain-level groups.
Query: CVE similar to CVE-2015-5378
Matching passage: CVE-2015-5378. CWE: CWE-200. CVSS: 7.5. Logstash 1.5.x before 1.5.3 and 1.4.x before 1.4.4 allows remote attackers to read communications between Logstash Forwarder agent and Logstash server.
Near-miss passage: CVE-2015-7511. CWE: CWE-200. CVSS: 2.0. Libgcrypt before 1.6.5 does not properly perform elliptic-point curve multiplication during decryption, which makes it easier for physically proximate attackers to extract ECDH keys by measuring electromagnetic emanations.
Query: indicators of Browser Fingerprint
Matching passage: T1036.012 Browser Fingerprint. Tactics: stealth. Description: Adversaries may attempt to blend in with legitimate traffic by spoofing browser and system attributes like operating system, system language, platform, user-agent string, resolution, time zone, etc. The HTTP User-Agent request header is a string that lets servers and network peers identify the application, operating system, vendor, and/or version of the requesting user agent.(Citation: Mozilla User Agent) Adversaries may gather this information through [System Information Discovery](https://attack.mitre.org/techniques/T1082) or by users navigating to adversary-controlled websites, and then use that information to craft their web traffic to evade defenses.(Citation: Gummy Browsers Targeted Browser Spoofing against State-of-the-Art Fingerprinting Techniques)
Near-miss passage: T1036.011 Overwrite Process Arguments. Tactics: stealth. Description: Adversaries may modify a process's in-memory arguments to change its name in order to appear as a legitimate or benign process. On Linux, the operating system stores command-line arguments in the process’s stack and passes them to the `main()` function as the `argv` array. The first element, `argv[0]`, typically contains the process name or path - by default, the command used to actually start the process (e.g., `cat /etc/passwd`). By default, the Linux `/proc` filesystem uses this value to represent the process name. The `/proc/<PID>/cmdline` file reflects the contents of this memory, and tools like `ps` use it to display process information. Since arguments are stored in user-space memory at launch, this modification can be performed without elevated privileges. During runtime, adversaries can erase the memory used by all command-line arguments for a process, overwriting each argument string with null bytes. This removes evidence of how the process was originally launched. They can then write a spoofed string into the memory region previously occupied by `argv[0]` to mimic a benign command, such as `cat resolv.conf`. The new command-line string is reflected in `/proc/<PID>/cmdline` and displayed by tools like `ps`.(Citation: Sandfly BPFDoor 2022)(Citation: Microsoft XorDdos Linux Stealth 2022)
Query: detect Detects usage of the `mknod` syscall to create special files (e.g., character or block devices). Attackers or malware mi in logs
Matching passage: Sigma rule: Detects usage of the `mknod` syscall to create special files (e.g., character or block devices). Attackers or malware mi. Logsource: linux / auditd. Rule: title: Special File Creation via Mknod Syscall id: 710bdbce-495d-491d-9a8f-7d0d88d2b41e status: experimental description: 'Detects usage of the `mknod` syscall to create special files (e.g., character or block devices). Attackers or malware might use `mknod` to create fake devices, interact with kernel interfaces, or establish covert channels in Linux systems. Monitoring the use of `mknod` is important because this syscall is rarely used by legitimate applications, and it can be abused to bypass file system restrictions or create backdoors. ' references: - https://man7.org/linux/man-pages/man2/mknod.2.html - https://hopeness.medium.com/master-the-linux-mknod-command-a-comprehensive-guide-1c150a546aa8 author: Milad Cheraghi date: 2025-05-31 modified: 2025-12-05 tags: - attack.privilege-escalation - attack.persistence - attack.t1543.003 logsource: product: linux service: auditd detection: selection: type: SYSCALL SYSCALL: mknod condition: selection falsepositives: - Device creation by legitimate scripts or init systems (udevadm, MAKEDEV) - Container runtimes or security tools during initialization level: low
Near-miss passage: Sigma rule: Detects when an a role is modified or deleted in Google Workspace.. Logsource: gcp / google_workspace.admin. Rule: title: Google Workspace Role Modified or Deleted id: 6aef64e3-60c6-4782-8db3-8448759c714e status: test description: Detects when an a role is modified or deleted in Google Workspace. references: - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3 - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-delegated-admin-settings author: Austin Songer date: 2021-08-24 modified: 2023-10-11 tags: - attack.impact logsource: product: gcp service: google_workspace.admin detection: selection: eventService: admin.googleapis.com eventName: - DELETE_ROLE - RENAME_ROLE - UPDATE_ROLE condition: selection falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-9315
Matching passage: CVE-2015-9315. CWE: CWE-89. CVSS: 9.800000190734863. The newstatpress plugin before 1.0.1 for WordPress has SQL injection.
Near-miss passage: CVE-2015-1513. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in SIPhone Enterprise PBX allows remote attackers to execute arbitrary SQL commands via the Username.
Query: detection engineering for Exfiltration to Text Storage Sites
Matching passage: T1567.003 Exfiltration to Text Storage Sites. Tactics: exfiltration. Description: Adversaries may exfiltrate data to text storage sites instead of their primary command and control channel. Text storage sites, such as <code>pastebin[.]com</code>, are commonly used by developers to share code and other information. Text storage sites are often used to host malicious code for C2 communication (e.g., [Stage Capabilities](https://attack.mitre.org/techniques/T1608)), but adversaries may also use these sites to exfiltrate collected data. Furthermore, paid features and encryption options may allow adversaries to conceal and store data more securely.(Citation: Pastebin EchoSec) **Note:** This is distinct from [Exfiltration to Code Repository](https://attack.mitre.org/techniques/T1567/001), which highlight access to code repositories via APIs.
Near-miss passage: T1567 Exfiltration Over Web Service. Tactics: exfiltration. Description: Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services. Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Query: alert when Detects attempts to remove Windows Defender configurations using the 'MpPreference' cmdlet
Matching passage: Sigma rule: Detects attempts to remove Windows Defender configurations using the 'MpPreference' cmdlet. Logsource: windows / process_creation. Rule: title: Tamper Windows Defender Remove-MpPreference id: 07e3cb2c-0608-410d-be4b-1511cb1a0448 related: - id: ae2bdd58-0681-48ac-be7f-58ab4e593458 type: similar status: test description: Detects attempts to remove Windows Defender configurations using the 'MpPreference' cmdlet references: - https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/windows-10-controlled-folder-access-event-search/ba-p/2326088 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-05 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: process_creation detection: selection_remove: CommandLine|contains: Remove-MpPreference selection_tamper: CommandLine|contains: - '-ControlledFolderAccessProtectedFolders ' - '-AttackSurfaceReductionRules_Ids ' - '-AttackSurfaceReductionRules_Actions ' - '-CheckForSignaturesBeforeRunningScan ' condition: all of selection_* falsepositives: - Legitimate PowerShell scripts level: high
Near-miss passage: Sigma rule: Detects Code Integrity (CI) engine blocking Microsoft Defender's processes (MpCmdRun and NisSrv) from loading unsigned D. Logsource: windows / security-mitigations. Rule: title: Microsoft Defender Blocked from Loading Unsigned DLL id: 0b0ea3cc-99c8-4730-9c53-45deee2a4c86 status: test description: Detects Code Integrity (CI) engine blocking Microsoft Defender's processes (MpCmdRun and NisSrv) from loading unsigned DLLs which may be an attempt to sideload arbitrary DLL references: - https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool author: Bhabesh Raj date: 2022-08-02 modified: 2022-09-28 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: product: windows service: security-mitigations detection: selection: EventID: - 11 - 12 ProcessPath|endswith: - \MpCmdRun.exe - \NisSrv.exe condition: selection falsepositives: - Unknown level: high
Query: what is T1102.003
Matching passage: T1102.003 One-Way Communication. Tactics: command and control. Description: Adversaries may use an existing, legitimate external Web service as a means for sending commands to a compromised system without receiving return output over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems may opt to send the output from those commands back over a different C2 channel, including to another distinct Web service. Alternatively, compromised systems may return no output at all in cases where adversaries want to send instructions to systems and do not want a response. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Near-miss passage: T1102.002 Bidirectional Communication. Tactics: command and control. Description: Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Query: CWE for Missing Authentication for Critical Function
Matching passage: CWE-306 Missing Authentication for Critical Function. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Near-miss passage: CWE-495 Private Data Structure Returned From A Public Method. The product has a method that is declared public, but returns a reference to a private data structure, which could then be modified in unexpected ways.
Query: risk of Libcontainer 1.6.0, as used in Docker Engine, allows local users to escape containerization ("mount namespace breakout") and write to arbitrary file on the host system via a symlin
Matching passage: CVE-2015-3629. CWE: CWE-59. CVSS: 7.800000190734863. Libcontainer 1.6.0, as used in Docker Engine, allows local users to escape containerization ("mount namespace breakout") and write to arbitrary file on the host system via a symlink attack in an image when respawning a container.
Near-miss passage: CVE-2015-5273. CWE: CWE-59. CVSS: 3.5999999046325684. The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users to write to arbitrary files via a symlink attack on unpacked.cpio in a pre-created directory with a predictable name in /var/tmp.
Query: risk of Cross-site scripting (XSS) vulnerability in the management interface in Cisco Unity Connection 9.1(1.10) allows remote attackers to inject arbitrary web script or HTML via a crafte
Matching passage: CVE-2015-6390. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the management interface in Cisco Unity Connection 9.1(1.10) allows remote attackers to inject arbitrary web script or HTML via a crafted value in a URL, aka Bug ID CSCup92741.
Near-miss passage: CVE-2015-7485. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in IBM Rational Engineering Lifecycle Manager 3.0 before 3.0.1.6 iFix7 Interim Fix 1, 4.0 before 4.0.7 iFix10, 5.0 before 5.0.2 iFix15, and 6.0 before 6.0.1 iFix4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 108626.