alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: patch priority for CVE-2015-5296
Matching passage: CVE-2015-5296. CWE: CWE-20. CVSS: 5.400000095367432. Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 supports connections that are encrypted but unsigned, which allows man-in-the-middle attackers to conduct encrypted-to-unencrypted downgrade attacks by modifying the client-server data stream, related to clidfs.c, libsmb_server.c, and smbXcli_base.c.
Near-miss passage: CVE-2015-6164. CWE: CWE-20. CVSS: 6.800000190734863. Microsoft Internet Explorer 9 through 11 improperly implements a cross-site scripting (XSS) protection mechanism, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, aka "Internet Explorer XSS Filter Bypass Vulnerability."
Query: vulnerability: Multiple SQL injection vulnerabilities in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) albumid 
Matching passage: CVE-2015-5599. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) albumid or (2) name parameter.
Near-miss passage: CVE-2015-4426. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in pimcore before build 3473 allows remote attackers to execute arbitrary SQL commands via the filter parameter to admin/asset/grid-proxy.
Query: CWE for Covert Timing Channel
Matching passage: CWE-385 Covert Timing Channel. Covert timing channels convey information by modulating some aspect of system behavior over time, so that the program receiving the information can observe system behavior and infer protected information.
Near-miss passage: CWE-453 Insecure Default Variable Initialization. The product, by default, initializes an internal variable with an insecure or less secure value than is possible.
Query: write Sigma for Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent rem
Matching passage: Sigma rule: Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent rem. Logsource: macos / process_creation. Rule: title: Creation Of A Local User Account id: 51719bf5-e4fd-4e44-8ba8-b830e7ac0731 status: test description: Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1136.001/T1136.001.md - https://ss64.com/osx/sysadminctl.html author: Alejandro Ortuno, oscd.community date: 2020-10-06 modified: 2023-02-18 tags: - attack.t1136.001 - attack.persistence logsource: category: process_creation product: macos detection: selection_dscl: Image|endswith: /dscl CommandLine|contains: create selection_sysadminctl: Image|endswith: /sysadminctl CommandLine|contains: addUser condition: 1 of selection_* falsepositives: - Legitimate administration activities level: low
Near-miss passage: Sigma rule: Detect creation of suspicious executable file names. Some strings look for suspicious file extensions, others look for f. Logsource: windows / file_event. Rule: title: Suspicious Executable File Creation id: 74babdd6-a758-4549-9632-26535279e654 status: test description: 'Detect creation of suspicious executable file names. Some strings look for suspicious file extensions, others look for filenames that exploit unquoted service paths. ' references: - https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae - https://app.any.run/tasks/76c69e2d-01e8-49d9-9aea-fb7cc0c4d3ad/ author: frack113 date: 2022-09-05 modified: 2023-12-11 tags: - attack.stealth - attack.t1564 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: - :\$Recycle.Bin.exe - :\Documents and Settings.exe - :\MSOCache.exe - :\PerfLogs.exe - :\Recovery.exe - .bat.exe - .sys.exe condition: selection falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-7410
Matching passage: CVE-2015-7410. CWE: CWE-17. CVSS: 7.400000095367432. The Health Check tool in IBM Sterling B2B Integrator 5.2 does not properly use cookies in conjunction with HTTPS sessions, which allows man-in-the-middle attackers to obtain sensitive information or modify data via unspecified vectors.
Near-miss passage: CVE-2015-1217. CWE: CWE-17. CVSS: 7.5. The V8LazyEventListener::prepareListenerObject function in bindings/core/v8/V8LazyEventListener.cpp in the V8 bindings in Blink, as used in Google Chrome before 41.0.2272.76, does not properly compile listeners, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion."
Query: risk of Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Ex
Matching passage: CVE-2015-0020. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0017, CVE-2015-0022, CVE-2015-0026, CVE-2015-0030, CVE-2015-0031, CVE-2015-0036, and CVE-2015-0041.
Near-miss passage: CVE-2015-0217. CWE: CWE-399. CVSS: 6.800000190734863. filter/mediaplugin/filter.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to cause a denial of service (CPU consumption or partial outage) via a crafted string that is matched against an improper regular expression.
Query: risk of Multiple incomplete blacklist vulnerabilities in inc/core/class.dc.core.php in Dotclear before 2.8.2 allow remote authenticated users with "manage their own media items" and "manag
Matching passage: CVE-2015-8832. CWE: CWE-284. CVSS: 8.800000190734863. Multiple incomplete blacklist vulnerabilities in inc/core/class.dc.core.php in Dotclear before 2.8.2 allow remote authenticated users with "manage their own media items" and "manage their own entries and comments" permissions to execute arbitrary PHP code by uploading a file with a (1) .pht, (2) .phps, or (3) .phtml extension.
Near-miss passage: CVE-2015-2107. CWE: CWE-284. CVSS: 6.800000190734863. HP Operations Manager i Management Pack 1.x before 1.01 for SAP allows local users to execute OS commands by leveraging SAP administrative privileges.
Query: incident response steps for Lateral movement indicators for Hidden Users
Matching passage: Playbook for T1564.002 Hidden Users. 1) Validate alert telemetry against T1564.002. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may use hidden users to hide the presence of user accounts they create or modify. Administrators may want to hide users when there are many user accounts on a given system or if they want to hide their administrative or other management accounts from other users. In macOS, adversaries can create or modify a user to be hidden through manipulating plist files, folder attributes, and user
Near-miss passage: Playbook for T1564.003 Hidden Window. Different response path focused on stealth.
Query: detect Detects usage of "findstr" with the argument "385201". Which could indicate potential discovery of an installed Sysinter in logs
Matching passage: Sigma rule: Detects usage of "findstr" with the argument "385201". Which could indicate potential discovery of an installed Sysinter. Logsource: windows / process_creation. Rule: title: Sysmon Discovery Via Default Driver Altitude Using Findstr.EXE id: 37db85d1-b089-490a-a59a-c7b6f984f480 status: test description: Detects usage of "findstr" with the argument "385201". Which could indicate potential discovery of an installed Sysinternals Sysmon service using the default driver altitude (even if the name is changed). references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518.001/T1518.001.md#atomic-test-5---security-software-discovery---sysmon-service author: frack113 date: 2021-12-16 modified: 2023-11-14 tags: - attack.discovery - attack.t1518.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \find.exe - \findstr.exe - OriginalFileName: - FIND.EXE - FINDSTR.EXE selection_cli: CommandLine|contains: ' 385201' condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects restricted access to applications by the Software Restriction Policies (SRP) policy. Logsource: windows / application. Rule: title: Restricted Software Access By SRP id: b4c8da4a-1c12-46b0-8a2b-0a8521d03442 status: test description: Detects restricted access to applications by the Software Restriction Policies (SRP) policy references: - https://learn.microsoft.com/en-us/windows-server/identity/software-restriction-policies/software-restriction-policies - https://github.com/nasbench/EVTX-ETW-Resources/blob/7a806a148b3d9d381193d4a80356016e6e8b1ee8/ETWEventsList/CSV/Windows11/22H2/W11_22H2_Pro_20220920_22621.382/Providers/Microsoft-Windows-AppXDeployment-Server.csv author: frack113 date: 2023-01-12 tags: - attack.lateral-movement - attack.execution - attack.t1072 logsource: product: windows service: application detection: selection: Provider_Name: Microsoft-Windows-SoftwareRestrictionPolicies EventID: - 865 - 866 - 867 - 868 - 882 condition: selection falsepositives: - Unknown level: high
Query: campaign using Network Topology
Matching passage: T1590.004 Network Topology. Tactics: reconnaissance. Description: Adversaries may gather information about the victim's network topology that can be used during targeting. Information about network topologies may include a variety of details, including the physical and/or logical arrangement of both external-facing and internal network environments. This information may also include specifics regarding network devices (gateways, routers, etc.) and other infrastructure. Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about network topologies may also be exposed to adversaries via online or other accessible data sets (ex: [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: DNS Dumpster) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133)).
Near-miss passage: T1590.003 Network Trust Dependencies. Tactics: reconnaissance. Description: Adversaries may gather information about the victim's network trust dependencies that can be used during targeting. Information about network trusts may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, etc.) that have connected (and potentially elevated) network access. Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about network trusts may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: Pentesting AD Forests) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
Query: risk of The Edge Component Caching Proxy in IBM WebSphere Application Server (WAS) 8.0 before 8.0.0.12 and 8.5 before 8.5.5.8 does not properly encrypt data, which allows remote authentica
Matching passage: CVE-2015-5004. CWE: CWE-200. CVSS: 4.0. The Edge Component Caching Proxy in IBM WebSphere Application Server (WAS) 8.0 before 8.0.0.12 and 8.5 before 8.5.5.8 does not properly encrypt data, which allows remote authenticated users to obtain sensitive information via unspecified vectors.
Near-miss passage: CVE-2015-5901. CWE: CWE-200. CVSS: 2.0999999046325684. The Secure Empty Trash feature in Finder in Apple OS X before 10.11 improperly deletes Trash files, which might allow local users to obtain sensitive information by reading storage media, as demonstrated by reading a flash drive.
Query: risk of Unspecified vulnerability in Oracle Sun Solaris 10 allows local users to affect confidentiality via unknown vectors related to Text Utilities.
Matching passage: CVE-2015-2574. CWE: UNKNOWN. CVSS: 2.0999999046325684. Unspecified vulnerability in Oracle Sun Solaris 10 allows local users to affect confidentiality via unknown vectors related to Text Utilities.
Near-miss passage: CVE-2015-3636. CWE: UNKNOWN. CVSS: 4.900000095367432. The ping_unhash function in net/ipv4/ping.c in the Linux kernel before 4.0.3 does not initialize a certain list data structure during an unhash operation, which allows local users to gain privileges or cause a denial of service (use-after-free and system crash) by leveraging the ability to make a SOCK_DGRAM socket system call for the IPPROTO_ICMP or IPPROTO_ICMPV6 protocol, and then making a connect system call after a disconnect.
Query: patch priority for CVE-2015-9353
Matching passage: CVE-2015-9353. CWE: CWE-89. CVSS: 7.199999809265137. The gigpress plugin before 2.3.11 for WordPress has SQL injection in the admin area, a different vulnerability than CVE-2015-4066.
Near-miss passage: CVE-2015-10056. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability was found in 2071174A vinylmap. It has been classified as critical. Affected is the function contact of the file recordstoreapp/views.py. The manipulation leads to sql injection. The name of the patch is b07b79a1e92cc62574ba0492cce000ef4a7bd25f. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218400.
Query: CVE similar to CVE-2015-4774
Matching passage: CVE-2015-4774. CWE: UNKNOWN. CVSS: 3.299999952316284. Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect integrity and availability via unknown vectors, a different vulnerability than CVE-2015-4779 and CVE-2015-4788.
Near-miss passage: CVE-2015-0476. CWE: UNKNOWN. CVSS: 5.5. Unspecified vulnerability in the SQL Trace Analyzer component in Oracle Support Tools before 12.1.11 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
Query: write Sigma for Detects usage of "find" binary in a suspicious manner to perform discovery
Matching passage: Sigma rule: Detects usage of "find" binary in a suspicious manner to perform discovery. Logsource: linux / process_creation. Rule: title: Potential Discovery Activity Using Find - Linux id: 8344c0e5-5783-47cc-9cf9-a0f7fd03e6cf related: - id: 85de3a19-b675-4a51-bfc6-b11a5186c971 type: similar status: test description: Detects usage of "find" binary in a suspicious manner to perform discovery references: - https://github.com/SaiSathvik1/Linux-Privilege-Escalation-Notes author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-28 tags: - attack.discovery - attack.t1083 logsource: category: process_creation product: linux detection: selection: Image|endswith: /find CommandLine|contains: - -perm -4000 - -perm -2000 - -perm 0777 - -perm -222 - -perm -o w - -perm -o x - -perm -u=s - -perm -g=s condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects potentially suspicious child process of applications launched from inside the WindowsApps directory. This could. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Windows App Activity id: f91ed517-a6ba-471d-9910-b3b4a398c0f3 status: test description: Detects potentially suspicious child process of applications launched from inside the WindowsApps directory. This could be a sign of a rogue ".appx" package installation/execution references: - https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-12 modified: 2025-10-07 tags: - attack.stealth logsource: product: windows category: process_creation detection: selection_parent: ParentImage|contains: C:\Program Files\WindowsApps\ selection_susp_img: Image|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \powershell_ise.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe selection_susp_cli: CommandLine|contains: - cmd /c - Invoke- - Base64 filter_optional_terminal: ParentImage|contains: :\Program Files\WindowsApps\Microsoft.WindowsTerminal ParentImage|endswith: \WindowsTerminal.exe Image|endswith: - \powershell.exe - \cmd.exe - \pwsh.exe filter_optional_sysinternals: ParentImage|startswith: C:\Program Files\WindowsApps\Microsoft.SysinternalsSuite Image|endswith: \cmd.exe condition: selection_parent and 1 of selection_susp_* and not 1 of filter_optional_* falsepositives: - Legitimate packages that make use of external binaries such as Windows Terminal level: medium
Query: Suspicious Token Impersonation/Theft execution detected on endpoint
Matching passage: T1134.001 Token Impersonation/Theft. Tactics: stealth, privilege escalation. Description: Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. For example, an adversary can duplicate an existing token using `DuplicateToken` or `DuplicateTokenEx`.(Citation: DuplicateToken function) The token can then be used with `ImpersonateLoggedOnUser` to allow the calling thread to impersonate a logged on user's security context, or with `SetThreadToken` to assign the impersonated token to a thread. An adversary may perform [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) when they have a specific, existing process they want to assign the duplicated token to. For example, this may be useful for when the target user has a non-network logon session on the system. When an adversary would instead use a duplicated token to create a new process rather than attaching to an existing process, they can additionally [Create Process with Token](https://attack.mitre.org/techniques/T1134/002) using `CreateProcessWithTokenW` or `CreateProcessAsUserW`. [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) is also distinct from [Make and Impersonate Token](https://attack.mitre.org/techniques/T1134/003) in that it refers to duplicating an existing token, rather than creating a new one.
Near-miss passage: T1134.003 Make and Impersonate Token. Tactics: stealth, privilege escalation. Description: Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls. For example, if an adversary has a username and password but the user is not logged onto the system the adversary can then create a logon session for the user using the `LogonUser` function.(Citation: LogonUserW function) The function will return a copy of the new session's access token and the adversary can use `SetThreadToken` to assign the token to a thread. This behavior is distinct from [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) in that this refers to creating a new user token instead of stealing or duplicating an existing one.
Query: vulnerability: Microsoft Internet Explorer 10 and 11 uses an incorrect flag during certain filesystem accesses, which allows remote attackers to delete arbitrary files via unspecified vectors, ak
Matching passage: CVE-2015-2484. CWE: CWE-264. CVSS: 6.400000095367432. Microsoft Internet Explorer 10 and 11 uses an incorrect flag during certain filesystem accesses, which allows remote attackers to delete arbitrary files via unspecified vectors, aka "Tampering Vulnerability."
Near-miss passage: CVE-2015-5961. CWE: CWE-264. CVSS: 3.299999952316284. The COPPA error page in the Accounts setup dialog in Mozilla Firefox OS before 2.2 embeds content from an external web server URL into the System process, which allows man-in-the-middle attackers to bypass intended access restrictions by spoofing that server.