alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit Cross-site scripting (XSS) vulnerability in blocklayered-ajax.php in the blocklayered module in PrestaShop 1.6.0.9 and earlier allows remote attackers to inject arbitrary web scrip
Matching passage: CVE-2015-1175. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in blocklayered-ajax.php in the blocklayered module in PrestaShop 1.6.0.9 and earlier allows remote attackers to inject arbitrary web script or HTML via the layered_price_slider parameter.
Near-miss passage: CVE-2015-9276. CWE: CWE-79. CVSS: 6.099999904632568. SmarterTools SmarterMail before 13.3.5535 was vulnerable to stored XSS by bypassing the anti-XSS mechanisms. It was possible to run JavaScript code when a victim user opens or replies to the attacker's email, which contained a malicious payload. Therefore, users' passwords could be reset by using an XSS attack, as the password reset page did not need the current password.
Query: playbook for alert: Outbound C2 pattern associated with Visual Basic
Matching passage: Playbook for T1059.005 Visual Basic. 1) Validate alert telemetry against T1059.005. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: execution. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows technologies such as [Component Object Model](https://attack.mitre.org/techniques/T1559/001) and the [Native API](https://attack.mitre.org/techniques/T1106) through the Windows API. Although tagged as legacy with no planned future evolutions, VB is integr
Near-miss passage: Playbook for T1059.010 AutoHotKey & AutoIT. Different response path focused on execution.
Query: risk of In all Qualcomm products with Android releases from CAF using the Linux kernel, a UE can respond to a UEInformationRequest before Access Stratum security is established.
Matching passage: CVE-2015-9065. CWE: CWE-254. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a UE can respond to a UEInformationRequest before Access Stratum security is established.
Near-miss passage: CVE-2015-3756. CWE: CWE-254. CVSS: 2.0999999046325684. The Certificate UI in Apple iOS before 8.4.1 does not prevent X.509 certificate acceptance within the lock screen, which allows physically proximate attackers to establish arbitrary certificate trust relationships by completing a dialog.
Query: risk of The display drivers in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a
Matching passage: CVE-2015-6633. CWE: CWE-119. CVSS: 9.300000190734863. The display drivers in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23987307.
Near-miss passage: CVE-2015-0826. CWE: CWE-119. CVSS: 6.800000190734863. The nsTransformedTextRun::SetCapitalization function in Mozilla Firefox before 36.0 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read of heap memory) via a crafted Cascading Style Sheets (CSS) token sequence that triggers a restyle or reflow operation.
Query: patch priority for CVE-2015-1481
Matching passage: CVE-2015-1481. CWE: CWE-264. CVSS: 6.5. Ansible Tower (aka Ansible UI) before 2.0.5 allows remote organization administrators to gain privileges by creating a superuser account.
Near-miss passage: CVE-2015-4103. CWE: CWE-264. CVSS: 4.900000095367432. Xen 3.3.x through 4.5.x does not properly restrict write access to the host MSI message data field, which allows local x86 HVM guest administrators to cause a denial of service (host interrupt handling confusion) via vectors related to qemu and accessing spanning multiple fields.
Query: rule covering Detects the execution of the "wusa.exe" (Windows Update Standalone Installer) utility to extract ".cab" files using the
Matching passage: Sigma rule: Detects the execution of the "wusa.exe" (Windows Update Standalone Installer) utility to extract ".cab" files using the. Logsource: windows / process_creation. Rule: title: Cab File Extraction Via Wusa.EXE From Potentially Suspicious Paths id: c74c0390-3e20-41fd-a69a-128f0275a5ea related: - id: 59b39960-5f9d-4a49-9cef-1e4d2c1d0cb9 type: derived status: test description: 'Detects the execution of the "wusa.exe" (Windows Update Standalone Installer) utility to extract ".cab" files using the "/extract" argument from potentially suspicious paths. ' references: - https://web.archive.org/web/20180331144337/https://www.fireeye.com/blog/threat-research/2018/03/sanny-malware-delivery-method-updated-in-recently-observed-attacks.html - https://www.echotrail.io/insights/search/wusa.exe/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-05 modified: 2023-11-28 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_root: Image|endswith: \wusa.exe CommandLine|contains: '/extract:' selection_paths: CommandLine|contains: - :\PerfLogs\ - :\Users\Public\ - :\Windows\Temp\ - \Appdata\Local\Temp\ condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Execute Hashcat.exe with provided SAM file from registry of Windows and Password list to crack against. Logsource: windows / process_creation. Rule: title: HackTool - Hashcat Password Cracker Execution id: 39b31e81-5f5f-4898-9c0e-2160cfc0f9bf status: test description: Execute Hashcat.exe with provided SAM file from registry of Windows and Password list to crack against references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1110.002/T1110.002.md#atomic-test-1---password-cracking-with-hashcat - https://hashcat.net/wiki/doku.php?id=hashcat author: frack113 date: 2021-12-27 modified: 2023-02-04 tags: - attack.credential-access - attack.t1110.002 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \hashcat.exe selection_cli: CommandLine|contains|all: - '-a ' - '-m 1000 ' - '-r ' condition: 1 of selection_* falsepositives: - Tools that use similar command line flags and values level: high
Query: what is T1036.003
Matching passage: T1036.003 Rename Legitimate Utilities. Tactics: stealth. Description: Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for legitimate utilities adversaries are capable of abusing, including both built-in binaries and tools such as PSExec, AutoHotKey, and IronPython.(Citation: LOLBAS Main Site)(Citation: Huntress Python Malware 2025)(Citation: The DFIR Report AutoHotKey 2023)(Citation: Splunk Detect Renamed PSExec) It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename <code>rundll32.exe</code>).(Citation: Elastic Masquerade Ball) An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on these utilities executing from non-standard paths.(Citation: F-Secure CozyDuke)
Near-miss passage: T1036.004 Masquerade Task or Service. Tactics: stealth. Description: Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign. Tasks/services executed by the Task Scheduler or systemd will typically be given a name and/or description.(Citation: TechNet Schtasks)(Citation: Systemd Service Units) Windows services will have a service name as well as a display name. Many benign tasks and services exist that have commonly associated names. Adversaries may give tasks or services names that are similar or identical to those of legitimate ones. Tasks or services contain other fields, such as a description, that adversaries may attempt to make appear legitimate.(Citation: Palo Alto Shamoon Nov 2016)(Citation: Fysbis Dr Web Analysis)
Query: rule covering Detects the presence of "UWhRC....AAYBAAAA" pattern in command line. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encode
Matching passage: Sigma rule: Detects the presence of "UWhRC....AAYBAAAA" pattern in command line. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encode. Logsource: windows / process_creation. Rule: title: Attempts of Kerberos Coercion Via DNS SPN Spoofing id: 0ed99dda-6a35-11ef-8c99-0242ac120002 related: - id: b07e58cf-cacc-4135-8473-ccb2eba63dd2 type: similar status: experimental description: 'Detects the presence of "UWhRC....AAYBAAAA" pattern in command line. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts. It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like in CVE-2025-33073. If you see this pattern in the command line, it is likely an attempt to add spoofed Service Principal Names (SPNs) to DNS records, or checking for the presence of such records through the `nslookup` command. ' references: - https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025 - https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-06-20 tags: - attack.collection - attack.credential-access - attack.persistence - attack.privilege-escalation - attack.t1557.001 - attack.t1187 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - UWhRCA - BAAAA condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32). Logsource: windows / registry_set. Rule: title: UAC Bypass Using Windows Media Player - Registry id: 5f9db380-ea57-4d1e-beab-8a2d33397e93 status: test description: Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-23 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store\C:\Program Files\Windows Media Player\osk.exe Details: Binary Data condition: selection falsepositives: - Unknown level: high
Query: describe CVE-2015-2485
Matching passage: CVE-2015-2485. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2491 and CVE-2015-2541.
Near-miss passage: CVE-2015-5283. CWE: CWE-119. CVSS: 4.699999809265137. The sctp_init function in net/sctp/protocol.c in the Linux kernel before 4.2.3 has an incorrect sequence of protocol-initialization steps, which allows local users to cause a denial of service (panic or memory corruption) by creating SCTP sockets before all of the steps have finished.
Query: risk of The all-in-one-wp-security-and-firewall plugin before 3.9.5 for WordPress has XSS in add_query_arg and remove_query_arg function instances.
Matching passage: CVE-2015-9294. CWE: CWE-79. CVSS: 6.099999904632568. The all-in-one-wp-security-and-firewall plugin before 3.9.5 for WordPress has XSS in add_query_arg and remove_query_arg function instances.
Near-miss passage: CVE-2015-9377. CWE: CWE-79. CVSS: 6.099999904632568. iThemes Builder Theme Depot before 5.0.30 for WordPress has XSS via add_query_arg() and remove_query_arg().
Query: exploit Multiple integer overflows in the Blob class in keystore/keystore.cpp in Keystore in Android before 5.1.1 LMY48M allow attackers to execute arbitrary code and read arbitrary Keysto
Matching passage: CVE-2015-3863. CWE: CWE-189. CVSS: 9.300000190734863. Multiple integer overflows in the Blob class in keystore/keystore.cpp in Keystore in Android before 5.1.1 LMY48M allow attackers to execute arbitrary code and read arbitrary Keystore keys via an application that uses a crafted blob in an insert operation, aka internal bug 22802399.
Near-miss passage: CVE-2015-5309. CWE: CWE-189. CVSS: 4.300000190734863. Integer overflow in the terminal emulator in PuTTY before 0.66 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via an ECH (erase characters) escape sequence with a large parameter value, which triggers a buffer underflow.
Query: write Sigma for DNSExfiltrator allows for transferring (exfiltrate) a file over a DNS request covert channel
Matching passage: Sigma rule: DNSExfiltrator allows for transferring (exfiltrate) a file over a DNS request covert channel. Logsource: windows / ps_script. Rule: title: Powershell DNSExfiltration id: d59d7842-9a21-4bc6-ba98-64bfe0091355 status: test description: DNSExfiltrator allows for transferring (exfiltrate) a file over a DNS request covert channel references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1048/T1048.md#atomic-test-3---dnsexfiltration-doh - https://github.com/Arno0x/DNSExfiltrator author: frack113 date: 2022-01-07 tags: - attack.exfiltration - attack.t1048 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_cmdlet: - ScriptBlockText|contains: Invoke-DNSExfiltrator - ScriptBlockText|contains|all: - ' -i ' - ' -d ' - ' -p ' - ' -doh ' - ' -t ' condition: selection_cmdlet falsepositives: - Legitimate script level: high
Near-miss passage: Sigma rule: Detects use of .NET InstallUtil.exe in order to download arbitrary files. The files will be written to "%LOCALAPPDATA%\M. Logsource: windows / process_creation. Rule: title: File Download Via InstallUtil.EXE id: 75edd216-1939-4c73-8d61-7f3a0d85b5cc status: test description: 'Detects use of .NET InstallUtil.exe in order to download arbitrary files. The files will be written to "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\" ' references: - https://github.com/LOLBAS-Project/LOLBAS/pull/239 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-19 modified: 2023-11-09 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \InstallUtil.exe - OriginalFileName: InstallUtil.exe selection_cli: CommandLine|contains: - ftp:// - http:// - https:// condition: all of selection_* falsepositives: - Unknown level: medium
Query: Sigma rule for Detects the presence of reversed PowerShell commands in the CommandLine. This is often used as a method of obfuscation b
Matching passage: Sigma rule: Detects the presence of reversed PowerShell commands in the CommandLine. This is often used as a method of obfuscation b. Logsource: windows / process_creation. Rule: title: Potential PowerShell Obfuscation Via Reversed Commands id: b6b49cd1-34d6-4ead-b1bf-176e9edba9a4 status: test description: Detects the presence of reversed PowerShell commands in the CommandLine. This is often used as a method of obfuscation by attackers references: - https://2019.offzone.moscow/ru/report/hunting-for-powershell-abuses/ - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=66 author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton date: 2020-10-11 modified: 2023-05-31 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_cli: CommandLine|contains: - hctac - kaerb - dnammoc - ekovn - eliFd - rahc - etirw - golon - tninon - eddih - tpircS - ssecorp - llehsrewop - esnopser - daolnwod - tneilCbeW - tneilc - ptth - elifotevas - 46esab - htaPpmeTteG - tcejbO - maerts - hcaerof - retupmoc filter_main_encoded_keyword: CommandLine|contains: - ' -EncodedCommand ' - ' -enc ' condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects code integrity failures such as missing page hashes or corrupted drivers due unauthorized modification. This cou. Logsource: windows / security. Rule: title: Failed Code Integrity Checks id: 470ec5fa-7b4e-4071-b200-4c753100f49b status: stable description: 'Detects code integrity failures such as missing page hashes or corrupted drivers due unauthorized modification. This could be a sign of tampered binaries. ' references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5038 - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6281 author: Thomas Patzke date: 2019-12-03 modified: 2025-01-19 tags: - attack.stealth - attack.t1027.001 logsource: product: windows service: security detection: selection: EventID: - 5038 - 6281 filter_optional_crowdstrike: param1|contains: - \CSFalconServiceUninstallTool_ - \Program Files\CrowdStrike\ - \System32\drivers\CrowdStrike\ - \Windows\System32\ScriptControl64_ filter_optional_sophos: param1|contains: \Program Files\Sophos\ condition: selection and not 1 of filter_optional_* falsepositives: - Disk device errors level: informational
Query: Encoded PowerShell / command-line abuse matching Digital Certificates
Matching passage: T1587.003 Digital Certificates. Tactics: resource development. Description: Adversaries may create self-signed SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. In the case of self-signing, digital certificates will lack the element of trust associated with the signature of a third-party certificate authority (CA). Adversaries may create self-signed SSL/TLS certificates that can be used to further their operations, such as encrypting C2 traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)) or even enabling [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) if added to the root of trust (i.e. [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004)). After creating a digital certificate, an adversary may then install that certificate (see [Install Digital Certificate](https://attack.mitre.org/techniques/T1608/003)) on infrastructure under their control.
Near-miss passage: T1587.001 Malware. Tactics: resource development. Description: Adversaries may develop malware and malware components that can be used during targeting. Building malicious software can include the development of payloads, droppers, post-compromise tools, backdoors (including backdoored images), packers, C2 protocols, and the creation of infected removable media. Adversaries may develop malware to support their operations, creating a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Citation: ActiveMalwareEnergy)(Citation: FBI Flash FIN7 USB) During malware development, adversaries may intentionally include indicators aligned with other known actors in order to mislead attribution by defenders.(Citation: Olympic Destroyer)(Citation: Risky Bulletin Threat actor impersonates FSB APT)(Citation: GamaCopy organization) As with legitimate development efforts, different skill sets may be required for developing malware. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's malware development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the malware. Some aspects of malware development, such as C2 protocol development, may require adversaries to obtain additional infrastructure. For example, malware developed that will communicate with Twitter for C2, may require use of [Web Services](https://attack.mitre.org/techniques/T1583/006).(Citation: FireEye APT29)
Query: CVE similar to CVE-2015-1188
Matching passage: CVE-2015-1188. CWE: UNKNOWN. CVSS: 7.5. The certificate verification functions in the HNDS service in Swisscom Centro Grande (ADB) DSL routers with firmware before 6.14.00 allows remote attackers to access the management functions via unknown vectors.
Near-miss passage: CVE-2015-0334. CWE: UNKNOWN. CVSS: 9.300000190734863. Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-0336.
Query: describe CVE-2015-1672
Matching passage: CVE-2015-1672. CWE: CWE-310. CVSS: 5.0. Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 allows remote attackers to cause a denial of service (recursion and performance degradation) via crafted encrypted data in an XML document, aka ".NET XML Decryption Denial of Service Vulnerability."
Near-miss passage: CVE-2015-1934. CWE: CWE-310. CVSS: 5.0. IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX002, and 7.6.0 before 7.6.0.1 IFIX001; Maximo Asset Management 7.5.x before 7.5.0.8 IFIX002 and 7.6.0 before 7.6.0.1 IFIX001 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products do not properly encrypt passwords, which makes it easier for context-dependent attackers to determine cleartext passwords by leveraging access to a password file.