alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit Double free vulnerability in Apple iOS before 9.1 and OS X before 10.11.1 allows attackers to write to arbitrary files via a crafted app that accesses AtomicBufferedFile descriptor
Matching passage: CVE-2015-6983. CWE: UNKNOWN. CVSS: 8.800000190734863. Double free vulnerability in Apple iOS before 9.1 and OS X before 10.11.1 allows attackers to write to arbitrary files via a crafted app that accesses AtomicBufferedFile descriptors.
Near-miss passage: CVE-2015-0814. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 37.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Query: describe CVE-2015-0177
Matching passage: CVE-2015-0177. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.5.0 before CF05 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-5489. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Smart Trim module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors involving the field settings form.
Query: vulnerability: The cluster repository manager in IBM WebSphere MQ 7.5 before 7.5.0.5 and 8.0 before 8.0.0.2 allows remote authenticated administrators to cause a denial of service (memory overwri
Matching passage: CVE-2015-0189. CWE: CWE-399. CVSS: 4.0. The cluster repository manager in IBM WebSphere MQ 7.5 before 7.5.0.5 and 8.0 before 8.0.0.2 allows remote authenticated administrators to cause a denial of service (memory overwrite and daemon outage) by triggering multiple transmit-queue records.
Near-miss passage: CVE-2015-0052. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0027, CVE-2015-0035, CVE-2015-0039, and CVE-2015-0068.
Query: exploit The web server on Siemens SCALANCE X-200IRT switches with firmware before 5.2.0 allows remote attackers to hijack sessions via unspecified vectors.
Matching passage: CVE-2015-1049. CWE: CWE-20. CVSS: 6.800000190734863. The web server on Siemens SCALANCE X-200IRT switches with firmware before 5.2.0 allows remote attackers to hijack sessions via unspecified vectors.
Near-miss passage: CVE-2015-2460. CWE: CWE-20. CVSS: 9.300000190734863. ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "OpenType Font Parsing Vulnerability."
Query: Sigma YAML for windows / appxdeployment-server
Matching passage: Sigma rule: Detects attempts to install unsigned MSIX/AppX packages using the -AllowUnsigned parameter via AppXDeployment-Server eve. Logsource: windows / appxdeployment-server. Rule: title: Windows AppX Deployment Unsigned Package Installation id: 9a025188-6f2d-42f8-bb2f-d3a83d24a5af related: - id: 37651c2a-42cd-4a69-ae0d-22a4349aa04a type: similar - id: 975b2262-9a49-439d-92a6-0709cccdf0b2 type: similar status: experimental description: Detects attempts to install unsigned MSIX/AppX packages using the -AllowUnsigned parameter via AppXDeployment-Server events references: - https://docs.microsoft.com/en-us/powershell/module/appx/add-appxpackage - https://www.splunk.com/en_us/blog/security/msix-weaponization-threat-detection-splunk.html author: Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-03 tags: - attack.execution - attack.defense-impairment - attack.t1204.002 - attack.t1553.005 logsource: product: windows service: appxdeployment-server detection: selection: EventID: 603 Flags: '8388608' condition: selection falsepositives: - Legitimate installation of unsigned packages for legitimate purposes such as development or testing level: medium
Near-miss passage: Sigma rule: Detects the execution of a renamed "client32.exe" (NetSupport RAT) via Imphash, Product and OriginalFileName strings. Logsource: windows / process_creation. Rule: title: Renamed NetSupport RAT Execution id: 0afbd410-de03-4078-8491-f132303cb67d status: test description: Detects the execution of a renamed "client32.exe" (NetSupport RAT) via Imphash, Product and OriginalFileName strings references: - https://redcanary.com/blog/misbehaving-rats/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-19 modified: 2024-11-23 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: - Product|contains: NetSupport Remote Control - OriginalFileName|contains: client32.exe - Hashes|contains: IMPHASH=A9D50692E95B79723F3E76FCF70D023E filter: Image|endswith: \client32.exe condition: selection and not filter falsepositives: - Unknown level: high
Query: risk of Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download (RFD) attack. 
Matching passage: CVE-2015-5211. CWE: CWE-552. CVSS: 9.600000381469727. Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download (RFD) attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being downloaded rather than rendered and also includes some input reflected in the response.
Near-miss passage: CVE-2015-4715. CWE: CWE-552. CVSS: 4.900000095367432. The fetch function in OAuth/Curl.php in Dropbox-PHP, as used in ownCloud Server before 6.0.8, 7.x before 7.0.6, and 8.x before 8.0.4 when an external Dropbox storage has been mounted, allows remote administrators of Dropbox.com to read arbitrary files via an @ (at sign) character in unspecified POST values.
Query: describe CVE-2015-0258
Matching passage: CVE-2015-0258. CWE: CWE-434. CVSS: 8.800000190734863. Multiple incomplete blacklist vulnerabilities in the avatar upload functionality in manageuser.php in Collabtive before 2.1 allow remote authenticated users to execute arbitrary code by uploading a file with a (1) .php3, (2) .php4, (3) .php5, or (4) .phtml extension.
Near-miss passage: CVE-2015-1000000. CWE: CWE-434. CVSS: 9.800000190734863. Remote file upload vulnerability in mailcwp v1.99 wordpress plugin
Query: Sigma rule for Detects when a Microsoft Cloud App Security reported suspicious email forwarding rules, for example, if a user created a
Matching passage: Sigma rule: Detects when a Microsoft Cloud App Security reported suspicious email forwarding rules, for example, if a user created a. Logsource: m365 / threat_management. Rule: title: Suspicious Inbox Forwarding id: 6c220477-0b5b-4b25-bb90-66183b4089e8 status: test description: Detects when a Microsoft Cloud App Security reported suspicious email forwarding rules, for example, if a user created an inbox rule that forwards a copy of all emails to an external address. references: - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference author: Austin Songer @austinsonger date: 2021-08-22 modified: 2022-10-09 tags: - attack.exfiltration - attack.t1020 logsource: service: threat_management product: m365 detection: selection: eventSource: SecurityComplianceCenter eventName: Suspicious inbox forwarding status: success condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects suspicious Kerberos TGT requests with pre-authentication disabled (Pre-Authentication Type = 0) and Ticket Encry. Logsource: windows / security. Rule: title: Potential AS-REP Roasting via Kerberos TGT Requests id: 3e2f1b2c-4d5e-11ee-be56-0242ac120002 status: experimental description: 'Detects suspicious Kerberos TGT requests with pre-authentication disabled (Pre-Authentication Type = 0) and Ticket Encryption Type (0x17) i.e, RC4-HMAC. This may indicate an AS-REP Roasting attack, where attackers request AS-REP messages for accounts without pre-authentication and attempt to crack the encrypted ticket offline to recover user passwords. ' references: - https://medium.com/system-weakness/detecting-as-rep-roasting-attacks-b5b3965f9714 - https://www.picussecurity.com/resource/blog/as-rep-roasting-attack-explained-mitre-attack-t1558.004 author: ANosir date: 2025-05-22 modified: 2025-07-04 logsource: product: windows service: security detection: selection: EventID: 4768 TicketEncryptionType: '0x17' ServiceName: krbtgt PreAuthType: 0 condition: selection falsepositives: - Legacy systems or applications that legitimately use RC4 encryption - Misconfigured accounts with pre-authentication disabled level: medium
Query: patch priority for CVE-2015-1653
Matching passage: CVE-2015-1653. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Foundation 2013 SP1 and SharePoint Server 2013 SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted request, aka "Microsoft SharePoint XSS Vulnerability."
Near-miss passage: CVE-2015-9362. CWE: CWE-79. CVSS: 6.099999904632568. The Post Connector plugin before 1.0.4 for WordPress has XSS via add_query_arg() and remove_query_arg().
Query: explain T1195.002 Compromise Software Supply Chain
Matching passage: T1195.002 Compromise Software Supply Chain. Tactics: initial access. Description: Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version. Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.(Citation: Avast CCleaner3 2018)(Citation: Command Five SK 2011)
Near-miss passage: T1195 Supply Chain Compromise. Tactics: initial access. Description: Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise can take place at any stage of the supply chain including: * Manipulation of development tools * Manipulation of a development environment * Manipulation of source code repositories (public or private) * Manipulation of source code in open-source dependencies * Manipulation of software update/distribution mechanisms * Compromised/infected system images (removable media infected at the factory)(Citation: IBM Storwize)(Citation: Schneider Electric USB Malware) * Replacement of legitimate software with modified versions * Sales of modified/counterfeit products to legitimate distributors * Shipment interdiction While supply chain compromise can impact any component of hardware or software, adversaries looking to gain execution have often focused on malicious additions to legitimate software in software distribution or update channels.(Citation: Avast CCleaner3 2018)(Citation: Microsoft Dofoil 2018)(Citation: Command Five SK 2011) Adversaries may limit targeting to a desired victim set or distribute malicious software to a broad set of consumers but only follow up with specific victims.(Citation: Symantec Elderwood Sept 2012)(Citation: Avast CCleaner3 2018)(Citation: Command Five SK 2011) Popular open-source projects that are used as dependencies in many applications may also be targeted as a means to add malicious code to users of the dependency.(Citation: Trendmicro NPM Compromise) In some cases, adversaries may conduct “second-order” supply chain compromises by leveraging the access gained from an initial supply chain compromise to further compromise a software component.(Citation: Krebs 3cx overview 2023) This may allow the threat actor to spread to even more victims.
Query: vulnerability: Facebook Proxygen before 2015-11-09 mismanages HTTPMessage.request state, which allows remote attackers to conduct hijacking attacks and bypass ACL checks.
Matching passage: CVE-2015-7265. CWE: CWE-284. CVSS: 7.5. Facebook Proxygen before 2015-11-09 mismanages HTTPMessage.request state, which allows remote attackers to conduct hijacking attacks and bypass ACL checks.
Near-miss passage: CVE-2015-0667. CWE: CWE-284. CVSS: 5.0. The Management Interface on Cisco Content Services Switch (CSS) 11500 devices 8.20.4.02 and earlier allows remote attackers to bypass intended restrictions on local-network device access via crafted SSH packets, aka Bug ID CSCut14855.
Query: vulnerability: lxc-start in lxc before 1.0.8 and 1.1.x before 1.1.4 allows local container administrators to escape AppArmor confinement via a symlink attack on a (1) mount target or (2) bind mou
Matching passage: CVE-2015-1335. CWE: CWE-59. CVSS: 7.199999809265137. lxc-start in lxc before 1.0.8 and 1.1.x before 1.1.4 allows local container administrators to escape AppArmor confinement via a symlink attack on a (1) mount target or (2) bind mount source.
Near-miss passage: CVE-2015-3156. CWE: CWE-59. CVSS: 5.5. The _write_config function in trove/guestagent/datastore/experimental/mongodb/service.py, reset_configuration function in trove/guestagent/datastore/experimental/postgresql/service/config.py, write_config function in trove/guestagent/datastore/experimental/redis/service.py, _write_mycnf function in trove/guestagent/datastore/mysql/service.py, InnoBackupEx::_run_prepare function in trove/guestagent/strategies/restore/mysql_impl.py, InnoBackupEx::cmd function in trove/guestagent/strategies/backup/mysql_impl.py, MySQLDump::cmd in trove/guestagent/strategies/backup/mysql_impl.py, InnoBackupExIncremental::cmd function in trove/guestagent/strategies/backup/mysql_impl.py, _get_actual_db_status function in trove/guestagent/datastore/experimental/cassandra/system.py and trove/guestagent/datastore/experimental/cassandra/service.py, and multiple class CbBackup methods in trove/guestagent/strategies/backup/experimental/couchbase_impl.py in Openstack DBaaS (aka Trove) as packaged in Openstack before 2015.1.0 (aka Kilo) allows local users to write to configuration files via a symlink attack on a temporary file.
Query: patch priority for CVE-2015-4863
Matching passage: CVE-2015-4863. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in the Portable Clusterware component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
Near-miss passage: CVE-2015-2014. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in the web server in IBM Domino 8.5 before 8.5.3 FP6 IF9 and 9.0 before 9.0.1 FP4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or cross-site scripting (XSS) attacks via a crafted URL, aka SPR SJAR9DNGDA.
Query: vulnerability: WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corrupt
Matching passage: CVE-2015-1077. CWE: CWE-399. CVSS: 6.800000190734863. WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Near-miss passage: CVE-2015-0099. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Query: CVE similar to CVE-2015-5097
Matching passage: CVE-2015-5097. CWE: CWE-190. CVSS: 10.0. Integer overflow in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5108 and CVE-2015-5109.
Near-miss passage: CVE-2015-8933. CWE: CWE-190. CVSS: 5.5. Integer overflow in the archive_read_format_tar_skip function in archive_read_support_format_tar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted tar file.
Query: describe CVE-2015-7230
Matching passage: CVE-2015-7230. CWE: CWE-264. CVSS: 3.5. The Workbench Email module 7.x-3.x before 7.x-3.4 for Drupal allows remote authenticated users with certain permissions to bypass node and field validation by saving a node.
Near-miss passage: CVE-2015-1481. CWE: CWE-264. CVSS: 6.5. Ansible Tower (aka Ansible UI) before 2.0.5 allows remote organization administrators to gain privileges by creating a superuser account.
Query: SIEM correlation: resource development activity consistent with Social Media Accounts
Matching passage: T1585.001 Social Media Accounts. Tactics: resource development. Description: Adversaries may create and cultivate social media accounts that can be used during targeting. Adversaries can create social media accounts that can be used to build a persona to further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage) For operations incorporating social engineering, the utilization of a persona on social media may be important. These personas may be fictitious or impersonate real people. The persona may exist on a single social media site or across multiple sites (ex: Facebook, LinkedIn, Twitter, etc.). Establishing a persona on social media may require development of additional documentation to make them seem real. This could include filling out profile information, developing social networks, or incorporating photos. Once a persona has been developed an adversary can use it to create connections to targets of interest. These connections may be direct or may include trying to connect through others.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage) These accounts may be leveraged during other phases of the adversary lifecycle, such as during Initial Access (ex: [Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003)).
Near-miss passage: T1585.003 Cloud Accounts. Tactics: resource development. Description: Adversaries may create accounts with cloud providers that can be used during targeting. Adversaries can use cloud accounts to further their operations, including leveraging cloud storage services such as Dropbox, MEGA, Microsoft OneDrive, or AWS S3 buckets for [Exfiltration to Cloud Storage](https://attack.mitre.org/techniques/T1567/002) or to [Upload Tool](https://attack.mitre.org/techniques/T1608/002)s. Cloud accounts can also be used in the acquisition of infrastructure, such as [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003)s or [Serverless](https://attack.mitre.org/techniques/T1583/007) infrastructure. Establishing cloud accounts may allow adversaries to develop sophisticated capabilities without managing their own servers.(Citation: Awake Security C2 Cloud) Creating [Cloud Accounts](https://attack.mitre.org/techniques/T1585/003) may also require adversaries to establish [Email Accounts](https://attack.mitre.org/techniques/T1585/002) to register with the cloud provider.
Query: write Sigma for Detects the attempt to create an ActiveScriptEventConsumer via WMIC.EXE. An ActiveScriptEventConsumer is a built-in Wind
Matching passage: Sigma rule: Detects the attempt to create an ActiveScriptEventConsumer via WMIC.EXE. An ActiveScriptEventConsumer is a built-in Wind. Logsource: windows / process_creation. Rule: title: NewActiveScriptEventConsumer Creation Attempt via Wmic.EXE id: ebef4391-1a81-4761-a40a-1db446c0e625 status: test description: 'Detects the attempt to create an ActiveScriptEventConsumer via WMIC.EXE. An ActiveScriptEventConsumer is a built-in Windows Management Instrumentation (WMI) class that automatically executes a predefined script (in VBScript or JScript) whenever a specific system event occurs. Adversaries often abuse ActiveScriptEventConsumer to maintain persistence on a compromised host by executing a malicious script whenever a specific event occurs. ' references: - https://twitter.com/johnlatwc/status/1408062131321270282?s=12 - https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf author: Florian Roth (Nextron Systems) date: 2021-06-25 modified: 2026-06-19 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.003 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: wmic.exe - Image|endswith: \WMIC.exe selection_cli: CommandLine|contains|all: - ActiveScriptEventConsumer - ' CREATE ' condition: all of selection_* falsepositives: - Legitimate software creating script event consumers level: high
Near-miss passage: Sigma rule: Detects suspicious mshta process execution patterns. Logsource: windows / process_creation. Rule: title: Suspicious Mshta.EXE Execution Patterns id: e32f92d1-523e-49c3-9374-bdb13b46a3ba status: test description: Detects suspicious mshta process execution patterns references: - https://en.wikipedia.org/wiki/HTML_Application - https://www.echotrail.io/insights/search/mshta.exe - https://app.any.run/tasks/34221348-072d-4b70-93f3-aa71f6ebecad/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2021-07-17 modified: 2023-02-21 tags: - attack.execution - attack.t1106 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \mshta.exe - OriginalFileName: MSHTA.EXE selection_susp: ParentImage|endswith: - \cmd.exe - \cscript.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe CommandLine|contains: - \AppData\Local\ - C:\ProgramData\ - C:\Users\Public\ - C:\Windows\Temp\ filter_img: - Image|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - CommandLine|contains: - .htm - .hta - CommandLine|endswith: - mshta.exe - mshta condition: all of selection_* or (selection_img and not filter_img) falsepositives: - Unknown level: high