alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-9355
Matching passage: CVE-2015-9355. CWE: CWE-79. CVSS: 6.099999904632568. The two-factor-authentication plugin before 1.1.10 for WordPress has XSS in the admin area.
Near-miss passage: CVE-2015-1629. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "ExchangeDLP Cross Site Scripting Vulnerability."
Query: playbook for alert: EDR alert: possible Masquerade File Type (T1036.008)
Matching passage: Playbook for T1036.008 Masquerade File Type. 1) Validate alert telemetry against T1036.008. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, icon, and contents. Various file types have a typical standard format, including how they are encoded and organized. For example, a file’s signature (also known as header or magic bytes) is the beginning bytes of a file and is often used to ident
Near-miss passage: Playbook for T1036 Masquerading. Different response path focused on stealth.
Query: exploit Multiple integer overflows in the addVorbisCodecInfo function in matroska/MatroskaExtractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allow remote attacke
Matching passage: CVE-2015-3861. CWE: CWE-189. CVSS: 5.0. Multiple integer overflows in the addVorbisCodecInfo function in matroska/MatroskaExtractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allow remote attackers to cause a denial of service (device inoperability) via crafted Matroska data, aka internal bug 21296336.
Near-miss passage: CVE-2015-2191. CWE: CWE-189. CVSS: 5.0. Integer overflow in the dissect_tnef function in epan/dissectors/packet-tnef.c in the TNEF dissector in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted length field in a packet.
Query: common weakness: Improper Handling of Inconsistent Structural Elements
Matching passage: CWE-240 Improper Handling of Inconsistent Structural Elements. The product does not handle or incorrectly handles when two or more structural elements should be consistent, but are not.
Near-miss passage: CWE-921 Storage of Sensitive Data in a Mechanism without Access Control. The product stores sensitive information in a file system or device that does not have built-in access control.
Query: exploit epan/dissectors/packet-websocket.c in the WebSocket dissector in Wireshark 1.12.x before 1.12.5 uses a recursive algorithm, which allows remote attackers to cause a denial of servi
Matching passage: CVE-2015-3810. CWE: CWE-399. CVSS: 7.800000190734863. epan/dissectors/packet-websocket.c in the WebSocket dissector in Wireshark 1.12.x before 1.12.5 uses a recursive algorithm, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted packet.
Near-miss passage: CVE-2015-5332. CWE: CWE-399. CVSS: 6.800000190734863. Atto in Moodle 2.8.x before 2.8.9 and 2.9.x before 2.9.3 allows remote attackers to cause a denial of service (disk consumption) by leveraging the guest role and entering drafts with the editor-autosave feature.
Query: vulnerability: protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.
Matching passage: CVE-2015-5237. CWE: CWE-787. CVSS: 8.800000190734863. protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.
Near-miss passage: CVE-2015-3113. CWE: CWE-787. CVSS: 9.800000190734863. Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in June 2015.
Query: patch priority for CVE-2015-5127
Matching passage: CVE-2015-5127. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5557, CVE-2015-5559, CVE-2015-5561, CVE-2015-5563, CVE-2015-5564, and CVE-2015-5565.
Near-miss passage: CVE-2015-8566. CWE: UNKNOWN. CVSS: 7.5. The Session package 1.x before 1.3.1 for Joomla! Framework allows remote attackers to execute arbitrary code via unspecified session values.
Query: common weakness: Use of Unmaintained Third Party Components
Matching passage: CWE-1104 Use of Unmaintained Third Party Components. The product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy for the original developer.
Near-miss passage: CWE-611 Improper Restriction of XML External Entity Reference. The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Query: risk of Cross-site scripting (XSS) vulnerability in ajax_cmd.php in Xceedium Xsuite 2.4.4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the fileName para
Matching passage: CVE-2015-4665. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in ajax_cmd.php in Xceedium Xsuite 2.4.4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the fileName parameter.
Near-miss passage: CVE-2015-3615. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in Fortinet FortiManager 5.0.x before 5.0.11, 5.2.x before 5.2.2 allows remote authenticated users to inject arbitrary web script or HTML via vectors involving unspecified parameters and a privilege escalation attack.
Query: risk of The ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service (crash) via vectors involving multiple whitespace characters before an
Matching passage: CVE-2015-5523. CWE: CWE-119. CVSS: 4.300000190734863. The ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service (crash) via vectors involving multiple whitespace characters before an empty href, which triggers a large memory allocation.
Near-miss passage: CVE-2015-8455. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, and CVE-2015-8451.
Query: detect setupapi.dll library provide InstallHinfSection function for processing INF files. INF file may contain instructions all in logs
Matching passage: Sigma rule: setupapi.dll library provide InstallHinfSection function for processing INF files. INF file may contain instructions all. Logsource: windows / process_creation. Rule: title: Suspicious Rundll32 Setupapi.dll Activity id: 285b85b1-a555-4095-8652-a8a4106af63f status: test description: setupapi.dll library provide InstallHinfSection function for processing INF files. INF file may contain instructions allowing to create values in the registry, modify files and install drivers. This technique could be used to obtain persistence via modifying one of Run or RunOnce registry keys, run process or use other DLLs chain calls (see references) InstallHinfSection function in setupapi.dll calls runonce.exe executable regardless of actual content of INF file. references: - https://lolbas-project.github.io/lolbas/Libraries/Setupapi/ - https://gist.githubusercontent.com/bohops/0cc6586f205f3691e04a1ebf1806aabd/raw/baf7b29891bb91e76198e30889fbf7d6642e8974/calc_exe.inf - https://raw.githubusercontent.com/huntresslabs/evading-autoruns/master/shady.inf - https://twitter.com/Z3Jpa29z/status/1313742350292746241?s=20 author: Konstantin Grishchenko, oscd.community date: 2020-10-07 modified: 2021-11-27 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection: Image|endswith: \runonce.exe ParentImage|endswith: \rundll32.exe ParentCommandLine|contains|all: - setupapi.dll - InstallHinfSection condition: selection falsepositives: - Scripts and administrative tools that use INF files for driver installation with setupapi.dll level: medium
Near-miss passage: Sigma rule: Detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new fil. Logsource: macos / process_creation. Rule: title: Potential Base64 Decoded From Images id: 09a910bf-f71f-4737-9c40-88880ba5913d status: test description: 'Detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new file with the decoded content. The detected execution is a bash one-liner. ' references: - https://www.virustotal.com/gui/file/16bafdf741e7a13137c489f3c8db1334f171c7cb13b62617d691b0a64783cc48/behavior - https://www.virustotal.com/gui/file/483fafc64a2b84197e1ef6a3f51e443f84dc5742602e08b9e8ec6ad690b34ed0/behavior author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-12-20 tags: - attack.stealth - attack.t1140 logsource: product: macos category: process_creation detection: selection_image: Image|endswith: /bash selection_view: CommandLine|contains|all: - tail - -c selection_b64: CommandLine|contains|all: - base64 - -d - '>' selection_files: CommandLine|contains: - .avif - .gif - .jfif - .jpeg - .jpg - .pjp - .pjpeg - .png - .svg - .webp condition: all of selection_* falsepositives: - Unknown level: high
Query: Sigma rule for Detects requests to exclude files, folders or processes from Antivirus scanning using PowerShell cmdlets
Matching passage: Sigma rule: Detects requests to exclude files, folders or processes from Antivirus scanning using PowerShell cmdlets. Logsource: windows / process_creation. Rule: title: Powershell Defender Exclusion id: 17769c90-230e-488b-a463-e05c08e9d48f related: - id: c1344fa2-323b-4d2e-9176-84b4d4821c88 type: similar status: test description: Detects requests to exclude files, folders or processes from Antivirus scanning using PowerShell cmdlets references: - https://learn.microsoft.com/en-us/defender-endpoint/configure-process-opened-file-exclusions-microsoft-defender-antivirus - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md - https://twitter.com/AdamTheAnalyst/status/1483497517119590403 author: Florian Roth (Nextron Systems) date: 2021-04-29 modified: 2022-05-12 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection1: CommandLine|contains: - 'Add-MpPreference ' - 'Set-MpPreference ' selection2: CommandLine|contains: - ' -ExclusionPath ' - ' -ExclusionExtension ' - ' -ExclusionProcess ' - ' -ExclusionIpAddress ' condition: all of selection* falsepositives: - Possible Admin Activity - Other Cmdlets that may use the same parameters level: medium
Near-miss passage: Sigma rule: Detects the creation of a office macro file from a a suspicious process. Logsource: windows / file_event. Rule: title: Office Macro File Creation From Suspicious Process id: b1c50487-1967-4315-a026-6491686d860e status: test description: Detects the creation of a office macro file from a a suspicious process references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1566.001/T1566.001.md - https://learn.microsoft.com/en-us/deployoffice/compat/office-file-format-reference author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2022-01-23 modified: 2023-02-22 tags: - attack.initial-access - attack.t1566.001 logsource: category: file_event product: windows definition: 'Requirements: The "ParentImage" field is not available by default on EID 11 of Sysmon logs. To be able to use this rule to the full extent you need to enriche the log with additional ParentImage data' detection: selection_cmd: - Image|endswith: - \cscript.exe - \mshta.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe - ParentImage|endswith: - \cscript.exe - \mshta.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe selection_ext: TargetFilename|endswith: - .docm - .dotm - .xlsm - .xltm - .potm - .pptm condition: all of selection_* falsepositives: - Unknown level: high
Query: describe CVE-2015-1660
Matching passage: CVE-2015-1660. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-0040. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0018, CVE-2015-0037, and CVE-2015-0066.
Query: vulnerability: The SPDY/2 codec in Facebook Proxygen before 2015-11-09 allows remote attackers to conduct hijacking attacks and bypass ACL checks via a crafted host value.
Matching passage: CVE-2015-7263. CWE: CWE-284. CVSS: 7.5. The SPDY/2 codec in Facebook Proxygen before 2015-11-09 allows remote attackers to conduct hijacking attacks and bypass ACL checks via a crafted host value.
Near-miss passage: CVE-2015-1854. CWE: CWE-284. CVSS: 7.5. 389 Directory Server before 1.3.3.10 allows attackers to bypass intended access restrictions and modify directory entries via a crafted ldapmodrdn call.
Query: describe CVE-2015-7310
Matching passage: CVE-2015-7310. CWE: CWE-78. CVSS: 6.5. McAfee Enterprise Security Manager (ESM), Enterprise Security Manager/Log Manager (ESMLM), and Enterprise Security Manager/Receiver (ESMREC) before 9.3.2MR18, 9.4.x before 9.4.2MR8, and 9.5.x before 9.5.0MR7 allow remote authenticated users to execute arbitrary OS commands via a crafted filename, which is not properly handled when downloading the file.
Near-miss passage: CVE-2015-2279. CWE: CWE-78. CVSS: 9.800000190734863. cgi_test.cgi in AirLive BU-2015 with firmware 1.03.18, BU-3026 with firmware 1.43, and MD-3025 with firmware 1.81 allows remote attackers to execute arbitrary OS commands via shell metacharacters after an "&" (ampersand) in the write_mac write_pid, write_msn, write_tan, or write_hdv parameter.
Query: Sigma YAML for windows / file_event
Matching passage: Sigma rule: Detects the creation of a file with a suspicious extension in the public folder, which could indicate potential maliciou. Logsource: windows / file_event. Rule: title: Suspicious Binaries and Scripts in Public Folder id: b447f7de-1e53-4cbf-bfb4-f1f6d0b04e4e status: experimental description: Detects the creation of a file with a suspicious extension in the public folder, which could indicate potential malicious activity. references: - https://intel.thedfirreport.com/events/view/30032 - https://intel.thedfirreport.com/eventReports/view/70 - https://thedfirreport.com/2025/01/27/cobalt-strike-and-a-pair-of-socks-lead-to-lockbit-ransomware/ author: The DFIR Report date: 2025-01-23 tags: - attack.execution - attack.t1204 logsource: category: file_event product: windows detection: selection: TargetFilename|contains: :\Users\Public\ TargetFilename|endswith: - .bat - .dll - .exe - .hta - .js - .ps1 - .vbe - .vbs condition: selection falsepositives: - Administrators deploying legitimate binaries to public folders. level: high regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_public_folder_extension/info.yml
Near-miss passage: Sigma rule: Detects suspicious processes based on name and location that access the windows credential manager and vault. Which can. Logsource: windows / file_access. Rule: title: Credential Manager Access By Uncommon Applications id: 407aecb1-e762-4acf-8c7b-d087bcff3bb6 status: test description: 'Detects suspicious processes based on name and location that access the windows credential manager and vault. Which can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::cred" function ' references: - https://hunter2.gitbook.io/darthsidious/privilege-escalation/mimikatz - https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-11 modified: 2026-07-28 tags: - attack.t1003 - attack.credential-access logsource: category: file_access product: windows definition: 'Requirements: Microsoft-Windows-Kernel-File ETW provider' detection: selection: FileName|contains: - \AppData\Local\Microsoft\Credentials\ - \AppData\Roaming\Microsoft\Credentials\ - \AppData\Local\Microsoft\Vault\ - \ProgramData\Microsoft\Vault\ filter_main_system_folders: Image|startswith: - C:\Program Files\ - C:\Program Files (x86)\ - C:\Windows\system32\ - C:\Windows\SysWOW64\ filter_main_explorer: Image: C:\Windows\explorer.exe condition: selection and not 1 of filter_main_* falsepositives: - Legitimate software installed by the users for example in the "AppData" directory may access these files (for any reason). level: medium
Query: playbook for alert: Suspicious Indicator Removal execution detected on endpoint
Matching passage: Playbook for T1070 Indicator Removal. 1) Validate alert telemetry against T1070. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may selectively delete or modify artifacts generated to reduce indications of their presence and blend in with legitimate activity. Rather than broadly removing evidence, adversaries may target specific artifacts that appear anomalous or are likely to draw scrutiny, while leaving sufficient data intact to maintain the appearance of normal system behavior. Artifacts such as command hist
Near-miss passage: Playbook for T1070.004 File Deletion. Different response path focused on stealth.
Query: describe CVE-2015-9118
Matching passage: CVE-2015-9118. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9615, MDM9625, MDM9635M, SD 400, SD 410/12, SD 615/16/SD 415, SD 800, SD 808, and SD 810, in ADSP's QDI Root-PD driver, untrusted arguments from User PD may cause integer overflow resulting in buffer overflow.
Near-miss passage: CVE-2015-5779. CWE: CWE-119. CVSS: 7.5. QuickTime 7 in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted file, a different vulnerability than CVE-2015-3765, CVE-2015-3779, CVE-2015-3788, CVE-2015-3789, CVE-2015-3790, CVE-2015-3791, CVE-2015-3792, CVE-2015-5751, and CVE-2015-5753.
Query: CVE similar to CVE-2015-0777
Matching passage: CVE-2015-0777. CWE: CWE-200. CVSS: 2.0999999046325684. drivers/xen/usbback/usbback.c in linux-2.6.18-xen-3.4.0 (aka the Xen 3.4.x support patches for the Linux kernel 2.6.18), as used in the Linux kernel 2.6.x and 3.x in SUSE Linux distributions, allows guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory via unspecified vectors.
Near-miss passage: CVE-2015-5340. CWE: CWE-200. CVSS: 4.300000190734863. Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not consider the moodle/badges:viewbadges capability, which allows remote authenticated users to obtain sensitive badge information via a request involving (1) badges/overview.php or (2) badges/view.php.
Query: exfiltration using Exfiltration Over Webhook
Matching passage: T1567.004 Exfiltration Over Webhook. Tactics: exfiltration. Description: Adversaries may exfiltrate data to a webhook endpoint rather than over their primary command and control channel. Webhooks are simple mechanisms for allowing a server to push data over HTTP/S to a client without the need for the client to continuously poll the server.(Citation: RedHat Webhooks) Many public and commercial services, such as Discord, Slack, and `webhook.site`, support the creation of webhook endpoints that can be used by other services, such as Github, Jira, or Trello.(Citation: Discord Intro to Webhooks) When changes happen in the linked services (such as pushing a repository update or modifying a ticket), these services will automatically post the data to the webhook endpoint for use by the consuming application. Adversaries may link an adversary-owned environment to a victim-owned SaaS service to achieve repeated [Automated Exfiltration](https://attack.mitre.org/techniques/T1020) of emails, chat messages, and other data.(Citation: Push Security SaaS Attacks Repository Webhooks) Alternatively, instead of linking the webhook endpoint to a service, an adversary can manually post staged data directly to the URL in order to exfiltrate it.(Citation: Microsoft SQL Server) Access to webhook endpoints is often over HTTPS, which gives the adversary an additional level of protection. Exfiltration leveraging webhooks can also blend in with normal network traffic if the webhook endpoint points to a commonly used SaaS application or collaboration service.(Citation: CyberArk Labs Discord)(Citation: Talos Discord Webhook Abuse)(Citation: Checkmarx Webhooks)
Near-miss passage: T1567.001 Exfiltration to Code Repository. Tactics: exfiltration. Description: Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel. Code repositories are often accessible via an API (ex: https://api.github.com). Access to these APIs are often over HTTPS, which gives the adversary an additional level of protection. Exfiltration to a code repository can also provide a significant amount of cover to the adversary if it is a popular service already used by hosts within the network.
Query: risk of Unspecified vulnerability in the Oracle Applications DBA component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.2, 12.2.3, and 12.2.4 allows remote authenticated user
Matching passage: CVE-2015-0393. CWE: UNKNOWN. CVSS: 6.0. Unspecified vulnerability in the Oracle Applications DBA component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.2, 12.2.3, and 12.2.4 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to DB Privileges. NOTE: the previous information is from the January 2015 CPU. Oracle has not commented on the researcher's claim that the PUBLIC role is granted the INDEX privilege for the DUAL table during a "seeded install," which allows remote authenticated users to gain SYSDBA privileges and execute arbitrary code.
Near-miss passage: CVE-2015-7924. CWE: UNKNOWN. CVSS: 8.800000190734863. eWON devices with firmware before 10.1s0 do not trigger the discarding of browser session data in response to a log-off action, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.