alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-8681
Matching passage: CVE-2015-8681. CWE: CWE-284. CVSS: 7.800000190734863. The ovisp driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230, and Mate S smartphones with software CRR-TL00 before CRR-TL00C01B160SP01, CRR-UL00 before CRR-UL00C00B160, and CRR-CL00 before CRR-CL00C92B161 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application with the camera permission, aka an "interface access control vulnerability."
Near-miss passage: CVE-2015-3657. CWE: CWE-284. CVSS: 7.199999809265137. Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated lower-level administrators to gain "Super Admin" privileges via unspecified vectors.
Query: detection rule: Detects when an adversary is trying to hide it's action from Sysmon logging based on error messages
Matching passage: Sigma rule: Detects when an adversary is trying to hide it's action from Sysmon logging based on error messages. Logsource: windows / sysmon_error. Rule: title: Sysmon Configuration Error id: 815cd91b-7dbc-4247-841a-d7dd1392b0a8 status: test description: Detects when an adversary is trying to hide it's action from Sysmon logging based on error messages references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md - https://talesfrominfosec.blogspot.com/2017/12/killing-sysmon-silently.html author: frack113 date: 2021-06-04 modified: 2026-07-23 tags: - attack.stealth - attack.t1564 logsource: product: windows category: sysmon_error detection: selection_error: Description|contains: - Failed to open service configuration with error - Failed to connect to the driver to update configuration filter_generic_english: Description|contains|all: - Failed to open service configuration with error - 'Last error: The media is write protected.' filter_generic_french: Description|contains|all: - Failed to open service configuration with error - 'Last error: Média protégé en écriture.' filter_by_errorcode: Description|contains: - Failed to open service configuration with error 19 - Failed to open service configuration with error 93 condition: selection_error and not 1 of filter* falsepositives: - Legitimate administrative action level: high
Near-miss passage: Sigma rule: Detects the execution of WMIC to query information on a remote system. Logsource: windows / process_creation. Rule: title: WMIC Remote Command Execution id: 7773b877-5abb-4a3e-b9c9-fd0369b59b00 related: - id: e42af9df-d90b-4306-b7fb-05c863847ebd type: obsolete - id: 09af397b-c5eb-4811-b2bb-08b3de464ebf type: obsolete status: test description: Detects the execution of WMIC to query information on a remote system references: - https://securelist.com/moonbounce-the-dark-side-of-uefi-firmware/105468/ - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-02-14 modified: 2025-10-22 tags: - attack.execution - attack.t1047 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \WMIC.exe - OriginalFileName: wmic.exe selection_cli: CommandLine|contains|windash: '/node:' filter_main_localhost: CommandLine|contains: - localhost - 127.0.0.1 condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: medium simulation: - type: atomic-red-team name: WMI Execute Remote Process technique: T1047 atomic_guid: 9c8ef159-c666-472f-9874-90c8d60d136b regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_remote_execution/info.yml
Query: Sigma rule for Detects when a EFS Fileshare is modified or deleted. You can't delete a file system that is in use. If the file system h
Matching passage: Sigma rule: Detects when a EFS Fileshare is modified or deleted. You can't delete a file system that is in use. If the file system h. Logsource: aws / cloudtrail. Rule: title: AWS EFS Fileshare Modified or Deleted id: 25cb1ba1-8a19-4a23-a198-d252664c8cef status: test description: 'Detects when a EFS Fileshare is modified or deleted. You can''t delete a file system that is in use. If the file system has any mount targets, the adversary must first delete them, so deletion of a mount will occur before deletion of a fileshare. ' references: - https://docs.aws.amazon.com/efs/latest/ug/API_DeleteFileSystem.html author: Austin Songer @austinsonger date: 2021-08-15 modified: 2022-10-09 tags: - attack.impact logsource: product: aws service: cloudtrail detection: selection: eventSource: elasticfilesystem.amazonaws.com eventName: DeleteFileSystem condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the creation of the PROCEXP152.sys file in the application-data local temporary folder. This driver is used by S. Logsource: windows / file_event. Rule: title: Suspicious PROCEXP152.sys File Created In TMP id: 3da70954-0f2c-4103-adff-b7440368f50e status: test description: 'Detects the creation of the PROCEXP152.sys file in the application-data local temporary folder. This driver is used by Sysinternals Process Explorer but also by KDU (https://github.com/hfiref0x/KDU) or Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs), which uses KDU. ' references: - https://web.archive.org/web/20230331181619/https://blog.dylan.codes/evading-sysmon-and-windows-event-logging/ author: xknow (@xknow_infosec), xorxes (@xor_xes) date: 2019-04-08 modified: 2026-06-29 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: file_event detection: selection: TargetFilename|contains: \AppData\Local\Temp\ TargetFilename|endswith: PROCEXP152.sys filter: Image|contains: - \procexp64.exe - \procexp64a.exe - \procexp.exe - \procmon64.exe - \procmon64a.exe - \procmon.exe condition: selection and not filter falsepositives: - Other legimate tools using this driver and filename (like Sysinternals). Note - Clever attackers may easily bypass this detection by just renaming the driver filename. Therefore just Medium-level and don't rely on it. level: medium
Query: patch priority for CVE-2015-5843
Matching passage: CVE-2015-5843. CWE: CWE-119. CVSS: 7.199999809265137. IOMobileFrameBuffer in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
Near-miss passage: CVE-2015-7017. CWE: CWE-119. CVSS: 7.5. CoreText in Apple iOS before 9.1, OS X before 10.11.1, and iTunes before 12.3.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6975 and CVE-2015-6992.
Query: detection rule: Detects the execution of a binary from the Linux shared memory directory /dev/shm. This directory is a tmpfs mount backe
Matching passage: Sigma rule: Detects the execution of a binary from the Linux shared memory directory /dev/shm. This directory is a tmpfs mount backe. Logsource: linux / process_creation. Rule: title: Process Execution From Shared Memory Directory id: 5cd16c8f-44a6-4654-81e7-a84d6db507d4 status: experimental description: 'Detects the execution of a binary from the Linux shared memory directory /dev/shm. This directory is a tmpfs mount backed entirely by RAM and is abused by attackers for fileless malware staging because files written there never touch physical disk and may evade disk-based detection. ' references: - https://www.sysdig.com/blog/containers-read-only-fileless-malware - https://unfinished.bike/fun-with-the-new-bpfdoor-2023 - https://asiapacificdefencereporter.com/wp-content/uploads/2023/08/Final-CRWD-2023-Threat-Hunting-Report.pdf - https://www.crowdstrike.com/en-us/blog/how-to-hunt-for-decisivearchitect-and-justforfun-implant/ - https://www.linkedin.com/posts/avradeep_malware-apt-infostealer-activity-7373203959697719296-JR-7 - https://www.stormshield.com/news/orbit-analysis-of-a-linux-dedicated-malware/ author: Stan Beukers date: 2026-06-20 tags: - attack.stealth - attack.execution - attack.t1027.011 logsource: category: process_creation product: linux detection: selection: Image|startswith: /dev/shm/ condition: selection falsepositives: - Unlikely in production environments; some container runtimes or IPC frameworks may use /dev/shm for inter-process communication but should not spawn executables. level: high
Near-miss passage: Sigma rule: Detects sign-in with properties that are unfamiliar to the user. The detection considers past sign-in history to look fo. Logsource: azure / riskdetection. Rule: title: Unfamiliar Sign-In Properties id: 128faeef-79dd-44ca-b43c-a9e236a60f49 status: test description: Detects sign-in with properties that are unfamiliar to the user. The detection considers past sign-in history to look for anomalous sign-ins. references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#unfamiliar-sign-in-properties - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-03 tags: - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation - attack.initial-access logsource: product: azure service: riskdetection detection: selection: riskEventType: unfamiliarFeatures condition: selection falsepositives: - User changing to a new device, location, browser, etc. level: high
Query: threat report mentioning Access Token Manipulation
Matching passage: T1134 Access Token Manipulation. Tactics: stealth, privilege escalation. Description: Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token. An adversary can use built-in Windows API functions to copy access tokens from existing processes; this is known as token stealing. These token can then be applied to an existing process (i.e. [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001)) or used to spawn a new process (i.e. [Create Process with Token](https://attack.mitre.org/techniques/T1134/002)). An adversary must already be in a privileged user context (i.e. administrator) to steal a token. However, adversaries commonly use token stealing to elevate their security context from the administrator level to the SYSTEM level. An adversary can then use a token to authenticate to a remote system as the account for that token if the account has appropriate permissions on the remote system.(Citation: Pentestlab Token Manipulation) Any standard user can use the <code>runas</code> command, and the Windows API functions, to create impersonation tokens; it does not require access to an administrator account. There are also other mechanisms, such as Active Directory fields, that can be used to modify access tokens.
Near-miss passage: T1134.003 Make and Impersonate Token. Tactics: stealth, privilege escalation. Description: Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls. For example, if an adversary has a username and password but the user is not logged onto the system the adversary can then create a logon session for the user using the `LogonUser` function.(Citation: LogonUserW function) The function will return a copy of the new session's access token and the adversary can use `SetThreadToken` to assign the token to a thread. This behavior is distinct from [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) in that this refers to creating a new user token instead of stealing or duplicating an existing one.
Query: patch priority for CVE-2015-10110
Matching passage: CVE-2015-10110. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability classified as problematic was found in ruddernation TinyChat Room Spy Plugin up to 1.2.8 on WordPress. This vulnerability affects the function wp_show_room_spy of the file room-spy.php. The manipulation of the argument room leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.2.9 is able to address this issue. The name of the patch is ab72627a963d61fb3bc31018e3855b08dc94a979. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230392.
Near-miss passage: CVE-2015-0216. CWE: CWE-79. CVSS: 3.5. access.php in the Lesson module in Moodle 2.8.x before 2.8.2 does not set the RISK_XSS bit for graders, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted essay feedback.
Query: exploit Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before
Matching passage: CVE-2015-3123. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3117, CVE-2015-3130, CVE-2015-3133, CVE-2015-3134, and CVE-2015-4431.
Near-miss passage: CVE-2015-3734. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in the uDesign (aka U-Design) theme 2.3.0 before 2.7.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via a 
Matching passage: CVE-2015-7357. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the uDesign (aka U-Design) theme 2.3.0 before 2.7.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via a fragment identifier, as demonstrated by #<svg onload=alert(1)>.
Near-miss passage: CVE-2015-2344. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in VMware vRealize Automation 6.x before 6.2.4 on Linux allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Query: risk of IOHIDFamily in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 allows physically proximate attackers to execute arbitrary code or cause a denial of service
Matching passage: CVE-2015-1095. CWE: UNKNOWN. CVSS: 7.199999809265137. IOHIDFamily in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 allows physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted HID device.
Near-miss passage: CVE-2015-8044. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, and CVE-2015-8046.
Query: explain T1071.002 File Transfer Protocols
Matching passage: T1071.002 File Transfer Protocols. Tactics: command and control. Description: Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as SMB(Citation: US-CERT TA18-074A), FTP(Citation: ESET Machete July 2019), FTPS, and TFTP that transfer files may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the transferred files. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.
Near-miss passage: T1071 Application Layer Protocol. Tactics: command and control. Description: Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.(Citation: Mandiant APT29 Eye Spy Email Nov 22)
Query: Lateral movement indicators for Web Portal Capture
Matching passage: T1056.003 Web Portal Capture. Tactics: collection, credential access. Description: Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service. This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through [External Remote Services](https://attack.mitre.org/techniques/T1133) and [Valid Accounts](https://attack.mitre.org/techniques/T1078) or as part of the initial compromise by exploitation of the externally facing web service.(Citation: Volexity Virtual Private Keylogging)
Near-miss passage: T1056.001 Keylogging. Tactics: collection, credential access. Description: Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.(Citation: Talos Kimsuky Nov 2021) Keylogging is the most prevalent type of input capture, with many different ways of intercepting keystrokes.(Citation: Adventures of a Keystroke) Some methods include: * Hooking API callbacks used for processing keystrokes. Unlike [Credential API Hooking](https://attack.mitre.org/techniques/T1056/004), this focuses solely on API functions intended for processing keystroke data. * Reading raw keystroke data from the hardware buffer. * Windows Registry modifications. * Custom drivers. * [Modify System Image](https://attack.mitre.org/techniques/T1601) may provide adversaries with hooks into the operating system of network devices to read raw keystrokes for login sessions.(Citation: Cisco Blog Legacy Device Attacks)
Query: CVE similar to CVE-2015-6375
Matching passage: CVE-2015-6375. CWE: CWE-200. CVSS: 2.0999999046325684. The debug-logging (aka debug cns) feature in Cisco Networking Services (CNS) for IOS 15.2(2)E3 allows local users to obtain sensitive information by reading an unspecified file, aka Bug ID CSCux18010.
Near-miss passage: CVE-2015-5340. CWE: CWE-200. CVSS: 4.300000190734863. Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not consider the moodle/badges:viewbadges capability, which allows remote authenticated users to obtain sensitive badge information via a request involving (1) badges/overview.php or (2) badges/view.php.
Query: patch priority for CVE-2015-6329
Matching passage: CVE-2015-6329. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in Cisco Prime Collaboration Provisioning 10.6 and 11.0 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCut64074.
Near-miss passage: CVE-2015-0540. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the xAdmin interface in EMC Document Sciences xPression 4.2 before P44 and 4.5 SP1 before P03 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Query: describe CVE-2015-0493
Matching passage: CVE-2015-0493. CWE: UNKNOWN. CVSS: 1.5. Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.4.1, 8.5.0, and 8.5.1 allows local users to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2015-0474.
Near-miss passage: CVE-2015-8322. CWE: UNKNOWN. CVSS: 8.800000190734863. NetApp OnCommand System Manager 8.3.x before 8.3.2 allows remote authenticated users to execute arbitrary code via unspecified vectors.
Query: describe CVE-2015-2069
Matching passage: CVE-2015-2069. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.11 for WordPress allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING in the wc-reports page to wp-admin/admin.php.
Near-miss passage: CVE-2015-10117. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability, which was classified as problematic, was found in Gravity Forms DPS PxPay Plugin up to 1.4.2 on WordPress. Affected is an unknown function. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.4.3 is able to address this issue. The name of the patch is 5966a5e6343e3d5610bdfa126a5cfbae95e629b6. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230664.
Query: vulnerability: The deref_parseCtrl function in servers/slapd/overlays/deref.c in OpenLDAP 2.4.13 through 2.4.40 allows remote attackers to cause a denial of service (NULL pointer dereference and 
Matching passage: CVE-2015-1545. CWE: UNKNOWN. CVSS: 5.0. The deref_parseCtrl function in servers/slapd/overlays/deref.c in OpenLDAP 2.4.13 through 2.4.40 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an empty attribute list in a deref control in a search request.
Near-miss passage: CVE-2015-2600. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in the Siebel Core - Server OM Svcs component in Oracle Siebel CRM 8.1.1, 8.2.2, and 15.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Security.