alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: patch priority for CVE-2015-8915
Matching passage: CVE-2015-8915. CWE: CWE-125. CVSS: 5.5. bsdcpio in libarchive before 3.2.0 allows remote attackers to cause a denial of service (invalid read and crash) via crafted cpio file.
Near-miss passage: CVE-2015-8397. CWE: CWE-125. CVSS: 8.199999809265137. The JPEGLSCodec::DecodeExtent function in MediaStorageAndFileFormat/gdcmJPEGLSCodec.cxx in Grassroots DICOM (aka GDCM) before 2.6.2 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (application crash) via an embedded JPEG-LS image with dimensions larger than the selected region in a (1) two-dimensional or (2) three-dimensional DICOM image file, which triggers an out-of-bounds read.
Query: exploit CoreMedia Playback in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary code or cause a denial of serv
Matching passage: CVE-2015-7075. CWE: CWE-119. CVSS: 6.800000190734863. CoreMedia Playback in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a malformed media file.
Near-miss passage: CVE-2015-7182. CWE: CWE-119. CVSS: 9.800000190734863. Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OCTET STRING data.
Query: write Sigma for Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells
Matching passage: Sigma rule: Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells. Logsource: windows / process_creation. Rule: title: Chopper Webshell Process Pattern id: fa3c117a-bc0d-416e-a31b-0c0e80653efb status: test description: Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells references: - https://www.microsoft.com/security/blog/2022/09/30/analyzing-attacks-using-the-exchange-vulnerabilities-cve-2022-41040-and-cve-2022-41082/ author: Florian Roth (Nextron Systems), MSTI (query) date: 2022-10-01 tags: - attack.persistence - attack.discovery - attack.t1505.003 - attack.t1018 - attack.t1033 - attack.t1087 logsource: category: process_creation product: windows detection: selection_origin: - Image|endswith: \w3wp.exe - ParentImage|endswith: \w3wp.exe selection_cmdline: CommandLine|contains: - '&ipconfig&echo' - '&quser&echo' - '&whoami&echo' - '&c:&echo' - '&cd&echo' - '&dir&echo' - '&echo [E]' - '&echo [S]' condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: A General detection for files being created in the Windows startup directory. This could be an indicator of persistence.. Logsource: windows / file_event. Rule: title: Startup Folder File Write id: 2aa0a6b4-a865-495b-ab51-c28249537b75 related: - id: 28208707-fe31-437f-9a7f-4b1108b94d2e type: similar status: test description: A General detection for files being created in the Windows startup directory. This could be an indicator of persistence. references: - https://github.com/OTRF/detection-hackathon-apt29/issues/12 - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/5.B.1_611FCA99-97D0-4873-9E51-1C1BA2DBB40D.md author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-05-02 modified: 2025-12-03 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: product: windows category: file_event detection: selection: TargetFilename|contains: \Microsoft\Windows\Start Menu\Programs\StartUp filter_main_update: - Image: - C:\Windows\System32\wuauclt.exe - C:\Windows\uus\ARM64\wuaucltcore.exe - TargetFilename|startswith: - C:\$WINDOWS.~BT\NewOS\ - C:\$WinREAgent\Scratch\Mount\ filter_optional_onenote: Image|endswith: \ONENOTE.EXE TargetFilename|endswith: \Send to OneNote.lnk condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - FP could be caused by legitimate application writing shortcuts for example. This folder should always be inspected to make sure that all the files in there are legitimate level: medium
Query: describe CVE-2015-4502
Matching passage: CVE-2015-4502. CWE: CWE-254. CVSS: 4.300000190734863. js/src/proxy/Proxy.cpp in Mozilla Firefox before 41.0 mishandles certain receiver arguments, which allows remote attackers to bypass intended window access restrictions via a crafted web site.
Near-miss passage: CVE-2015-8801. CWE: CWE-254. CVSS: 2.9000000953674316. Race condition in the client in Symantec Endpoint Protection (SEP) 12.1 before RU6 MP5 allows local users to bypass intended restrictions on USB file transfer by conducting filesystem operations before the SEP device manager recognizes a new USB device.
Query: explain T1061 Graphical User Interface
Matching passage: T1061 Graphical User Interface. Tactics: execution. Description: **This technique has been deprecated. Please use [Remote Services](https://attack.mitre.org/techniques/T1021) where appropriate.** The Graphical User Interfaces (GUI) is a common way to interact with an operating system. Adversaries may use a system's GUI during an operation, commonly through a remote interactive session such as [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1076), instead of through a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), to search for information and execute files via mouse double-click events, the Windows Run command (Citation: Wikipedia Run Command), or other potentially difficult to monitor interactions.
Near-miss passage: T1059.011 Lua. Tactics: execution. Description: Adversaries may abuse Lua commands and scripts for execution. Lua is a cross-platform scripting and programming language primarily designed for embedded use in applications. Lua can be executed on the command-line (through the stand-alone lua interpreter), via scripts (<code>.lua</code>), or from Lua-embedded programs (through the <code>struct lua_State</code>).(Citation: Lua main page)(Citation: Lua state) Lua scripts may be executed by adversaries for malicious purposes. Adversaries may incorporate, abuse, or replace existing Lua interpreters to allow for malicious Lua command execution at runtime.(Citation: PoetRat Lua)(Citation: Lua Proofpoint Sunseed)(Citation: Cyphort EvilBunny)(Citation: Kaspersky Lua)
Query: EDR alert: possible Credential API Hooking (T1056.004)
Matching passage: T1056.004 Credential API Hooking. Tactics: collection, credential access. Description: Adversaries may hook into Windows application programming interface (API) functions and Linux system functions to collect user credentials. Malicious hooking mechanisms may capture API or function calls that include parameters that reveal user authentication credentials.(Citation: Microsoft TrojanSpy:Win32/Ursnif.gen!I Sept 2017) Unlike [Keylogging](https://attack.mitre.org/techniques/T1056/001), this technique focuses specifically on API functions that include parameters that reveal user credentials. In Windows, hooking involves redirecting calls to these functions and can be implemented via: * **Hooks procedures**, which intercept and execute designated code in response to events such as messages, keystrokes, and mouse inputs.(Citation: Microsoft Hook Overview)(Citation: Elastic Process Injection July 2017) * **Import address table (IAT) hooking**, which use modifications to a process’s IAT, where pointers to imported API functions are stored.(Citation: Elastic Process Injection July 2017)(Citation: Adlice Software IAT Hooks Oct 2014)(Citation: MWRInfoSecurity Dynamic Hooking 2015) * **Inline hooking**, which overwrites the first bytes in an API function to redirect code flow.(Citation: Elastic Process Injection July 2017)(Citation: HighTech Bridge Inline Hooking Sept 2011)(Citation: MWRInfoSecurity Dynamic Hooking 2015) In Linux and macOS, adversaries may hook into system functions via the `LD_PRELOAD` (Linux) or `DYLD_INSERT_LIBRARIES` (macOS) environment variables, which enables loading shared libraries into a program’s address space. For example, an adversary may capture credentials by hooking into the `libc read` function leveraged by SSH or SCP.(Citation: Intezer Symbiote 2022)
Near-miss passage: T1056 Input Capture. Tactics: collection, credential access. Description: Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. [Credential API Hooking](https://attack.mitre.org/techniques/T1056/004)) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. [Web Portal Capture](https://attack.mitre.org/techniques/T1056/003)).
Query: CVE similar to CVE-2015-3154
Matching passage: CVE-2015-3154. CWE: CWE-74. CVSS: 6.099999904632568. CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.
Near-miss passage: CVE-2015-0169. CWE: CWE-74. CVSS: 4.0. IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows remote authenticated users to inject arguments via unspecified vectors.
Query: exploit Cross-site scripting (XSS) vulnerability in the Message Log in the Email Security Gateway in Websense TRITON AP-EMAIL before 8.0.0 and V-Series 7.7 appliances allows remote attacke
Matching passage: CVE-2015-2702. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Message Log in the Email Security Gateway in Websense TRITON AP-EMAIL before 8.0.0 and V-Series 7.7 appliances allows remote attackers to inject arbitrary web script or HTML via the sender address in an email.
Near-miss passage: CVE-2015-2992. CWE: CWE-79. CVSS: 6.099999904632568. Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability.
Query: risk of Cisco IOS 12.2, 12.4, 15.0, 15.2, and 15.3 allows remote attackers to cause a denial of service (device reload) via malformed Common Industrial Protocol (CIP) TCP packets, aka Bug 
Matching passage: CVE-2015-0649. CWE: CWE-20. CVSS: 7.800000190734863. Cisco IOS 12.2, 12.4, 15.0, 15.2, and 15.3 allows remote attackers to cause a denial of service (device reload) via malformed Common Industrial Protocol (CIP) TCP packets, aka Bug ID CSCun63514.
Near-miss passage: CVE-2015-2140. CWE: CWE-20. CVSS: 6.5. HP Systems Insight Manager (SIM) before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors.
Query: vulnerability: IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.9 IFIX002, and 7.6.0 before 7.6.0.3 IFIX001; Maximo Asset Management 7.5.0 before 7.5.0.9 IFIX002, 7.5.1, and 7
Matching passage: CVE-2015-7487. CWE: CWE-200. CVSS: 4.099999904632568. IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.9 IFIX002, and 7.6.0 before 7.6.0.3 IFIX001; Maximo Asset Management 7.5.0 before 7.5.0.9 IFIX002, 7.5.1, and 7.6.0 before 7.6.0.3 IFIX001 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products allow local users to obtain sensitive information by leveraging administrative privileges and reading log files.
Near-miss passage: CVE-2015-6404. CWE: CWE-200. CVSS: 4.0. Cisco Hosted Collaboration Mediation Fulfillment 10.6(3) does not use RBAC, which allows remote authenticated users to obtain sensitive credential information by leveraging admin access and making SOAP API requests, aka Bug ID CSCuw84374.
Query: describe CVE-2015-6349
Matching passage: CVE-2015-6349. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the web interface in the Solution Engine in Cisco Secure Access Control Server (ACS) 5.7(0.15) allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-0696. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the login page in Cisco TC Software before 7.1.0 on Cisco TelePresence Collaboration Desk and Room Endpoints devices allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCuq94977.
Query: SOC alert related to Remote Access Hardware
Matching passage: T1219.003 Remote Access Hardware. Tactics: command and control. Description: An adversary may use legitimate remote access hardware to establish an interactive command and control channel to target systems within networks. These services, including IP-based keyboard, video, or mouse (KVM) devices such as TinyPilot and PiKVM, are commonly used as legitimate tools and may be allowed by peripheral device policies within a target environment. Remote access hardware may be physically installed and used post-compromise as an alternate communications channel for redundant access or as a way to establish an interactive remote session with the target system. Using hardware-based remote access tools may allow threat actors to bypass software security solutions and gain more control over the compromised device(s).(Citation: Palo Alto Unit 42 North Korean IT Workers 2024)(Citation: Google Cloud Threat Intelligence DPRK IT Workers 2024)
Near-miss passage: T1219.001 IDE Tunneling. Tactics: command and control. Description: Adversaries may abuse Integrated Development Environment (IDE) software with remote development features to establish an interactive command and control channel on target systems within a network. IDE tunneling combines SSH, port forwarding, file sharing, and debugging into a single secure connection, letting developers work on remote systems as if they were local. Unlike SSH and port forwarding, IDE tunneling encapsulates an entire session and may use proprietary tunneling protocols alongside SSH, allowing adversaries to blend in with legitimate development workflows. Some IDEs, like Visual Studio Code, also provide CLI tools (e.g., `code tunnel`) that adversaries may use to programmatically establish tunnels and generate web-accessible URLs for remote access. These tunnels can be authenticated through accounts such as GitHub, enabling the adversary to control the compromised system via a legitimate developer portal.(Citation: sentinelone operationDigitalEye Dec 2024)(Citation: Unit42 Chinese VSCode 06 September 2024)(Citation: Thornton tutorial VSCode shell September 2023) Additionally, adversaries may use IDE tunneling for persistence. Some IDEs, such as Visual Studio Code and JetBrains, support automatic reconnection. Adversaries may configure the IDE to auto-launch at startup, re-establishing the tunnel upon execution. Compromised developer machines may also be exploited as jump hosts to move further into the network. IDE tunneling tools may be built-in or installed as [IDE Extensions](https://attack.mitre.org/techniques/T1176/002).
Query: patch priority for CVE-2015-8481
Matching passage: CVE-2015-8481. CWE: CWE-200. CVSS: 3.0999999046325684. Atlassian JIRA Software 7.0.3, JIRA Core 7.0.3, and the bundled JIRA Service Desk 3.0.3 installer attaches the wrong image to e-mail notifications when a user views an issue with inline wiki markup referencing an image attachment, which might allow remote attackers to obtain sensitive information by updating a different issue that includes wiki markup for an external image reference.
Near-miss passage: CVE-2015-2018. CWE: CWE-200. CVSS: 3.5. IBM Integration Bus 9 and 10 before 10.0.0.1 and WebSphere Message Broker 7 before 7.0.0.8 and 8 before 8.0.0.7 do not ensure that the correct security profile is selected, which allows remote authenticated users to obtain sensitive information via unspecified vectors.
Query: CVE similar to CVE-2015-3176
Matching passage: CVE-2015-3176. CWE: CWE-200. CVSS: 4.300000190734863. The account-confirmation feature in login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote attackers to obtain sensitive full-name information by attempting to self-register.
Near-miss passage: CVE-2015-3251. CWE: CWE-200. CVSS: 4.900000095367432. Apache CloudStack before 4.5.2 might allow remote authenticated administrators to obtain sensitive password information for root accounts of virtual machines via unspecified vectors related to API calls.
Query: patch priority for CVE-2015-7390
Matching passage: CVE-2015-7390. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in TestLink before 1.9.14 allows remote attackers to execute arbitrary SQL commands via the apikey parameter to lnl.php.
Near-miss passage: CVE-2015-1467. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in Translations in Fork CMS before 3.8.6 allow remote authenticated users to execute arbitrary SQL commands via the (1) language[] or (2) type[] parameter to private/en/locale/index.
Query: alert when Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. This can be used by attackers to e
Matching passage: Sigma rule: Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. This can be used by attackers to e. Logsource: windows / file_event. Rule: title: ADExplorer Writing Complete AD Snapshot Into .dat File id: 0a1255c5-d732-4b62-ac02-b5152d34fb83 related: - id: 9212f354-7775-4e28-9c9f-8f0a4544e664 type: similar status: experimental description: Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field. references: - https://learn.microsoft.com/de-de/sysinternals/downloads/adexplorer - https://github.com/c3c/ADExplorerSnapshot.py/tree/f700904defac330802bbfedd1d8ffd9248f4ee24 - https://www.packetlabs.net/posts/scattered-spider-is-a-young-ransomware-gang-exploiting-large-corporations/ - https://www.nccgroup.com/us/research-blog/lapsus-recent-techniques-tactics-and-procedures/ - https://trustedsec.com/blog/adexplorer-on-engagements author: Arnim Rupp (Nextron Systems), Thomas Patzke date: 2025-07-09 tags: - attack.discovery - attack.t1087.002 - attack.t1069.002 - attack.t1482 logsource: category: file_event product: windows detection: selection: Image|endswith: - \ADExp.exe - \ADExplorer.exe - \ADExplorer64.exe - \ADExplorer64a.exe TargetFilename|endswith: .dat condition: selection falsepositives: - Legitimate use of ADExplorer by administrators creating .dat snapshots level: medium
Near-miss passage: Sigma rule: Detects local user creation on Windows servers, which shouldn't happen in an Active Directory environment. Apply this Si. Logsource: windows / security. Rule: title: Local User Creation id: 66b6be3d-55d0-4f47-9855-d69df21740ea status: test description: 'Detects local user creation on Windows servers, which shouldn''t happen in an Active Directory environment. Apply this Sigma Use Case on your Windows server logs and not on your DC logs. ' references: - https://patrick-bareiss.com/detecting-local-user-creation-in-ad-with-sigma/ author: Patrick Bareiss date: 2019-04-18 modified: 2021-01-17 tags: - attack.persistence - attack.t1136.001 logsource: product: windows service: security detection: selection: EventID: 4720 condition: selection falsepositives: - Domain Controller Logs - Local accounts managed by privileged account management tools level: low
Query: patch priority for CVE-2015-2444
Matching passage: CVE-2015-2444. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2442.
Near-miss passage: CVE-2015-0555. CWE: CWE-119. CVSS: 6.800000190734863. Buffer overflow in the XnsSdkDeviceIpInstaller.ocx ActiveX control in Samsung iPOLiS Device Manager 1.12.2 allows remote attackers to execute arbitrary code via a long string in the first argument to the (1) ReadConfigValue or (2) WriteConfigValue function.
Query: risk of Buffer overflow in the gethostbyname_r and other unspecified NSS functions in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denia
Matching passage: CVE-2015-1781. CWE: CWE-119. CVSS: 6.800000190734863. Buffer overflow in the gethostbyname_r and other unspecified NSS functions in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response, which triggers a call with a misaligned buffer.
Near-miss passage: CVE-2015-7860. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in the agent in Persistent Accelerite Radia Client Automation (formerly HP Client Automation), possibly before 9.1, allows remote attackers to execute arbitrary code by sending a large amount of data in an environment that lacks relationship-based firewalling.
Query: risk of SQL injection vulnerability in ticket.php in TickFa 1.x allows remote authenticated users to execute arbitrary SQL commands via the tid parameter in a read action.
Matching passage: CVE-2015-4676. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in ticket.php in TickFa 1.x allows remote authenticated users to execute arbitrary SQL commands via the tid parameter in a read action.
Near-miss passage: CVE-2015-6331. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the web framework in Cisco Prime Collaboration Assurance 10.5(1) allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCus39887.