alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of The mcollective-puppet-agent plugin before 1.11.1 for Puppet allows remote attackers to execute arbitrary code via vectors involving the --server argument.
Matching passage: CVE-2015-7331. CWE: CWE-254. CVSS: 6.599999904632568. The mcollective-puppet-agent plugin before 1.11.1 for Puppet allows remote attackers to execute arbitrary code via vectors involving the --server argument.
Near-miss passage: CVE-2015-6762. CWE: CWE-254. CVSS: 7.5. The CSSFontFaceSrcValue::fetch function in core/css/CSSFontFaceSrcValue.cpp in the Cascading Style Sheets (CSS) implementation in Blink, as used in Google Chrome before 46.0.2490.71, does not use the CORS cross-origin request algorithm when a font's URL appears to be a same-origin URL, which allows remote web servers to bypass the Same Origin Policy via a redirect.
Query: SOC alert related to External Defacement
Matching passage: T1491.002 External Defacement. Tactics: impact. Description: An adversary may deface systems external to an organization in an attempt to deliver messaging, intimidate, or otherwise mislead an organization or users. [External Defacement](https://attack.mitre.org/techniques/T1491/002) may ultimately cause users to distrust the systems and to question/discredit the system’s integrity. Externally-facing websites are a common victim of defacement; often targeted by adversary and hacktivist groups in order to push a political message or spread propaganda.(Citation: FireEye Cyber Threats to Media Industries)(Citation: Kevin Mandia Statement to US Senate Committee on Intelligence)(Citation: Anonymous Hackers Deface Russian Govt Site) [External Defacement](https://attack.mitre.org/techniques/T1491/002) may be used as a catalyst to trigger events, or as a response to actions taken by an organization or government. Similarly, website defacement may also be used as setup, or a precursor, for future attacks such as [Drive-by Compromise](https://attack.mitre.org/techniques/T1189).(Citation: Trend Micro Deep Dive Into Defacement)
Near-miss passage: T1491 Defacement. Tactics: impact. Description: Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content. Reasons for [Defacement](https://attack.mitre.org/techniques/T1491) include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion. Disturbing or offensive images may be used as a part of [Defacement](https://attack.mitre.org/techniques/T1491) in order to cause user discomfort, or to pressure compliance with accompanying messages.
Query: risk of The Host Guest File System (HGFS) in VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.5, and VMware Fusion 6.x before 6.0.5 and 7.x before 7.0.1 allows guest OS 
Matching passage: CVE-2015-1043. CWE: CWE-20. CVSS: 3.299999952316284. The Host Guest File System (HGFS) in VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.5, and VMware Fusion 6.x before 6.0.5 and 7.x before 7.0.1 allows guest OS users to cause a guest OS denial of service via unspecified vectors.
Near-miss passage: CVE-2015-3204. CWE: CWE-20. CVSS: 5.0. libreswan 3.9 through 3.12 allows remote attackers to cause a denial of service (daemon restart) via an IKEv1 packet with (1) unassigned bits set in the IPSEC DOI value or (2) the next payload value set to ISAKMP_NEXT_SAK.
Query: CVE similar to CVE-2015-8804
Matching passage: CVE-2015-8804. CWE: CWE-254. CVSS: 9.800000190734863. x86_64/ecc-384-modp.asm in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-384 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors.
Near-miss passage: CVE-2015-6582. CWE: CWE-254. CVSS: 6.800000190734863. The decompose function in platform/transforms/TransformationMatrix.cpp in Blink, as used in Google Chrome before 45.0.2454.85, does not verify that a matrix inversion succeeded, which allows remote attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted web site.
Query: detection rule: Detects potentially suspicious explicit credential logon events where the user is trying to logon with explicit credenti
Matching passage: Sigma rule: Detects potentially suspicious explicit credential logon events where the user is trying to logon with explicit credenti. Logsource: windows / security. Rule: title: Potentially Suspicious Explicit Credential Local Logon id: e3c6d245-7b8f-4e2a-c17f-a9d0e5b38f62 status: experimental description: 'Detects potentially suspicious explicit credential logon events where the user is trying to logon with explicit credentials (username and password) that are different from the current user context. It might indicate an attacker attempting to escalate privileges after obtaining credentials for a different user account. ' references: - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648 - https://github.com/MSNightmare/LegacyHive author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-07-23 tags: - attack.privilege-escalation - attack.stealth - attack.t1134 - attack.t1134.003 logsource: product: windows service: security detection: selection_eid: EventID: 4648 selection_localhost: - TargetServerName: localhost - TargetInfo: localhost - IpAddress: - 127.0.0.1 - ::1 filter_main_computer_accounts: SubjectUserName|endswith: $ filter_main_system_processes: ProcessName|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ filter_main_program_files: ProcessName|startswith: - C:\Program Files\ - C:\Program Files (x86)\ filter_main_same_user: SubjectUserName|fieldref: TargetUserName condition: all of selection_* and not 1 of filter_main_* falsepositives: - RunAs usage from user-installed applications outside Program Files - Administrative scripts using explicit credentials from non-standard paths level: medium regression_tests_path: regression_data/rules/windows/builtin/security/win_security_explicit_credential_local_logon/info.yml
Near-miss passage: Sigma rule: Detects the extraction of password protected ZIP archives with suspicious file names. See the filename variable for more. Logsource: windows / security. Rule: title: Password Protected ZIP File Opened (Suspicious Filenames) id: 54f0434b-726f-48a1-b2aa-067df14516e4 status: test description: Detects the extraction of password protected ZIP archives with suspicious file names. See the filename variable for more details on which file has been opened. references: - https://twitter.com/sbousseaden/status/1523383197513379841 author: Florian Roth (Nextron Systems) date: 2022-05-09 tags: - attack.command-and-control - attack.stealth - attack.t1027 - attack.t1105 - attack.t1036 logsource: product: windows service: security detection: selection: EventID: 5379 TargetName|contains: Microsoft_Windows_Shell_ZipFolder:filename selection_filename: TargetName|contains: - invoice - new order - rechnung - factura - delivery - purchase - order - payment condition: selection and selection_filename falsepositives: - Legitimate used of encrypted ZIP files level: high
Query: describe CVE-2015-2954
Matching passage: CVE-2015-2954. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to hijack the authentication of arbitrary users.
Near-miss passage: CVE-2015-2940. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the CheckUser extension for MediaWiki allows remote attackers to hijack the authentication of certain users for requests that retrieve sensitive user information via unspecified vectors.
Query: risk of Beckhoff IPC Diagnostics before 1.8 does not properly restrict access to functions in /config, which allows remote attackers to cause a denial of service (reboot or shutdown), crea
Matching passage: CVE-2015-4051. CWE: CWE-284. CVSS: 9.0. Beckhoff IPC Diagnostics before 1.8 does not properly restrict access to functions in /config, which allows remote attackers to cause a denial of service (reboot or shutdown), create arbitrary users, or possibly have unspecified other impact via a crafted request, as demonstrated by a beckhoff.com:service:cxconfig:1#Write SOAP action to /upnpisapi.
Near-miss passage: CVE-2015-2267. CWE: CWE-284. CVSS: 4.0. mdeploy.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to bypass intended access restrictions and extract archives to arbitrary directories via a crafted dataroot value.
Query: Lateral movement indicators for Cloud Service Discovery
Matching passage: T1526 Cloud Service Discovery. Tactics: discovery. Description: An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can include Continuous Integration and Continuous Delivery (CI/CD), Lambda Functions, Entra ID, etc. They may also include security services, such as AWS GuardDuty and Microsoft Defender for Cloud, and logging services, such as AWS CloudTrail and Google Cloud Audit Logs. Adversaries may attempt to discover information about the services enabled throughout the environment. Azure tools and APIs, such as the Microsoft Graph API and Azure Resource Manager API, can enumerate resources and services, including applications, management groups, resources and policy definitions, and their relationships that are accessible by an identity.(Citation: Azure - Resource Manager API)(Citation: Azure AD Graph API) For example, Stormspotter is an open source tool for enumerating and constructing a graph for Azure resources and services, and Pacu is an open source AWS exploitation framework that supports several methods for discovering cloud services.(Citation: Azure - Stormspotter)(Citation: GitHub Pacu) Adversaries may use the information gained to shape follow-on behaviors, such as targeting data or credentials from enumerated services or evading identified defenses through [Disable or Modify Tools](https://attack.mitre.org/techniques/T1685) or [Disable or Modify Cloud Log](https://attack.mitre.org/techniques/T1685/002).
Near-miss passage: T1087.002 Domain Account. Tactics: discovery. Description: Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges. Commands such as <code>net user /domain</code> and <code>net group /domain</code> of the [Net](https://attack.mitre.org/software/S0039) utility, <code>dscacheutil -q group</code> on macOS, and <code>ldapsearch</code> on Linux can list domain users and groups. [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets including <code>Get-ADUser</code> and <code>Get-ADGroupMember</code> may enumerate members of Active Directory groups.(Citation: CrowdStrike StellarParticle January 2022)
Query: describe CVE-2015-8962
Matching passage: CVE-2015-8962. CWE: CWE-415. CVSS: 7.300000190734863. Double free vulnerability in the sg_common_write function in drivers/scsi/sg.c in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (memory corruption and system crash) by detaching a device during an SG_IO ioctl call.
Near-miss passage: CVE-2015-9007. CWE: CWE-415. CVSS: 7.800000190734863. In TrustZone in all Android releases from CAF using the Linux kernel, a Double Free vulnerability could potentially exist.
Query: vulnerability: The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit map feature.
Matching passage: CVE-2015-9308. CWE: CWE-352. CVSS: 8.800000190734863. The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit map feature.
Near-miss passage: CVE-2015-6966. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in Nibbleblog before 4.0.5 allow remote attackers to hijack the authentication of administrators for requests that (1) create a post via a new_simple action to admin.php or (2) conduct cross-site scripting (XSS) attacks via the content parameter in a new_simple action to admin.php.
Query: CVE similar to CVE-2015-3839
Matching passage: CVE-2015-3839. CWE: CWE-476. CVSS: 5.5. The updateMessageStatus function in Android 5.1.1 and earlier allows local users to cause a denial of service (NULL pointer exception and process crash).
Near-miss passage: CVE-2015-9111. CWE: CWE-476. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, and SD 820A, in a QTEE syscall handler, an untrusted pointer dereference can occur.
Query: risk of Philips In.Sight B120/37 has a password of b120root for the backdoor root account, a password of /ADMIN/ for the backdoor admin account, a password of merlin for the backdoor mg350
Matching passage: CVE-2015-2882. CWE: CWE-798. CVSS: 9.800000190734863. Philips In.Sight B120/37 has a password of b120root for the backdoor root account, a password of /ADMIN/ for the backdoor admin account, a password of merlin for the backdoor mg3500 account, a password of M100-4674448 for the backdoor user account, and a password of M100-4674448 for the backdoor admin account.
Near-miss passage: CVE-2015-2887. CWE: CWE-798. CVSS: 9.800000190734863. iBaby M3S has a password of admin for the backdoor admin account.
Query: CVE similar to CVE-2015-9285
Matching passage: CVE-2015-9285. CWE: CWE-79. CVSS: 6.099999904632568. esoTalk 1.0.0g4 has XSS via the PATH_INFO to the conversations/ URI.
Near-miss passage: CVE-2015-9369. CWE: CWE-79. CVSS: 6.099999904632568. Easy US Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Query: Encoded PowerShell / command-line abuse matching Exfiltration Over Symmetric Encrypted Non-C2 Protocol
Matching passage: T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol. Tactics: exfiltration. Description: Adversaries may steal data by exfiltrating it over a symmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Symmetric encryption algorithms are those that use shared or the same keys/secrets on each end of the channel. This requires an exchange or pre-arranged agreement/possession of the value used to encrypt and decrypt data. Network protocols that use asymmetric encryption often utilize symmetric encryption once keys are exchanged, but adversaries may opt to manually share keys and implement symmetric cryptographic algorithms (ex: RC4, AES) vice using mechanisms that are baked into a protocol. This may result in multiple layers of encryption (in protocols that are natively encrypted such as HTTPS) or encryption in protocols that not typically encrypted (such as HTTP or FTP).
Near-miss passage: T1048 Exfiltration Over Alternative Protocol. Tactics: exfiltration. Description: Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel. Adversaries may also opt to encrypt and/or obfuscate these alternate channels. [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048) can be done using various common operating system utilities such as [Net](https://attack.mitre.org/software/S0039)/SMB or FTP.(Citation: Palo Alto OilRig Oct 2016) On macOS and Linux <code>curl</code> may be used to invoke protocols such as HTTP/S or FTP/S to exfiltrate data from a system.(Citation: 20 macOS Common Tools and Techniques) Many IaaS and SaaS platforms (such as Microsoft Exchange, Microsoft SharePoint, GitHub, and AWS S3) support the direct download of files, emails, source code, and other sensitive information via the web console or [Cloud API](https://attack.mitre.org/techniques/T1059/009).
Query: detect Detects a suspicious program execution in Outlook temp folder in logs
Matching passage: Sigma rule: Detects a suspicious program execution in Outlook temp folder. Logsource: windows / process_creation. Rule: title: Suspicious Execution From Outlook Temporary Folder id: a018fdc3-46a3-44e5-9afb-2cd4af1d4b39 status: test description: Detects a suspicious program execution in Outlook temp folder author: Florian Roth (Nextron Systems) references: - Internal Research date: 2019-10-01 modified: 2022-10-09 tags: - attack.initial-access - attack.t1566.001 logsource: category: process_creation product: windows detection: selection: Image|contains: \Temporary Internet Files\Content.Outlook\ condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the use of reg.exe to export registry paths associated with third-party credentials. Credential stealers have be. Logsource: windows / process_creation. Rule: title: Registry Export of Third-Party Credentials id: cc1abf27-78a3-4ac5-a51c-f3070b1d8e40 related: - id: 87a476dc-0079-4583-a985-dee7a20a03de type: similar status: experimental description: 'Detects the use of reg.exe to export registry paths associated with third-party credentials. Credential stealers have been known to use this technique to extract sensitive information from the registry. ' references: - https://www.virustotal.com/gui/file/fdc86a5b3d7df37a72c3272836f743747c47bfbc538f05af9ecf78547fa2e789/behavior author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-05-22 tags: - attack.credential-access - attack.t1552.002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_cli_save: CommandLine|contains: - save - export selection_cli_path: CommandLine|contains: - \Software\Aerofox\Foxmail\V3.1 - \Software\Aerofox\FoxmailPreview - \Software\DownloadManager\Passwords - \Software\FTPWare\COREFTP\Sites - \Software\IncrediMail\Identities - \Software\Martin Prikryl\WinSCP 2\Sessions - \Software\Mobatek\MobaXterm - \Software\OpenSSH\Agent\Keys - \Software\OpenVPN-GUI\configs - \Software\ORL\WinVNC3\Password - \Software\Qualcomm\Eudora\CommandLine - \Software\RealVNC\WinVNC4 - \Software\RimArts\B2\Settings - \Software\SimonTatham\PuTTY\Sessions - \Software\SimonTatham\PuTTY\SshHostKeys - \Software\Sota\FFFTP - \Software\TightVNC\Server - \Software\WOW6432Node\Radmin\v3.0\Server\Parameters\Radmin condition: all of selection_* falsepositives: - Unknown level: high
Query: risk of epan/dissectors/packet-gsm_a_dtap.c in the GSM DTAP dissector in Wireshark 1.12.x before 1.12.6 does not properly validate digit characters, which allows remote attackers to cause 
Matching passage: CVE-2015-4652. CWE: CWE-20. CVSS: 4.300000190734863. epan/dissectors/packet-gsm_a_dtap.c in the GSM DTAP dissector in Wireshark 1.12.x before 1.12.6 does not properly validate digit characters, which allows remote attackers to cause a denial of service (application crash) via a crafted packet, related to the de_emerg_num_list and de_bcd_num functions.
Near-miss passage: CVE-2015-1492. CWE: CWE-20. CVSS: 8.5. Untrusted search path vulnerability in the client in Symantec Endpoint Protection 12.1 before 12.1-RU6-MP1 allows local users to gain privileges via a Trojan horse DLL in a client install package.
Query: CVE similar to CVE-2015-4327
Matching passage: CVE-2015-4327. CWE: CWE-20. CVSS: 7.199999809265137. The CLI in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows local users to obtain root privileges by writing script arguments to an unspecified file, aka Bug ID CSCuv12542.
Near-miss passage: CVE-2015-8678. CWE: CWE-20. CVSS: 5.5. The ION driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230 and Mate S smartphones with software CRR-TL00 before CRR-TL00C01B160SP01, CRR-UL00 before CRR-UL00C00B160, and CRR-CL00 before CRR-CL00C92B161 allows remote attackers to cause a denial of service (crash) via a crafted application.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Windows Test Authoring and Execution Framework (TAEF) framework allows you to run automation by executing tests files wr. Logsource: windows / process_creation. Rule: title: Malicious Windows Script Components File Execution by TAEF Detection id: 634b00d5-ccc3-4a06-ae3b-0ec8444dd51b status: test description: 'Windows Test Authoring and Execution Framework (TAEF) framework allows you to run automation by executing tests files written on different languages (C, C#, Microsoft COM Scripting interfaces Adversaries may execute malicious code (such as WSC file with VBScript, dll and so on) directly by running te.exe ' references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Te/ - https://twitter.com/pabraeken/status/993298228840992768 - https://learn.microsoft.com/en-us/windows-hardware/drivers/taef/ author: Agro (@agro_sev) oscd.community date: 2020-10-13 modified: 2021-11-27 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \te.exe - ParentImage|endswith: \te.exe - OriginalFileName: \te.exe condition: selection falsepositives: - It's not an uncommon to use te.exe directly to execute legal TAEF tests level: low
Near-miss passage: Sigma rule: Detect use of Get-GPO to get one GPO or all the GPOs in a domain.. Logsource: windows / ps_script. Rule: title: Suspicious GPO Discovery With Get-GPO id: eb2fd349-ec67-4caa-9143-d79c7fb34441 status: test description: Detect use of Get-GPO to get one GPO or all the GPOs in a domain. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1615/T1615.md - https://learn.microsoft.com/en-us/powershell/module/grouppolicy/get-gpo?view=windowsserver2022-ps author: frack113 date: 2022-06-04 tags: - attack.discovery - attack.t1615 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: Get-GPO condition: selection falsepositives: - Legitimate PowerShell scripts level: low
Query: exploit Cross-site request forgery (CSRF) vulnerability in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin before 2.8.32 for WordPress allows remote attacker
Matching passage: CVE-2015-1874. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin before 2.8.32 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete all plugin records via a request in the CF7DBPluginSubmissions page to wp-admin/admin.php.
Near-miss passage: CVE-2015-0735. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Cisco Unified Customer Voice Portal (CVP) 10.5(1) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCut93970.