alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: patch priority for CVE-2015-8313
Matching passage: CVE-2015-8313. CWE: CWE-203. CVSS: 5.900000095367432. GnuTLS incorrectly validates the first byte of padding in CBC modes
Near-miss passage: CVE-2015-0837. CWE: CWE-203. CVSS: 5.900000095367432. The mpi_powm function in Libgcrypt before 1.6.3 and GnuPG before 1.4.19 allows attackers to obtain sensitive information by leveraging timing differences when accessing a pre-computed table during modular exponentiation, related to a "Last-Level Cache Side-Channel Attack."
Query: describe CVE-2015-6309
Matching passage: CVE-2015-6309. CWE: CWE-399. CVSS: 6.800000190734863. Cisco Email Security Appliance (ESA) 8.5.6-106 and 9.6.0-042 allows remote authenticated users to cause a denial of service (file-descriptor consumption and device reload) via crafted HTTP requests, aka Bug ID CSCuw32211.
Near-miss passage: CVE-2015-0586. CWE: CWE-399. CVSS: 7.800000190734863. The Network-Based Application Recognition (NBAR) protocol implementation in Cisco IOS 15.3(100)M and earlier on Cisco 2900 Integrated Services Router (aka Cisco Internet Router) devices allows remote attackers to cause a denial of service (NBAR process hang) via IPv4 packets, aka Bug ID CSCuo73682.
Query: SOC runbook when seeing Encoded PowerShell / command-line abuse matching Botnet
Matching passage: Playbook for T1584.005 Botnet. 1) Validate alert telemetry against T1584.005. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: resource development. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may compromise numerous third-party systems to form a botnet that can be used during targeting. A botnet is a network of compromised systems that can be instructed to perform coordinated tasks.(Citation: Norton Botnet) Instead of purchasing/renting a botnet from a booter/stresser service, adversaries may build their own botnet by compromising numerous third-party systems.(Citation: Imp
Near-miss passage: Playbook for T1584.001 Domains. Different response path focused on resource development.
Query: Persistence mechanism resembling Hypervisor
Matching passage: T1062 Hypervisor. Tactics: persistence. Description: **This technique has been deprecated and should no longer be used.** A type-1 hypervisor is a software layer that sits between the guest operating systems and system's hardware. (Citation: Wikipedia Hypervisor) It presents a virtual running environment to an operating system. An example of a common hypervisor is Xen. (Citation: Wikipedia Xen) A type-1 hypervisor operates at a level below the operating system and could be designed with [Rootkit](https://attack.mitre.org/techniques/T1014) functionality to hide its existence from the guest operating system. (Citation: Myers 2007) A malicious hypervisor of this nature could be used to persist on systems through interruption.
Near-miss passage: T1098.006 Additional Container Cluster Roles. Tactics: persistence, privilege escalation. Description: An adversary may add additional roles or permissions to an adversary-controlled user or service account to maintain persistent access to a container orchestration system. For example, an adversary with sufficient permissions may create a RoleBinding or a ClusterRoleBinding to bind a Role or ClusterRole to a Kubernetes account.(Citation: Kubernetes RBAC)(Citation: Aquasec Kubernetes Attack 2023) Where attribute-based access control (ABAC) is in use, an adversary with sufficient permissions may modify a Kubernetes ABAC policy to give the target account additional permissions.(Citation: Kuberentes ABAC) This account modification may immediately follow [Create Account](https://attack.mitre.org/techniques/T1136) or other malicious account activity. Adversaries may also modify existing [Valid Accounts](https://attack.mitre.org/techniques/T1078) that they have compromised. Note that where container orchestration systems are deployed in cloud environments, as with Google Kubernetes Engine, Amazon Elastic Kubernetes Service, and Azure Kubernetes Service, cloud-based role-based access control (RBAC) assignments or ABAC policies can often be used in place of or in addition to local permission assignments.(Citation: Google Cloud Kubernetes IAM)(Citation: AWS EKS IAM Roles for Service Accounts)(Citation: Microsoft Azure Kubernetes Service Service Accounts) In these cases, this technique may be used in conjunction with [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003).
Query: exploit MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 uses the thumbnail ImageMagick command line argument, which allows remote attackers to obtain the installat
Matching passage: CVE-2015-8005. CWE: CWE-200. CVSS: 5.0. MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 uses the thumbnail ImageMagick command line argument, which allows remote attackers to obtain the installation path by reading the metadata of a PNG thumbnail file.
Near-miss passage: CVE-2015-0673. CWE: CWE-200. CVSS: 4.0. Cisco Mobility Services Engine (MSE) 8.0(110.0) allows remote authenticated users to discover the passwords of arbitrary users by (1) reading log files or (2) using an unspecified GUI feature, aka Bug ID CSCut24792.
Query: CVE similar to CVE-2015-6978
Matching passage: CVE-2015-6978. CWE: CWE-119. CVSS: 6.800000190734863. FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976, CVE-2015-6977, CVE-2015-6990, CVE-2015-6991, CVE-2015-6993, CVE-2015-7008, CVE-2015-7009, CVE-2015-7010, and CVE-2015-7018.
Near-miss passage: CVE-2015-6069. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6081.
Query: risk of The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the St
Matching passage: CVE-2015-8749. CWE: CWE-200. CVSS: 5.900000095367432. The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.
Near-miss passage: CVE-2015-4216. CWE: CWE-200. CVSS: 5.0. The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and Security Management Virtual Appliance (SMAv) devices before 2015-06-25 uses the same default SSH root authorized key across different customers' installations, which makes it easier for remote attackers to bypass authentication by leveraging knowledge of a private key from another installation, aka Bug IDs CSCuu95988, CSCuu95994, and CSCuu96630.
Query: risk of Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to bypass intended calendar-viewing restrictions via unspecified vectors, a different vulnerability than CVE-20
Matching passage: CVE-2015-8484. CWE: CWE-264. CVSS: 5.400000095367432. Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to bypass intended calendar-viewing restrictions via unspecified vectors, a different vulnerability than CVE-2015-8485, CVE-2015-8486, and CVE-2016-1152.
Near-miss passage: CVE-2015-5498. CWE: CWE-264. CVSS: 5.0. The Shipwire API module 7.x-1.x before 7.x-1.03 for Drupal does not check the view permission for the shipments overview (admin/shipwire/shipments), which allows remote attackers to obtain sensitive information via a request to the page.
Query: detection rule: Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several
Matching passage: Sigma rule: Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several. Logsource: windows / ps_script. Rule: title: Enumerate Credentials from Windows Credential Manager With PowerShell id: 603c6630-5225-49c1-8047-26c964553e0e status: test description: 'Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555/T1555.md author: frack113 date: 2021-12-20 modified: 2022-12-25 tags: - attack.credential-access - attack.t1555 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_cmd: ScriptBlockText|contains|all: - vaultcmd - '/listcreds:' selection_option: ScriptBlockText|contains: - Windows Credentials - Web Credentials condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePo. Logsource: linux / process_creation. Rule: title: PUA - TruffleHog Execution - Linux id: d7a650c4-226c-451e-948f-cc490db506aa related: - id: 44030449-b0df-4c94-aae1-502359ab28ee type: similar status: experimental description: 'Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously. While it is a legitimate tool, intended for use in CI pipelines and security assessments, It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information. ' references: - https://github.com/trufflesecurity/trufflehog - https://www.getsafety.com/blog-posts/shai-hulud-npm-attack author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-09-24 tags: - attack.discovery - attack.credential-access - attack.t1083 - attack.t1552.001 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: /trufflehog selection_cli_platform: CommandLine|contains: - ' docker --image ' - ' Git ' - ' GitHub ' - ' Jira ' - ' Slack ' - ' Confluence ' - ' SharePoint ' - ' s3 ' - ' gcs ' selection_cli_verified: CommandLine|contains: ' --results=verified' condition: selection_img or all of selection_cli_* falsepositives: - Legitimate use of TruffleHog by security teams or developers. level: medium
Query: describe CVE-2015-1496
Matching passage: CVE-2015-1496. CWE: CWE-264. CVSS: 7.199999809265137. Motorola Scanner SDK uses weak permissions for (1) CoreScanner.exe, (2) rsmdriverproviderservice.exe, and (3) ScannerService.exe, which allows local users to gain privileges via unspecified vectors.
Near-miss passage: CVE-2015-9015. CWE: CWE-264. CVSS: 7.800000190734863. An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36714120.
Query: Encoded PowerShell / command-line abuse matching AS-REP Roasting
Matching passage: T1558.004 AS-REP Roasting. Tactics: credential access. Description: Adversaries may reveal credentials of accounts that have disabled Kerberos preauthentication by [Password Cracking](https://attack.mitre.org/techniques/T1110/002) Kerberos messages.(Citation: Harmj0y Roasting AS-REPs Jan 2017) Preauthentication offers protection against offline [Password Cracking](https://attack.mitre.org/techniques/T1110/002). When enabled, a user requesting access to a resource initiates communication with the Domain Controller (DC) by sending an Authentication Server Request (AS-REQ) message with a timestamp that is encrypted with the hash of their password. If and only if the DC is able to successfully decrypt the timestamp with the hash of the user’s password, it will then send an Authentication Server Response (AS-REP) message that contains the Ticket Granting Ticket (TGT) to the user. Part of the AS-REP message is signed with the user’s password.(Citation: Microsoft Kerberos Preauth 2014) For each account found without preauthentication, an adversary may send an AS-REQ message without the encrypted timestamp and receive an AS-REP message with TGT data which may be encrypted with an insecure algorithm such as RC4. The recovered encrypted data may be vulnerable to offline [Password Cracking](https://attack.mitre.org/techniques/T1110/002) attacks similarly to [Kerberoasting](https://attack.mitre.org/techniques/T1558/003) and expose plaintext credentials. (Citation: Harmj0y Roasting AS-REPs Jan 2017)(Citation: Stealthbits Cracking AS-REP Roasting Jun 2019) An account registered to a domain, with or without special privileges, can be abused to list all domain accounts that have preauthentication disabled by utilizing Windows tools like [PowerShell](https://attack.mitre.org/techniques/T1059/001) with an LDAP filter. Alternatively, the adversary may send an AS-REQ message for each user. If the DC responds without errors, the account does not require preauthentication and the AS-REP message will already contain the encrypted data. (Citation: Harmj0y
Near-miss passage: T1558 Steal or Forge Kerberos Tickets. Tactics: credential access. Description: Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003). Kerberos is an authentication protocol widely used in modern Windows domain environments. In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC).(Citation: ADSecurity Kerberos Ring Decoder) Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated. The KDC is responsible for both authentication and ticket granting. Adversaries may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access. On Windows, the built-in <code>klist</code> utility can be used to list and analyze cached Kerberos tickets.(Citation: Microsoft Klist)
Query: risk of Remote Desktop Session Host (RDSH) in Remote Desktop Protocol (RDP) through 8.1 in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Window
Matching passage: CVE-2015-2472. CWE: CWE-20. CVSS: 4.300000190734863. Remote Desktop Session Host (RDSH) in Remote Desktop Protocol (RDP) through 8.1 in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly verify certificates, which allows man-in-the-middle attackers to spoof clients via a crafted certificate with valid Issuer and Serial Number fields, aka "Remote Desktop Session Host Spoofing Vulnerability."
Near-miss passage: CVE-2015-5074. CWE: CWE-20. CVSS: 7.5. Incomplete blacklist vulnerability in the FileUploadsFilter class in protected/components/filters/FileUploadsFilter.php in X2Engine X2CRM before 5.0.9 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a .pht extension.
Query: CVE similar to CVE-2015-2675
Matching passage: CVE-2015-2675. CWE: CWE-119. CVSS: 7.5. The OAuth implementation in librest before 0.7.93 incorrectly truncates the pointer returned by the rest_proxy_call_get_url function, which allows remote attackers to cause a denial of service (application crash) via running the EnsureCredentials method from the org.gnome.OnlineAccounts.Account interface on an object representing a Flickr account.
Near-miss passage: CVE-2015-8388. CWE: CWE-119. CVSS: 7.5. PCRE before 8.38 mishandles the /(?=di(?<=(?1))|(?=(.))))/ pattern and related patterns with an unmatched closing parenthesis, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
Query: patch priority for CVE-2015-2803
Matching passage: CVE-2015-2803. CWE: CWE-89. CVSS: 6.0. SQL injection vulnerability in mod1/index.php in the Akronymmanager (sb_akronymmanager) extension before 7.0.0 for TYPO3 allows remote authenticated users with permission to maintain acronyms to execute arbitrary SQL commands via the id parameter.
Near-miss passage: CVE-2015-0894. CWE: CWE-89. CVSS: 6.0. SQL injection vulnerability in the All In One WP Security & Firewall plugin before 3.8.8 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Query: CVE similar to CVE-2015-8139
Matching passage: CVE-2015-8139. CWE: CWE-284. CVSS: 5.300000190734863. ntpq in NTP before 4.2.8p7 allows remote attackers to obtain origin timestamps and then impersonate peers via unspecified vectors.
Near-miss passage: CVE-2015-0755. CWE: CWE-284. CVSS: 6.800000190734863. The Posture module for Cisco Identity Services Engine (ISE), as distributed in Cisco AnyConnect Secure Mobility Client 4.0(64), allows local users to gain privileges via unspecified commands, aka Bug ID CSCut05797.
Query: secure coding against Improper Preservation of Permissions
Matching passage: CWE-281 Improper Preservation of Permissions. The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
Near-miss passage: CWE-1052 Excessive Use of Hard-Coded Literals in Initialization. The product initializes a data element using a hard-coded literal that is not a simple integer or static constant element.
Query: Sigma YAML for macos / process_creation
Matching passage: Sigma rule: Detects potential execution of MeshAgent which is a tool used for remote access. Historical data shows that threat actor. Logsource: macos / process_creation. Rule: title: Remote Access Tool - Potential MeshAgent Execution - MacOS id: 22c45af6-f590-4d44-bab3-b5b2d2a2b6d9 related: - id: 2fbbe9ff-0afc-470b-bdc0-592198339968 type: similar status: experimental description: 'Detects potential execution of MeshAgent which is a tool used for remote access. Historical data shows that threat actors rename MeshAgent binary to evade detection. Matching command lines with the ''--meshServiceName'' argument can indicate that the MeshAgent is being used for remote access. ' references: - https://www.huntress.com/blog/know-thy-enemy-a-novel-november-case-on-persistent-remote-access - https://thecyberexpress.com/ukraine-hit-by-meshagent-malware-campaign/ - https://wazuh.com/blog/how-to-detect-meshagent-with-wazuh/ - https://www.security.com/threat-intelligence/medusa-ransomware-attacks author: Norbert Jaśniewicz (AlphaSOC) date: 2025-05-19 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: macos detection: selection: CommandLine|contains: --meshServiceName condition: selection falsepositives: - Environments that legitimately use MeshAgent level: medium
Near-miss passage: Sigma rule: Detects the execution GMER tool based on image and hash fields.. Logsource: windows / process_creation. Rule: title: HackTool - GMER Rootkit Detector and Remover Execution id: 9082ff1f-88ab-4678-a3cc-5bcff99fc74d status: test description: Detects the execution GMER tool based on image and hash fields. references: - http://www.gmer.net/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-05 modified: 2024-11-23 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \gmer.exe selection_sysmon_hash: Hashes|contains: - MD5=E9DC058440D321AA17D0600B3CA0AB04 - SHA1=539C228B6B332F5AA523E5CE358C16647D8BBE57 - SHA256=E8A3E804A96C716A3E9B69195DB6FFB0D33E2433AF871E4D4E1EAB3097237173 condition: 1 of selection_* falsepositives: - Unlikely level: high
Query: patch priority for CVE-2015-0390
Matching passage: CVE-2015-0390. CWE: UNKNOWN. CVSS: 6.800000190734863. Unspecified vulnerability in the MICROS Retail component in Oracle Retail Applications Xstore: 3.2.1, 3.4.2, 3.5.0, 4.0.1, 4.5.1, 4.8.0, 5.0.3, 5.5.3, 6.0.6, and 6.5.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Xstore Point of Sale.
Near-miss passage: CVE-2015-0365. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Siebel Core - Server Infrastructure component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Security.
Query: CVE similar to CVE-2015-4355
Matching passage: CVE-2015-4355. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Watchdog Aggregator module for Drupal allows remote attackers to hijack the authentication of administrators for requests that enable or disable monitoring sites via unspecified vectors.
Near-miss passage: CVE-2015-3946. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in Advantech WebAccess before 8.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Query: patch priority for CVE-2015-0637
Matching passage: CVE-2015-0637. CWE: CWE-20. CVSS: 7.800000190734863. The Autonomic Networking Infrastructure (ANI) implementation in Cisco IOS 12.2, 12.4, 15.0, 15.2, 15.3, and 15.4 and IOS XE 3.10.xS through 3.13.xS before 3.13.1S allows remote attackers to cause a denial of service (device reload) via spoofed AN messages, aka Bug ID CSCup62315.
Near-miss passage: CVE-2015-9108. CWE: CWE-20. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, and SD 820A, no address argument validation performed on calls to a QSEE syscall may lead to arbitrary read/write or NULL Pointer exception when calling a downstream function.