alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: SOC alert related to Scan Databases
Matching passage: T1596.005 Scan Databases. Tactics: reconnaissance. Description: Adversaries may search within public scan databases for information about victims that can be used during targeting. Various online services continuously publish the results of Internet scans/surveys, often harvesting information such as active IP addresses, hostnames, open ports, certificates, and even server banners.(Citation: Shodan) Adversaries may search scan databases to gather actionable information. Threat actors can use online resources and lookup tools to harvest information from these services. Adversaries may seek information about their already identified targets, or use these datasets to discover opportunities for successful breaches. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)).
Near-miss passage: T1596.003 Digital Certificates. Tactics: reconnaissance. Description: Adversaries may search public digital certificate data for information about victims that can be used during targeting. Digital certificates are issued by a certificate authority (CA) in order to cryptographically verify the origin of signed content. These certificates, such as those used for encrypted web traffic (HTTPS SSL/TLS communications), contain information about the registered organization such as name and location. Adversaries may search digital certificate data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about certificates.(Citation: SSLShopper Lookup) Digital certificate data may also be available from artifacts signed by the organization (ex: certificates used from encrypted web traffic are served with content).(Citation: Medium SSL Cert) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
Query: secure coding against Unquoted Search Path or Element
Matching passage: CWE-428 Unquoted Search Path or Element. The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.
Near-miss passage: CWE-666 Operation on Resource in Wrong Phase of Lifetime. The product performs an operation on a resource at the wrong phase of the resource's lifecycle, which can lead to unexpected behaviors.
Query: CVE similar to CVE-2015-4860
Matching passage: CVE-2015-4860. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI, a different vulnerability than CVE-2015-4883.
Near-miss passage: CVE-2015-1210. CWE: UNKNOWN. CVSS: 5.0. The V8ThrowException::createDOMException function in bindings/core/v8/V8ThrowException.cpp in the V8 bindings in Blink, as used in Google Chrome before 40.0.2214.111 on Windows, OS X, and Linux and before 40.0.2214.109 on Android, does not properly consider frame access restrictions during the throwing of an exception, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
Query: patch priority for CVE-2015-6703
Matching passage: CVE-2015-6703. CWE: CWE-772. CVSS: 4.300000190734863. The loadFlashMovie function in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to obtain sensitive information from process memory via invalid arguments, a different vulnerability than CVE-2015-6697, CVE-2015-6699, CVE-2015-6700, CVE-2015-6701, CVE-2015-6702, and CVE-2015-6704.
Near-miss passage: CVE-2015-6701. CWE: CWE-772. CVSS: 4.300000190734863. The ambientIlluminationColor property implementation in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to obtain sensitive information from process memory via a function call, a different vulnerability than CVE-2015-6697, CVE-2015-6699, CVE-2015-6700, CVE-2015-6702, CVE-2015-6703, and CVE-2015-6704.
Query: Sigma rule for Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary contro
Matching passage: Sigma rule: Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary contro. Logsource: windows / process_creation. Rule: title: Root Certificate Installed From Susp Locations id: 5f6a601c-2ecb-498b-9c33-660362323afa status: test description: Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. references: - https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/ - https://learn.microsoft.com/en-us/powershell/module/pki/import-certificate?view=windowsserver2022-ps author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-09 modified: 2023-01-16 tags: - attack.defense-impairment - attack.t1553.004 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - Import-Certificate - ' -FilePath ' - Cert:\LocalMachine\Root CommandLine|contains: - \AppData\Local\Temp\ - :\Windows\TEMP\ - \Desktop\ - \Downloads\ - \Perflogs\ - :\Users\Public\ condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects PowerShell calling a credential prompt. Logsource: windows / ps_script. Rule: title: PowerShell Credential Prompt id: ca8b77a9-d499-4095-b793-5d5f330d450e status: test description: Detects PowerShell calling a credential prompt references: - https://twitter.com/JohnLaTwC/status/850381440629981184 - https://t.co/ezOTGy1a1G author: John Lambert (idea), Florian Roth (Nextron Systems) date: 2017-04-09 modified: 2022-12-25 tags: - attack.credential-access - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: PromptForCredential condition: selection falsepositives: - Unknown level: high
Query: risk of Directory traversal vulnerability in the WifiHs20UtilityService on the Samsung S6 Edge LRX22G.G925VVRU1AOE2 allows remote attackers to overwrite or create arbitrary files as the sy
Matching passage: CVE-2015-7888. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in the WifiHs20UtilityService on the Samsung S6 Edge LRX22G.G925VVRU1AOE2 allows remote attackers to overwrite or create arbitrary files as the system-level user via a .. (dot dot) in the name of a file, compressed into a zipped file named cred.zip, and downloaded to /sdcard/Download.
Near-miss passage: CVE-2015-4670. CWE: CWE-22. CVSS: 6.400000095367432. Directory traversal vulnerability in the AjaxFileUpload control in DevExpress AJAX Control Toolkit (aka AjaxControlToolkit) before 15.1 allows remote attackers to write to arbitrary files via a .. (dot dot) in the fileId parameter to AjaxFileUploadHandler.axd.
Query: patch priority for CVE-2015-8676
Matching passage: CVE-2015-8676. CWE: CWE-119. CVSS: 7.5. Memory leak in Huawei S5300EI, S5300SI, S5310HI, S6300EI/ S2350EI, and S5300LI Campus series switches with software V200R001C00 before V200R001SPH018, V200R002C00 before V200R003SPH011, and V200R003C00 before V200R003SPH011; S9300, S7700, and S9700 Campus series switches with software V200R001C00 before V200R001SPH023, V200R002C00 before V200R003SPH011, and V200R003C00 before V200R003SPH011; and S2300 and S3300 Campus series switches with software V100R006C05 before V100R006SPH022 allows remote attackers to cause a denial of service (memory consumption and reboot) via a large number of ICMPv6 packets.
Near-miss passage: CVE-2015-3669. CWE: CWE-119. CVSS: 6.800000190734863. QT Media Foundation in Apple QuickTime before 7.7.7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, a different vulnerability than CVE-2015-3664 and CVE-2015-3665.
Query: describe CVE-2015-2661
Matching passage: CVE-2015-2661. CWE: UNKNOWN. CVSS: 2.0999999046325684. Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows local users to affect availability via unknown vectors related to Client.
Near-miss passage: CVE-2015-4885. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 12.1.0.4 allows remote attackers to affect confidentiality via vectors related to Agent Next Gen.
Query: vulnerability: Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated administrators to write to arbitrary files within the underlying operating s
Matching passage: CVE-2015-3653. CWE: CWE-284. CVSS: 7.199999809265137. Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated administrators to write to arbitrary files within the underlying operating system and consequently cause a denial of service or gain privileges by leveraging incorrect permission checking.
Near-miss passage: CVE-2015-3644. CWE: CWE-284. CVSS: 5.800000190734863. Stunnel 5.00 through 5.13, when using the redirect option, does not redirect client connections to the expected server after the initial connection, which allows remote attackers to bypass authentication.
Query: CVE similar to CVE-2015-2952
Matching passage: CVE-2015-2952. CWE: CWE-284. CVSS: 6.5. The user-information management functionality in Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote authenticated users to bypass intended access restrictions and modify administrative credentials via unspecified vectors, a different vulnerability than CVE-2015-2953 and CVE-2015-2958.
Near-miss passage: CVE-2015-1937. CWE: CWE-284. CVSS: 7.5. IBM PowerVC 1.2.0.x through 1.2.0.4, 1.2.1.x through 1.2.1.2, and 1.2.2.x through 1.2.2.2 does not require authentication for the ceilometer NoSQL database, which allows remote attackers to read or write to arbitrary database records, and consequently obtain administrator privileges, via a session on port 27017.
Query: exploit The SMB module in Cisco Wide Area Application Services (WAAS) 6.0(1) allows remote attackers to cause a denial of service (module reload) via an invalid field in a Negotiate Protoc
Matching passage: CVE-2015-0730. CWE: CWE-20. CVSS: 5.0. The SMB module in Cisco Wide Area Application Services (WAAS) 6.0(1) allows remote attackers to cause a denial of service (module reload) via an invalid field in a Negotiate Protocol request, aka Bug ID CSCuo75645.
Near-miss passage: CVE-2015-8218. CWE: CWE-20. CVSS: 6.800000190734863. The decode_uncompressed function in libavcodec/faxcompr.c in FFmpeg before 2.8.2 does not validate uncompressed runs, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted CCITT FAX data.
Query: detection rule: Detects the execution of whoami that has been renamed to a different name to avoid detection
Matching passage: Sigma rule: Detects the execution of whoami that has been renamed to a different name to avoid detection. Logsource: windows / process_creation. Rule: title: Renamed Whoami Execution id: f1086bf7-a0c4-4a37-9102-01e573caf4a0 status: test description: Detects the execution of whoami that has been renamed to a different name to avoid detection references: - https://brica.de/alerts/alert/public/1247926/agent-tesla-keylogger-delivered-inside-a-power-iso-daa-archive/ - https://app.any.run/tasks/7eaba74e-c1ea-400f-9c17-5e30eee89906/ author: Florian Roth (Nextron Systems) date: 2021-08-12 modified: 2022-10-09 tags: - attack.discovery - attack.t1033 - car.2016-03-001 logsource: category: process_creation product: windows detection: selection: OriginalFileName: whoami.exe filter: Image|endswith: \whoami.exe condition: selection and not filter falsepositives: - Unknown level: critical
Near-miss passage: Sigma rule: Detects suspicious Speech Runtime Binary Execution by monitoring its child processes. Child processes spawned by SpeechR. Logsource: windows / process_creation. Rule: title: Suspicious Speech Runtime Binary Child Process id: 78f10490-f2f4-4d19-a75b-4e0683bf3b8d status: experimental description: 'Detects suspicious Speech Runtime Binary Execution by monitoring its child processes. Child processes spawned by SpeechRuntime.exe could indicate an attempt for lateral movement via COM & DCOM hijacking. ' references: - https://github.com/rtecCyberSec/SpeechRuntimeMove author: andrewdanis date: 2025-10-23 logsource: category: process_creation product: windows tags: - attack.lateral-movement - attack.stealth - attack.t1021.003 - attack.t1218 detection: selection: ParentImage|endswith: \SpeechRuntime.exe condition: selection falsepositives: - Unlikely. level: high
Query: hunt for Browser Fingerprint activity
Matching passage: T1036.012 Browser Fingerprint. Tactics: stealth. Description: Adversaries may attempt to blend in with legitimate traffic by spoofing browser and system attributes like operating system, system language, platform, user-agent string, resolution, time zone, etc. The HTTP User-Agent request header is a string that lets servers and network peers identify the application, operating system, vendor, and/or version of the requesting user agent.(Citation: Mozilla User Agent) Adversaries may gather this information through [System Information Discovery](https://attack.mitre.org/techniques/T1082) or by users navigating to adversary-controlled websites, and then use that information to craft their web traffic to evade defenses.(Citation: Gummy Browsers Targeted Browser Spoofing against State-of-the-Art Fingerprinting Techniques)
Near-miss passage: T1036.005 Match Legitimate Resource Name or Location. Tactics: stealth. Description: Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: `svchost.exe`). Alternatively, a Windows Registry key may be given a close approximation to a key used by a legitimate program. In containerized environments, a threat actor may create a resource in a trusted namespace or one that matches the naming convention of a container pod or cluster.(Citation: Aquasec Kubernetes Backdoor 2023)
Query: risk of Cisco ASR 5000 and 5500 devices with software 18.0.0.57828 and 19.0.M0.61045 allow remote attackers to cause a denial of service (vpnmgr process restart) via a crafted header in a 
Matching passage: CVE-2015-6334. CWE: CWE-20. CVSS: 5.0. Cisco ASR 5000 and 5500 devices with software 18.0.0.57828 and 19.0.M0.61045 allow remote attackers to cause a denial of service (vpnmgr process restart) via a crafted header in a TACACS packet, aka Bug ID CSCuw01984.
Near-miss passage: CVE-2015-7691. CWE: CWE-20. CVSS: 7.5. The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted packets containing particular autokey operations. NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750.
Query: detection rule: Detects process access request to uncommon target images with a "PROCESS_ALL_ACCESS" access mask.
Matching passage: Sigma rule: Detects process access request to uncommon target images with a "PROCESS_ALL_ACCESS" access mask.. Logsource: windows / process_access. Rule: title: Uncommon Process Access Rights For Target Image id: a24e5861-c6ca-4fde-a93c-ba9256feddf0 status: test description: 'Detects process access request to uncommon target images with a "PROCESS_ALL_ACCESS" access mask. ' references: - https://learn.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2024-05-27 tags: - attack.privilege-escalation - attack.stealth - attack.t1055.011 logsource: category: process_access product: windows detection: selection: TargetImage|endswith: - \calc.exe - \calculator.exe - \mspaint.exe - \notepad.exe - \ping.exe - \wordpad.exe - \write.exe GrantedAccess: '0x1FFFFF' condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects the deletion of a process's executable by itself. This is usually not possible without workarounds and may be us. Logsource: windows / file_delete. Rule: title: Process Deletion of Its Own Executable id: f01d1f70-cd41-42ec-9c0b-26dd9c22bf29 status: test description: 'Detects the deletion of a process''s executable by itself. This is usually not possible without workarounds and may be used by malware to hide its traces. ' references: - https://github.com/joaoviictorti/RustRedOps/tree/ce04369a246006d399e8c61d9fe0e6b34f988a49/Self_Deletion author: Max Altgelt (Nextron Systems) date: 2024-09-03 tags: - attack.stealth logsource: product: windows category: file_delete detection: selection: TargetFilename|fieldref: Image condition: selection falsepositives: - Some false positives are to be expected from uninstallers. level: medium
Query: patch priority for CVE-2015-0297
Matching passage: CVE-2015-0297. CWE: CWE-284. CVSS: 9.0. Red Hat JBoss Operations Network 3.3.1 does not properly restrict access to certain APIs, which allows remote attackers to execute arbitrary Java methods via the (1) ServerInvokerServlet or (2) SchedulerService or (3) cause a denial of service (disk consumption) via the ContentManager.
Near-miss passage: CVE-2015-9152. CWE: CWE-284. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile IPQ4019, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 800, SD 810, SD 820, SD 820A, SD 835, and Snapdragon_High_Med_2016, modem owned regions are accessible from secure side.
Query: CVE similar to CVE-2015-5944
Matching passage: CVE-2015-5944. CWE: CWE-119. CVSS: 6.800000190734863. CoreText in Apple OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file.
Near-miss passage: CVE-2015-4485. CWE: CWE-119. CVSS: 10.0. Heap-based buffer overflow in the resize_context_buffers function in libvpx in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via malformed WebM video data.
Query: CVE similar to CVE-2015-4378
Matching passage: CVE-2015-4378. CWE: CWE-79. CVSS: 2.0999999046325684. Cross-site scripting (XSS) vulnerability in the Crumbs module 7.x-2.x before 7.x-2.3 for Drupal allows remote authenticated users with the "Administer Crumbs" permission to inject arbitrary web script or HTML via a custom breadcrumb separator.
Near-miss passage: CVE-2015-4346. CWE: CWE-79. CVSS: 2.5999999046325684. Cross-site scripting (XSS) vulnerability in the SMS Framework module 6.x-1.x before 6.x-1.1 for Drupal, when the "Send to phone" submodule is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to message previews.
Query: actor TTPs: Cron
Matching passage: T1053.003 Cron. Tactics: execution, persistence, privilege escalation. Description: Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code.(Citation: 20 macOS Common Tools and Techniques) The <code>cron</code> utility is a time-based job scheduler for Unix-like operating systems. The <code> crontab</code> file contains the schedule of cron entries to be run and the specified times for execution. Any <code>crontab</code> files are stored in operating system-specific file paths. An adversary may use <code>cron</code> in Linux or Unix environments to execute programs at system startup or on a scheduled basis for [Persistence](https://attack.mitre.org/tactics/TA0003). In ESXi environments, cron jobs must be created directly via the crontab file (e.g., `/var/spool/cron/crontabs/root`).(Citation: CloudSEK ESXiArgs 2023)
Near-miss passage: T1053.002 At. Tactics: execution, persistence, privilege escalation. Description: Adversaries may abuse the [at](https://attack.mitre.org/software/S0110) utility to perform task scheduling for initial or recurring execution of malicious code. The [at](https://attack.mitre.org/software/S0110) utility exists as an executable within Windows, Linux, and macOS for scheduling tasks at a specified time and date. Although deprecated in favor of [Scheduled Task](https://attack.mitre.org/techniques/T1053/005)'s [schtasks](https://attack.mitre.org/software/S0111) in Windows environments, using [at](https://attack.mitre.org/software/S0110) requires that the Task Scheduler service be running, and the user to be logged on as a member of the local Administrators group. In addition to explicitly running the `at` command, adversaries may also schedule a task with [at](https://attack.mitre.org/software/S0110) by directly leveraging the [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) `Win32_ScheduledJob` WMI class.(Citation: Malicious Life by Cybereason) On Linux and macOS, [at](https://attack.mitre.org/software/S0110) may be invoked by the superuser as well as any users added to the <code>at.allow</code> file. If the <code>at.allow</code> file does not exist, the <code>at.deny</code> file is checked. Every username not listed in <code>at.deny</code> is allowed to invoke [at](https://attack.mitre.org/software/S0110). If the <code>at.deny</code> exists and is empty, global use of [at](https://attack.mitre.org/software/S0110) is permitted. If neither file exists (which is often the baseline) only the superuser is allowed to use [at](https://attack.mitre.org/software/S0110).(Citation: Linux at) Adversaries may use [at](https://attack.mitre.org/software/S0110) to execute programs at system startup or on a scheduled basis for [Persistence](https://attack.mitre.org/tactics/TA0003). [at](https://attack.mitre.org/software/S0110) can also be abused to conduct remote [Execution](https://attack.mitre.org/tactics/TA0002) as part of [Lateral Move