alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: android/java/src/org/chromium/chrome/browser/WebsiteSettingsPopup.java in Google Chrome before 43.0.2357.65 on Android does not properly restrict use of a URL's fragment identifier
Matching passage: CVE-2015-1261. CWE: CWE-20. CVSS: 5.0. android/java/src/org/chromium/chrome/browser/WebsiteSettingsPopup.java in Google Chrome before 43.0.2357.65 on Android does not properly restrict use of a URL's fragment identifier during construction of a page-info popup, which allows remote attackers to spoof the URL bar or deliver misleading popup content via crafted text.
Near-miss passage: CVE-2015-0561. CWE: CWE-20. CVSS: 5.0. asn1/lpp/lpp.cnf in the LPP dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 does not validate a certain index value, which allows remote attackers to cause a denial of service (out-of-bounds memory access and application crash) via a crafted packet.
Query: patch priority for CVE-2015-8508
Matching passage: CVE-2015-8508. CWE: CWE-79. CVSS: 4.699999809265137. Cross-site scripting (XSS) vulnerability in showdependencygraph.cgi in Bugzilla 2.x, 3.x, and 4.x before 4.2.16, 4.3.x and 4.4.x before 4.4.11, and 4.5.x and 5.0.x before 5.0.2, when a local dot configuration is used, allows remote attackers to inject arbitrary web script or HTML via a crafted bug summary.
Near-miss passage: CVE-2015-0105. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Process Portal in IBM Business Process Manager (BPM) 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Query: CVE similar to CVE-2015-1278
Matching passage: CVE-2015-1278. CWE: CWE-254. CVSS: 4.300000190734863. content/browser/web_contents/web_contents_impl.cc in Google Chrome before 44.0.2403.89 does not ensure that a PDF document's modal dialog is closed upon navigation to an interstitial page, which allows remote attackers to spoof URLs via a crafted document, as demonstrated by the alert_dialog.pdf document.
Near-miss passage: CVE-2015-3755. CWE: CWE-254. CVSS: 4.300000190734863. WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, allows remote attackers to spoof the user interface via a malformed URL.
Query: alert when Detects SMB server connections to shares without signing or encryption enabled. This could indicate potential lateral mo
Matching passage: Sigma rule: Detects SMB server connections to shares without signing or encryption enabled. This could indicate potential lateral mo. Logsource: windows / smbserver-connectivity. Rule: title: Unsigned or Unencrypted SMB Connection to Share Established id: 8d91f6e4-9f3b-4c21-ae41-2c5b7d9f7a12 status: experimental description: 'Detects SMB server connections to shares without signing or encryption enabled. This could indicate potential lateral movement activity using unsecured SMB shares. ' author: Mohamed Abdelghani date: 2025-10-19 references: - https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/overview-server-message-block-signing tags: - attack.lateral-movement - attack.t1021.002 logsource: product: windows service: smbserver-connectivity detection: selection_shares: EventID: 4000 ShareName|contains: - IPC$ - ADMIN$ - C$ selection_status: - SigningUsed: 'false' - EncyptionUsed: 'false' filter_main_local_ips: - ClientAddress|cidr: - 127.0.0.0/8 - 169.254.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 - ClientAddress|contains: - '00000000000000000000000000000001' - FE80000000000000 - FC00000000000000 - 0200????7F - 0200????A9FE condition: all of selection_* and not 1 of filter_main_* falsepositives: - Connections from local or private IP addresses to SMB shares without signing or encryption enabled for older systems or misconfigured environments. Apply additional tuning as needed. level: medium
Near-miss passage: Sigma rule: Detects uncommon child processes of "DefaultPack.EXE" binary as a proxy to launch other programs. Logsource: windows / process_creation. Rule: title: Uncommon Child Process Of Defaultpack.EXE id: b2309017-4235-44fe-b5af-b15363011957 status: test description: Detects uncommon child processes of "DefaultPack.EXE" binary as a proxy to launch other programs references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/DefaultPack/ - https://www.echotrail.io/insights/search/defaultpack.exe author: frack113 date: 2022-12-31 modified: 2024-04-22 tags: - attack.stealth - attack.t1218 - attack.execution logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \DefaultPack.exe condition: selection falsepositives: - Unknown level: medium
Query: campaign using Encrypted Channel
Matching passage: T1573 Encrypted Channel. Tactics: command and control. Description: Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Near-miss passage: T1573.001 Symmetric Cryptography. Tactics: command and control. Description: Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.
Query: risk of win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2 allows local users to gain privileges or cause a denial of service (memory corruption) via a c
Matching passage: CVE-2015-1768. CWE: CWE-119. CVSS: 7.199999809265137. win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted application, aka "Win32k Memory Corruption Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-5103. CWE: CWE-119. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3095, CVE-2015-5087, CVE-2015-5094, CVE-2015-5100, CVE-2015-5102, CVE-2015-5104, and CVE-2015-5115.
Query: threat report mentioning Transfer Data to Cloud Account
Matching passage: T1537 Transfer Data to Cloud Account. Tactics: exfiltration. Description: Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service. A defender who is monitoring for large transfers to outside the cloud environment through normal file transfers or over command and control channels may not be watching for data transfers to another account within the same cloud provider. Such transfers may utilize existing cloud provider APIs and the internal address space of the cloud provider to blend into normal traffic or avoid data transfers over external network interfaces.(Citation: TLDRSec AWS Attacks) Adversaries may also use cloud-native mechanisms to share victim data with adversary-controlled cloud accounts, such as creating anonymous file sharing links or, in Azure, a shared access signature (SAS) URI.(Citation: Microsoft Azure Storage Shared Access Signature) Incidents have been observed where adversaries have created backups of cloud instances and transferred them to separate accounts.(Citation: DOJ GRU Indictment Jul 2018)
Near-miss passage: T1011 Exfiltration Over Other Network Medium. Tactics: exfiltration. Description: Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel. If the command and control network is a wired Internet connection, the exfiltration may occur, for example, over a WiFi connection, modem, cellular data connection, Bluetooth, or another radio frequency (RF) channel. Adversaries may choose to do this if they have sufficient access or proximity, and the connection might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.
Query: CVE similar to CVE-2015-7264
Matching passage: CVE-2015-7264. CWE: CWE-74. CVSS: 9.800000190734863. The SPDY/2 codec in Facebook Proxygen before 2015-11-09 truncates a certain field to two bytes, which allows hijacking and injection attacks.
Near-miss passage: CVE-2015-5377. CWE: CWE-74. CVSS: 9.800000190734863. Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the transport protocol. NOTE: ZDI appears to claim that CVE-2015-3253 and CVE-2015-5377 are the same vulnerability
Query: describe CVE-2015-10125
Matching passage: CVE-2015-10125. CWE: CWE-352. CVSS: 8.800000190734863. A vulnerability classified as problematic has been found in WP Ultimate CSV Importer Plugin 3.7.2 on WordPress. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 3.7.3 is able to address this issue. The identifier of the patch is 13c30af721d3f989caac72dd0f56cf0dc40fad7e. It is recommended to upgrade the affected component. The identifier VDB-241317 was assigned to this vulnerability.
Near-miss passage: CVE-2015-2770. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the command line page in Websense TRITON V-Series appliances before 8.0.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Query: rule covering Detects the removal or uninstallation of an application via "Wmic.EXE".
Matching passage: Sigma rule: Detects the removal or uninstallation of an application via "Wmic.EXE".. Logsource: windows / process_creation. Rule: title: Application Removed Via Wmic.EXE id: b53317a0-8acf-4fd1-8de8-a5401e776b96 related: - id: 847d5ff3-8a31-4737-a970-aeae8fe21765 type: derived status: test description: Detects the removal or uninstallation of an application via "Wmic.EXE". references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md#atomic-test-10---application-uninstall-using-wmic author: frack113 date: 2022-01-28 modified: 2024-07-02 tags: - attack.execution - attack.t1047 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \WMIC.exe - OriginalFileName: wmic.exe selection_cli: CommandLine|contains|all: - call - uninstall condition: all of selection_* falsepositives: - Unknown level: medium simulation: - type: atomic-red-team name: Application uninstall using WMIC technique: T1047 atomic_guid: c510d25b-1667-467d-8331-a56d3e9bc4ff regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_uninstall_application/info.yml
Near-miss passage: Sigma rule: Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SA. Logsource: windows / ps_script. Rule: title: Winlogon Helper DLL id: 851c506b-6b7c-4ce2-8802-c703009d03c0 status: test description: 'Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. Registry entries in HKLM\Software[Wow6432Node]Microsoft\Windows NT\CurrentVersion\Winlogon\ and HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ are used to manage additional helper programs and functionalities that support Winlogon. Malicious modifications to these Registry keys may cause Winlogon to load and execute malicious DLLs and/or executables. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.004/T1547.004.md author: Timur Zinniatullin, oscd.community date: 2019-10-21 modified: 2022-07-07 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.004 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: CurrentVersion\Winlogon selection2: ScriptBlockText|contains: - Set-ItemProperty - New-Item condition: all of selection* falsepositives: - Unknown level: medium
Query: CVE similar to CVE-2015-0304
Matching passage: CVE-2015-0304. CWE: CWE-119. CVSS: 10.0. Heap-based buffer overflow in Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0309.
Near-miss passage: CVE-2015-8683. CWE: CWE-119. CVSS: 5.5. The putcontig8bitCIELab function in tif_getimage.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via a packed TIFF image.
Query: mitigate Asymmetric Cryptography
Matching passage: T1573.002 Asymmetric Cryptography. Tactics: command and control. Description: Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private. Due to how the keys are generated, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key. This ensures that only the intended recipient can read the encrypted data. Common public key encryption algorithms include RSA and ElGamal. For efficiency, many protocols (including SSL/TLS) use symmetric cryptography once a connection is established, but use asymmetric cryptography to establish or transmit a key. As such, these protocols are classified as [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002).
Near-miss passage: T1573 Encrypted Channel. Tactics: command and control. Description: Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Query: CVE similar to CVE-2015-3660
Matching passage: CVE-2015-3660. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the PDF functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL in embedded PDF content.
Near-miss passage: CVE-2015-0634. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the administrative interface in Cisco WebEx Meetings Server 2.5 and 2.5.0.997 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuq86310.
Query: rule covering Detects potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This can be used by attackers to ena
Matching passage: Sigma rule: Detects potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This can be used by attackers to ena. Logsource: windows / process_creation. Rule: title: Potential Remote Desktop Tunneling id: 8a3038e8-9c9d-46f8-b184-66234a160f6f status: test description: Detects potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination. references: - https://www.elastic.co/guide/en/security/current/potential-remote-desktop-tunneling-detected.html author: Tim Rauch, Elastic (idea) date: 2022-09-27 tags: - attack.lateral-movement - attack.t1021 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: :3389 selection_opt: CommandLine|contains: - ' -L ' - ' -P ' - ' -R ' - ' -pw ' - ' -ssh ' condition: all of selection* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects usage of findstr with the "EVERYONE" or "BUILTIN" keywords. This was seen being used in combination with "icacls. Logsource: windows / process_creation. Rule: title: Permission Misconfiguration Reconnaissance Via Findstr.EXE id: 47e4bab7-c626-47dc-967b-255608c9a920 status: test description: 'Detects usage of findstr with the "EVERYONE" or "BUILTIN" keywords. This was seen being used in combination with "icacls" and other utilities to spot misconfigured files or folders permissions. ' references: - https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-12 modified: 2023-11-11 tags: - attack.credential-access - attack.t1552.006 logsource: category: process_creation product: windows detection: selection_findstr_img: - Image|endswith: - \find.exe - \findstr.exe - OriginalFileName: - FIND.EXE - FINDSTR.EXE selection_findstr_cli: CommandLine|contains: - '"Everyone"' - '''Everyone''' - '"BUILTIN\\"' - '''BUILTIN\''' selection_special: CommandLine|contains|all: - 'icacls ' - 'findstr ' - Everyone condition: all of selection_findstr_* or selection_special falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_findstr_recon_everyone/info.yml
Query: ATT&CK technique for Account Discovery
Matching passage: T1087 Account Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., [Valid Accounts](https://attack.mitre.org/techniques/T1078)). Adversaries may use several methods to enumerate accounts, including abuse of existing tools, built-in commands, and potential misconfigurations that leak account names and roles or permissions in the targeted environment. For examples, cloud environments typically provide easily accessible interfaces to obtain user lists.(Citation: AWS List Users)(Citation: Google Cloud - IAM Servie Accounts List API) On hosts, adversaries can use default [PowerShell](https://attack.mitre.org/techniques/T1059/001) and other command line functionality to identify accounts. Information about email addresses and accounts may also be extracted by searching an infected system’s files.
Near-miss passage: T1087.003 Email Account. Tactics: discovery. Description: Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).(Citation: Microsoft Exchange Address Lists) In on-premises Exchange and Exchange Online, the <code>Get-GlobalAddressList</code> PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.(Citation: Microsoft getglobaladdresslist)(Citation: Black Hills Attacking Exchange MailSniper, 2016) In Google Workspace, the GAL is shared with Microsoft Outlook users through the Google Workspace Sync for Microsoft Outlook (GWSMO) service. Additionally, the Google Workspace Directory allows for users to get a listing of other users within the organization.(Citation: Google Workspace Global Access List)
Query: exploit Stack-based buffer overflow in the catopen function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (applicati
Matching passage: CVE-2015-8779. CWE: CWE-119. CVSS: 9.800000190734863. Stack-based buffer overflow in the catopen function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long catalog name.
Near-miss passage: CVE-2015-5868. CWE: CWE-119. CVSS: 7.199999809265137. The kernel in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5896 and CVE-2015-5903.
Query: exploit Multiple cross-site request forgery (CSRF) vulnerabilities in the User Import module 6.x-4.x before 6.x-4.4 and 7.x-2.x before 7.x-2.3 for Drupal allow remote attackers to hijack t
Matching passage: CVE-2015-4390. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the User Import module 6.x-4.x before 6.x-4.4 and 7.x-2.x before 7.x-2.3 for Drupal allow remote attackers to hijack the authentication of administrators for requests that (1) continue or (2) delete an ongoing import via unspecified vectors.
Near-miss passage: CVE-2015-4361. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Registration codes module before 6.x-1.6 for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete registration codes via unspecified vectors.
Query: vulnerability: WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and appli
Matching passage: CVE-2015-7095. CWE: CWE-119. CVSS: 6.800000190734863. WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7096, CVE-2015-7097, CVE-2015-7098, CVE-2015-7099, CVE-2015-7100, CVE-2015-7101, CVE-2015-7102, and CVE-2015-7103.
Near-miss passage: CVE-2015-5547. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5544, CVE-2015-5545, CVE-2015-5546, CVE-2015-5548, CVE-2015-5549, CVE-2015-5552, and CVE-2015-5553.
Query: patch priority for CVE-2015-2086
Matching passage: CVE-2015-2086. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the live preview in the Panopoly Magic module before 7.x-1.17 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a pane title.
Near-miss passage: CVE-2015-6253. CWE: CWE-79. CVSS: 5.400000095367432. edx-platform before 2015-08-17 allows XSS in the Studio listing of courses.