alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of Use-after-free vulnerability in the CanvasRenderingContext2D implementation in Mozilla Firefox before 40.0.3 and Firefox ESR 38.x before 38.2.1 allows remote attackers to execute a
Matching passage: CVE-2015-4497. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in the CanvasRenderingContext2D implementation in Mozilla Firefox before 40.0.3 and Firefox ESR 38.x before 38.2.1 allows remote attackers to execute arbitrary code by leveraging improper interaction between resize events and changes to Cascading Style Sheets (CSS) token sequences for a CANVAS element.
Near-miss passage: CVE-2015-1427. CWE: UNKNOWN. CVSS: 9.800000190734863. The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
Query: risk of Use-after-free vulnerability in Oxide before 1.5.6 and 1.6.x before 1.6.1 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code by deletin
Matching passage: CVE-2015-1317. CWE: UNKNOWN. CVSS: 7.5. Use-after-free vulnerability in Oxide before 1.5.6 and 1.6.x before 1.6.1 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code by deleting all WebContents while a RenderProcessHost instance still exists.
Near-miss passage: CVE-2015-3146. CWE: UNKNOWN. CVSS: 7.5. The (1) SSH_MSG_NEWKEYS and (2) SSH_MSG_KEXDH_REPLY packet handlers in package_cb.c in libssh before 0.6.5 do not properly validate state, which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted SSH packet.
Query: patch priority for CVE-2015-5797
Matching passage: CVE-2015-5797. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Near-miss passage: CVE-2015-8392. CWE: CWE-119. CVSS: 7.5. PCRE before 8.38 mishandles certain instances of the (?| substring, which allows remote attackers to cause a denial of service (unintended recursion and buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, a related issue to CVE-2015-8384 and CVE-2015-8395.
Query: CVE similar to CVE-2015-7403
Matching passage: CVE-2015-7403. CWE: UNKNOWN. CVSS: 4.0. IBM Spectrum Scale 4.1.1.x before 4.1.1.3 and General Parallel File System (GPFS) 3.5.x before 3.5.0.29 and 4.1.x through 4.1.0.8 on AIX allow local users to cause a denial of service (incorrect pointer dereference and node crash) via unspecified vectors.
Near-miss passage: CVE-2015-5563. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5557, CVE-2015-5559, CVE-2015-5561, CVE-2015-5564, and CVE-2015-5565.
Query: incident response steps for Suspicious Launchd execution detected on endpoint
Matching passage: Playbook for T1053.004 Launchd. 1) Validate alert telemetry against T1053.004. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: execution, persistence, privilege escalation. 5) Eradicate persistence and recover. Reference detection notes: This technique is deprecated due to the inaccurate usage. The report cited did not provide technical detail as to how the malware interacted directly with launchd rather than going through known services. Other system services are used to interact with launchd rather than launchd being used by itself. Adversaries may abuse the <code>Launchd</code> daemon to perform task scheduling for initial or r
Near-miss passage: Playbook for T1053.007 Container Orchestration Job. Different response path focused on execution, persistence, privilege escalation.
Query: exploit Cross-site scripting (XSS) vulnerability in the view-based webform results table in the Webform module 7.x-4.x before 7.x-4.4 for Drupal allows remote authenticated users with cert
Matching passage: CVE-2015-4356. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the view-based webform results table in the Webform module 7.x-4.x before 7.x-4.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a webform.
Near-miss passage: CVE-2015-4392. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Display Suite module 7.x-2.7 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to field display settings.
Query: exploit openhpi/Makefile.am in OpenHPI before 3.6.0 uses world-writable permissions for /var/lib/openhpi directory, which allows local users, when quotas are not properly setup, to fill th
Matching passage: CVE-2015-3248. CWE: CWE-400. CVSS: 4.699999809265137. openhpi/Makefile.am in OpenHPI before 3.6.0 uses world-writable permissions for /var/lib/openhpi directory, which allows local users, when quotas are not properly setup, to fill the filesystem hosting /var/lib and cause a denial of service (disk consumption).
Near-miss passage: CVE-2015-1779. CWE: CWE-400. CVSS: 8.600000381469727. The VNC websocket frame decoder in QEMU allows remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section.
Query: hunt for Network Logon Script activity
Matching passage: T1037.003 Network Logon Script. Tactics: persistence, privilege escalation. Description: Adversaries may use network logon scripts automatically executed at logon initialization to establish persistence. Network logon scripts can be assigned using Active Directory or Group Policy Objects.(Citation: Petri Logon Script AD) These logon scripts run with the privileges of the user they are assigned to. Depending on the systems within the network, initializing one of these scripts could apply to more than one or potentially all systems. Adversaries may use these scripts to maintain persistence on a network. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.
Near-miss passage: T1037 Boot or Logon Initialization Scripts. Tactics: persistence, privilege escalation. Description: Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.(Citation: Mandiant APT29 Eye Spy Email Nov 22)(Citation: Anomali Rocke March 2019) Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating system and whether applied locally or remotely. Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary. An adversary may also be able to escalate their privileges since some boot or logon initialization scripts run with higher privileges.
Query: detect Detects usage of winget to add a new insecure (http) download source. Winget will not allow the addition of insecure sou in logs
Matching passage: Sigma rule: Detects usage of winget to add a new insecure (http) download source. Winget will not allow the addition of insecure sou. Logsource: windows / process_creation. Rule: title: Add Insecure Download Source To Winget id: 81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2 related: - id: 05ebafc8-7aa2-4bcd-a269-2aec93f9e842 type: similar - id: c15a46a0-07d4-4c87-b4b6-89207835a83b type: similar status: test description: 'Detects usage of winget to add a new insecure (http) download source. Winget will not allow the addition of insecure sources, hence this could indicate potential suspicious activity (or typos) ' references: - https://learn.microsoft.com/en-us/windows/package-manager/winget/source - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-17 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \winget.exe - OriginalFileName: winget.exe selection_cli: CommandLine|contains|all: - 'source ' - 'add ' - http:// condition: all of selection_* falsepositives: - False positives might occur if the users are unaware of such control checks level: high
Near-miss passage: Sigma rule: Detects the creation or update of a scheduled task to run with "NT AUTHORITY\SYSTEM" privileges. Logsource: windows / process_creation. Rule: title: Schtasks Creation Or Modification With SYSTEM Privileges id: 89ca78fd-b37c-4310-b3d3-81a023f83936 status: test description: Detects the creation or update of a scheduled task to run with "NT AUTHORITY\SYSTEM" privileges references: - https://www.elastic.co/security-labs/exploring-the-qbot-attack-pattern - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-28 modified: 2025-02-15 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1053.005 logsource: product: windows category: process_creation detection: selection_root: Image|endswith: \schtasks.exe CommandLine|contains: - ' /change ' - ' /create ' selection_run: CommandLine|contains: '/ru ' selection_user: CommandLine|contains: - NT AUT - ' SYSTEM ' filter_optional_teamviewer: Image|endswith: \schtasks.exe CommandLine|contains|all: - /TN TVInstallRestore - \TeamViewer_.exe filter_optional_office: CommandLine|contains|all: - Subscription Heartbeat - \HeartbeatConfig.xml - \Microsoft Shared\OFFICE filter_optional_avira: CommandLine|contains: - '/Create /F /RU System /SC WEEKLY /TN AviraSystemSpeedupVerify /TR ' - :\Program Files (x86)\Avira\System Speedup\setup\avira_speedup_setup.exe - /VERIFY /VERYSILENT /NOSTART /NODOTNET /NORESTART" /RL HIGHEST condition: all of selection_* and not 1 of filter_optional_* falsepositives: - Unknown level: high
Query: exploit Cross-site scripting (XSS) vulnerability in Homepage Decorator PerlTreeBBS 2.30 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Matching passage: CVE-2015-0873. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Homepage Decorator PerlTreeBBS 2.30 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-4714. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the DreamBox DM500-S allows remote attackers to inject arbitrary web script or HTML via the mode parameter to /body.
Query: describe CVE-2015-3974
Matching passage: CVE-2015-3974. CWE: CWE-255. CVSS: 9.0. EasyIO EasyIO-30P-SF controllers with firmware before 0.5.21 and 2.x before 2.0.5.21, as used in Accutrol, Bar-Tech Automation, Infocon/EasyIO, Honeywell Automation India, Johnson Controls, SyxthSENSE, Transformative Wave Technologies, Tridium Asia Pacific, and Tridium Europe products, have a hardcoded password, which makes it easier for remote attackers to obtain access via unspecified vectors.
Near-miss passage: CVE-2015-4684. CWE: CWE-255. CVSS: 6.5. Multiple directory traversal vulnerabilities in Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allow (1) remote authenticated users to read arbitrary files via a .. (dot dot) in the Modifier parameter to PlcmRmWeb/FileDownload; or remote authenticated administrators to upload arbitrary files via the (2) Filename or (3) SE_FNAME parameter to PlcmRmWeb/FileUpload or to read and remove arbitrary files via the (4) filePathName parameter in an importSipUriReservations SOAP request to PlcmRmWeb/JUserManager.
Query: alert when Detects delete action in the Github audit logs for codespaces, environment, project and repo.
Matching passage: Sigma rule: Detects delete action in the Github audit logs for codespaces, environment, project and repo.. Logsource: github / audit. Rule: title: Github Delete Action Invoked id: 16a71777-0b2e-4db7-9888-9d59cb75200b status: test description: Detects delete action in the Github audit logs for codespaces, environment, project and repo. author: Muhammad Faisal (@faisalusuf) date: 2023-01-19 modified: 2026-03-09 references: - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#audit-log-actions - https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events#codespaces tags: - attack.impact - attack.collection - attack.t1213.003 logsource: product: github service: audit definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming' detection: selection: action: - codespaces.destroy - environment.delete - project.delete - repo.destroy condition: selection falsepositives: - Validate the deletion activity is permitted. The "actor" field need to be validated. level: medium
Near-miss passage: Sigma rule: Detects execution of the hacktool NetExec. NetExec (formerly CrackMapExec) is a widely used post-exploitation tool desig. Logsource: windows / process_creation. Rule: title: HackTool - NetExec Execution id: 7638e5fe-600c-4289-a968-f49dd537ec7d status: experimental description: 'Detects execution of the hacktool NetExec. NetExec (formerly CrackMapExec) is a widely used post-exploitation tool designed for Active Directory penetration testing and network enumeration In enterprise environments, the use of NetExec is considered suspicious or potentially malicious because it enables attackers to enumerate hosts, exploit network services, and move laterally across systems. Threat actors and red teams commonly use NetExec to identify vulnerable systems, harvest credentials, and execute commands remotely. ' references: - https://thedfirreport.com/2025/12/17/cats-got-your-files-lynx-ransomware/ - https://github.com/Pennyw0rth/NetExec - https://www.netexec.wiki/ author: Chirag Damani date: 2026-03-29 tags: - attack.discovery - attack.t1018 - attack.lateral-movement - attack.t1021 logsource: category: process_creation product: windows detection: selection: Image|endswith: \nxc.exe CommandLine|contains: - ' ftp ' - ' ldap ' - ' mssql ' - ' nfs ' - ' rdp ' - ' smb ' - ' ssh ' - ' vnc ' - ' winrm ' - ' wmi ' condition: selection falsepositives: - Legitimate use of NetExec by security professionals or system administrators for network assessment and management. level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_hktl_netexec/info.yml
Query: Sigma rule for Detects changes to the Internet Explorer "DisableFirstRunCustomize" value, which prevents Internet Explorer from running
Matching passage: Sigma rule: Detects changes to the Internet Explorer "DisableFirstRunCustomize" value, which prevents Internet Explorer from running. Logsource: windows / registry_set. Rule: title: Internet Explorer DisableFirstRunCustomize Enabled id: ab567429-1dfb-4674-b6d2-979fd2f9d125 status: test description: 'Detects changes to the Internet Explorer "DisableFirstRunCustomize" value, which prevents Internet Explorer from running the first run wizard the first time a user starts the browser after installing Internet Explorer or Windows. ' references: - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/devil-bait/NCSC-MAR-Devil-Bait.pdf - https://unit42.paloaltonetworks.com/operation-ke3chang-resurfaces-with-new-tidepool-malware/ - https://admx.help/?Category=InternetExplorer&Policy=Microsoft.Policies.InternetExplorer::NoFirstRunCustomise author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-16 modified: 2025-10-07 tags: - attack.defense-impairment logsource: product: windows category: registry_set detection: selection: TargetObject|endswith: \Microsoft\Internet Explorer\Main\DisableFirstRunCustomize Details: - DWORD (0x00000001) - DWORD (0x00000002) filter_main_generic: Image: - C:\Windows\explorer.exe - C:\Windows\System32\ie4uinit.exe filter_optional_avira: Image|contains|all: - \Temp\ - \.cr\avira_ Details|contains: DWORD (0x00000001) filter_optional_foxit: Image: - C:\Program Files (x86)\Foxit Software\Foxit PDF Reader\FoxitPDFReader.exe - C:\Program Files\Foxit Software\Foxit PDF Reader\FoxitPDFReader.exe Details|contains: DWORD (0x00000001) condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - As this is controlled by group policy as well as user settings. Some false positives may occur. level: medium
Near-miss passage: Sigma rule: Detects changes to the security group entries for RDS databases. This can indicate that a misconfiguration has occurred. Logsource: aws / cloudtrail. Rule: title: RDS Database Security Group Modification id: 14f3f1c8-02d5-43a2-a191-91ffb52d3015 status: test description: 'Detects changes to the security group entries for RDS databases. This can indicate that a misconfiguration has occurred which potentially exposes the database to the public internet, a wider audience within the VPC or that removal of valid rules has occurred which could impact the availability of the database to legitimate services and users. ' references: - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/ author: jamesc-grafana date: 2024-07-11 tags: - attack.initial-access - attack.t1190 logsource: product: aws service: cloudtrail detection: selection: eventSource: rds.amazonaws.com eventName: - AuthorizeDBSecurityGroupIngress - CreateDBSecurityGroup - DeleteDBSecurityGroup - RevokeDBSecurityGroupIngress condition: selection falsepositives: - Creation of a new Database that needs new security group rules level: medium
Query: weakness Inappropriate Encoding for Output Context
Matching passage: CWE-838 Inappropriate Encoding for Output Context. The product uses or specifies an encoding when generating output to a downstream component, but the specified encoding is not the same as the encoding that is expected by the downstream component.
Near-miss passage: CWE-806 Buffer Access Using Size of Source Buffer. The product uses the size of a source buffer when reading from or writing to a destination buffer, which may cause it to access memory that is outside of the bounds of the buffer.
Query: SIEM correlation: resource development activity consistent with Tool
Matching passage: T1588.002 Tool. Tactics: resource development. Description: Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A tool can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: [PsExec](https://attack.mitre.org/software/S0029)). Adversaries may obtain tools to support their operations, including to support execution of post-compromise behaviors. Tools may also be leveraged for testing – for example, evaluating malware against commercial antivirus or endpoint detection and response (EDR) applications.(Citation: Forescout Conti Leaks 2022)(Citation: Sentinel Labs Top Tier Target 2025) Tool acquisition may involve the procurement of commercial software licenses, including for red teaming tools such as Cobalt Strike. In addition to freely downloading or purchasing software, adversaries may steal software and/or software licenses from third-party entities (including other adversaries). Threat actors may also crack trial versions of software.(Citation: Recorded Future Beacon 2019)
Near-miss passage: T1588.006 Vulnerabilities. Tactics: resource development. Description: Adversaries may acquire information about vulnerabilities that can be used during targeting. A vulnerability is a weakness in computer hardware or software that can, potentially, be exploited by an adversary to cause unintended or unanticipated behavior to occur. Adversaries may find vulnerability information by searching open databases or gaining access to closed vulnerability databases.(Citation: National Vulnerability Database) An adversary may monitor vulnerability disclosures/databases to understand the state of existing, as well as newly discovered, vulnerabilities. There is usually a delay between when a vulnerability is discovered and when it is made public. An adversary may target the systems of those known to conduct vulnerability research (including commercial vendors). Knowledge of a vulnerability may cause an adversary to search for an existing exploit (i.e. [Exploits](https://attack.mitre.org/techniques/T1588/005)) or to attempt to develop one themselves (i.e. [Exploits](https://attack.mitre.org/techniques/T1587/004)).
Query: incident response steps for Outbound C2 pattern associated with TCC Manipulation
Matching passage: Playbook for T1548.006 TCC Manipulation. 1) Validate alert telemetry against T1548.006. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: privilege escalation. 5) Eradicate persistence and recover. Reference detection notes: Adversaries can manipulate or abuse the Transparency, Consent, & Control (TCC) service or database to grant malicious executables elevated permissions. TCC is a Privacy & Security macOS control mechanism used to determine if the running process has permission to access the data or services protected by TCC, such as screen sharing, camera, microphone, or Full Disk Access (FDA). When an application
Near-miss passage: Playbook for T1548.004 Elevated Execution with Prompt. Different response path focused on privilege escalation.
Query: CVE similar to CVE-2015-1060
Matching passage: CVE-2015-1060. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in lib/Cake/Controller/Controller.php in AdaptCMS 3.0.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the HTTP Referer header.
Near-miss passage: CVE-2015-6581. CWE: UNKNOWN. CVSS: 7.5. Double free vulnerability in the opj_j2k_copy_default_tcp_and_create_tcd function in j2k.c in OpenJPEG before r3002, as used in PDFium in Google Chrome before 45.0.2454.85, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by triggering a memory-allocation failure.
Query: exploit Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to Swing.
Matching passage: CVE-2015-0407. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to Swing.
Near-miss passage: CVE-2015-4938. CWE: UNKNOWN. CVSS: 5.0. IBM WebSphere Application Server 7.x before 7.0.0.39, 8.0.x before 8.0.0.11, and 8.5.x before 8.5.5.7 allows remote attackers to spoof servlets and obtain sensitive information via unspecified vectors.