alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: stealth using Break Process Trees
Matching passage: T1036.009 Break Process Trees. Tactics: stealth. Description: An adversary may attempt to evade process tree-based analysis by modifying executed malware's parent process ID (PPID). If endpoint protection software leverages the “parent-child" relationship for detection, breaking this relationship could result in the adversary’s behavior not being associated with previous process tree activity. On Unix-based systems breaking this process tree is common practice for administrators to execute software using scripts and programs.(Citation: 3OHA double-fork 2022) On Linux systems, adversaries may execute a series of [Native API](https://attack.mitre.org/techniques/T1106) calls to alter malware's process tree. For example, adversaries can execute their payload without any arguments, call the `fork()` API call twice, then have the parent process exit. This creates a grandchild process with no parent process that is immediately adopted by the `init` system process (PID 1), which successfully disconnects the execution of the adversary's payload from its previous process tree. Another example is using the “daemon” syscall to detach from the current parent process and run in the background.(Citation: Sandfly BPFDoor 2022)(Citation: Microsoft XorDdos Linux Stealth 2022)
Near-miss passage: T1036.007 Double File Extension. Tactics: stealth. Description: Adversaries may abuse a double extension in the filename as a means of masquerading the true file type. A file name may include a secondary file type extension that may cause only the first extension to be displayed (ex: <code>File.txt.exe</code> may render in some views as just <code>File.txt</code>). However, the second extension is the true file type that determines how the file is opened and executed. The real file extension may be hidden by the operating system in the file browser (ex: explorer.exe), as well as in any software configured using or similar to the system’s policies.(Citation: PCMag DoubleExtension)(Citation: SOCPrime DoubleExtension) Adversaries may abuse double extensions to attempt to conceal dangerous file types of payloads. A very common usage involves tricking a user into opening what they think is a benign file type but is actually executable code. Such files often pose as email attachments and allow an adversary to gain [Initial Access](https://attack.mitre.org/tactics/TA0001) into a user’s system via [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001) then [User Execution](https://attack.mitre.org/techniques/T1204). For example, an executable file attachment named <code>Evil.txt.exe</code> may display as <code>Evil.txt</code> to a user. The user may then view it as a benign text file and open it, inadvertently executing the hidden malware.(Citation: SOCPrime DoubleExtension) Common file types, such as text files (.txt, .doc, etc.) and image files (.jpg, .gif, etc.) are typically used as the first extension to appear benign. Executable extensions commonly regarded as dangerous, such as .exe, .lnk, .hta, and .scr, often appear as the second extension and true file type.
Query: risk of Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to aff
Matching passage: CVE-2015-4884. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality via unknown vectors related to Single Signon.
Near-miss passage: CVE-2015-5371. CWE: UNKNOWN. CVSS: 10.0. The AuthenticationFilter class in SolarWinds Storage Manager allows remote attackers to upload and execute arbitrary scripts via unspecified vectors.
Query: detection rule: Detects deletion of registry key that adds 'Scan with Defender' option in context menu. Attackers may use this to make i
Matching passage: Sigma rule: Detects deletion of registry key that adds 'Scan with Defender' option in context menu. Attackers may use this to make i. Logsource: windows / registry_delete. Rule: title: Delete Defender Scan ShellEx Context Menu Registry Key id: 72a0369a-2576-4aaf-bfc9-6bb24a574ac6 related: - id: b9e8c7d6-a5f4-4e3d-8b1a-9f0c8d7e6a5b type: similar status: experimental description: Detects deletion of registry key that adds 'Scan with Defender' option in context menu. Attackers may use this to make it harder for users to scan files that are suspicious. references: - https://research.splunk.com/endpoint/395ed5fe-ad13-4366-9405-a228427bdd91/ - https://winaero.com/how-to-delete-scan-with-windows-defender-from-context-menu-in-windows-10/ - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ author: Matt Anderson (Huntress) date: 2025-07-11 modified: 2025-10-07 tags: - attack.defense-impairment logsource: category: registry_delete product: windows detection: selection: TargetObject|contains: shellex\ContextMenuHandlers\EPP filter_main_defender: Image|startswith: - C:\ProgramData\Microsoft\Windows Defender\Platform\ - C:\Program Files\Windows Defender\ - C:\Program Files (x86)\Windows Defender\ Image|endswith: \MsMpEng.exe condition: selection and not 1 of filter_main_* falsepositives: - Unlikely as this weakens defenses and normally would not be done even if using another AV. level: medium
Near-miss passage: Sigma rule: Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename. Logsource: windows / process_creation. Rule: title: PUA - Potential PE Metadata Tamper Using Rcedit id: 0c92f2e6-f08f-4b73-9216-ecb0ca634689 status: test description: Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion. references: - https://security.stackexchange.com/questions/210843/is-it-possible-to-change-original-filename-of-an-exe - https://www.virustotal.com/gui/file/02e8e8c5d430d8b768980f517b62d7792d690982b9ba0f7e04163cbc1a6e7915 - https://github.com/electron/rcedit author: Micah Babinski date: 2022-12-11 modified: 2023-03-05 tags: - attack.stealth - attack.t1036.003 - attack.t1036 - attack.t1027.005 - attack.t1027 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \rcedit-x64.exe - \rcedit-x86.exe - Description: Edit resources of exe - Product: rcedit selection_flags: CommandLine|contains: --set- selection_attributes: CommandLine|contains: - OriginalFileName - CompanyName - FileDescription - ProductName - ProductVersion - LegalCopyright condition: all of selection_* falsepositives: - Legitimate use of the tool by administrators or users to update metadata of a binary level: medium
Query: patch priority for CVE-2015-2314
Matching passage: CVE-2015-2314. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the WPML plugin before 3.1.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the lang parameter in the HTTP Referer header in a wp-link-ajax action to comments/feed.
Near-miss passage: CVE-2015-1000003. CWE: CWE-89. CVSS: 9.800000190734863. Blind SQL Injection in filedownload v1.4 wordpress plugin
Query: vulnerability: Vulnerability in Easy2map-photos WordPress Plugin v1.09 allows SQL Injection via unsanitized mapTemplateName, mapName, mapSettingsXML, parentCSSXML, photoCSSXML, mapCSSXML, mapHTML
Matching passage: CVE-2015-4615. CWE: CWE-89. CVSS: 9.800000190734863. Vulnerability in Easy2map-photos WordPress Plugin v1.09 allows SQL Injection via unsanitized mapTemplateName, mapName, mapSettingsXML, parentCSSXML, photoCSSXML, mapCSSXML, mapHTML,mapID variables
Near-miss passage: CVE-2015-2213. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the wp_untrash_post_comments function in wp-includes/post.php in WordPress before 4.2.4 allows remote attackers to execute arbitrary SQL commands via a comment that is mishandled after retrieval from the trash.
Query: detect Detects when a GitHub repository is archived or unarchived, which may indicate unauthorized changes to repository status in logs
Matching passage: Sigma rule: Detects when a GitHub repository is archived or unarchived, which may indicate unauthorized changes to repository status. Logsource: github / audit. Rule: title: GitHub Repository Archive Status Changed id: dca8991c-cb16-4128-abf8-6b11e5cd156f status: experimental description: 'Detects when a GitHub repository is archived or unarchived, which may indicate unauthorized changes to repository status. ' references: - https://docs.github.com/en/repositories/archiving-a-github-repository/archiving-repositories - https://www.sentinelone.com/blog/exploiting-repos-6-ways-threat-actors-abuse-github-other-devops-platforms - https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events author: Ivan Saakov date: 2025-10-18 tags: - attack.persistence - attack.impact - attack.defense-impairment logsource: product: github service: audit detection: selection: action: - repo.archived - repo.unarchived condition: selection falsepositives: - Archiving or unarchiving a repository is often legitimate. Investigate this action to determine if it was authorized. level: low
Near-miss passage: Sigma rule: Detects enabling of the "AllowAnonymousCallback" registry value, which allows a remote connection between computers that. Logsource: windows / registry_set. Rule: title: Enable Remote Connection Between Anonymous Computer - AllowAnonymousCallback id: 4d431012-2ab5-4db7-a84e-b29809da2172 status: test description: Detects enabling of the "AllowAnonymousCallback" registry value, which allows a remote connection between computers that do not have a trust relationship. references: - https://learn.microsoft.com/en-us/windows/win32/wmisdk/connecting-to-wmi-remotely-starting-with-vista author: X__Junior (Nextron Systems) date: 2023-11-03 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: registry_set detection: selection: TargetObject|contains: \Microsoft\WBEM\CIMOM\AllowAnonymousCallback Details: DWORD (0x00000001) condition: selection falsepositives: - Administrative activity level: medium
Query: risk of The management-services protocol implementation in Veritas NetBackup 7.x through 7.5.0.7, 7.6.0.x through 7.6.0.4, 7.6.1.x through 7.6.1.2, and 7.7.x before 7.7.2 and NetBackup App
Matching passage: CVE-2015-6552. CWE: CWE-284. CVSS: 9.800000190734863. The management-services protocol implementation in Veritas NetBackup 7.x through 7.5.0.7, 7.6.0.x through 7.6.0.4, 7.6.1.x through 7.6.1.2, and 7.7.x before 7.7.2 and NetBackup Appliance through 2.5.4, 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, and 2.7.x before 2.7.2 allows remote attackers to make arbitrary RPC calls via unspecified vectors.
Near-miss passage: CVE-2015-1000010. CWE: CWE-284. CVSS: 7.5. Remote file download in simple-image-manipulator v1.0 wordpress plugin
Query: patch priority for CVE-2015-4557
Matching passage: CVE-2015-4557. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the new_Twitter_sign_button function in nextend-Twitter-connect.php in the Nextend Twitter Connect plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirect_to parameter. NOTE: this may overlap CVE-2015-4413.
Near-miss passage: CVE-2015-4671. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in OpenCart before 2.1.0.2 allows remote attackers to inject arbitrary web script or HTML via the zone_id parameter to index.php.
Query: vulnerability: XML external entity (XXE) vulnerability in PyAMF before 0.8.0 allows remote attackers to cause a denial of service or read arbitrary files via a crafted Action Message Format (AMF)
Matching passage: CVE-2015-8549. CWE: CWE-611. CVSS: 7.099999904632568. XML external entity (XXE) vulnerability in PyAMF before 0.8.0 allows remote attackers to cause a denial of service or read arbitrary files via a crafted Action Message Format (AMF) payload.
Near-miss passage: CVE-2015-0194. CWE: CWE-611. CVSS: 6.5. XML External Entity (XXE) vulnerability in IBM Sterling B2B Integrator 5.1 and 5.2 and IBM Sterling File Gateway 2.1 and 2.2 allows remote attackers to read arbitrary files via a crafted XML data.
Query: CVE similar to CVE-2015-8079
Matching passage: CVE-2015-8079. CWE: CWE-200. CVSS: 5.300000190734863. qt5-qtwebkit before 5.4 records private browsing URLs to its favicon database, WebpageIcons.db.
Near-miss passage: CVE-2015-6344. CWE: CWE-200. CVSS: 4.0. The web-based GUI in Cisco Adaptive Security Appliance (ASA) CX Context-Aware Security 9.3(4.1.11) allows remote authenticated users to bypass intended access restrictions and obtain sensitive user information via an unspecified HTTP request, aka Bug ID CSCuv74105.
Query: CVE similar to CVE-2015-6721
Matching passage: CVE-2015-6721. CWE: UNKNOWN. CVSS: 6.800000190734863. The CBSharedReviewSecurityDialog method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6712, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7616, CVE-2015-7618, CVE-2015-7619, CVE-2015-7620, and CVE-2015-7623.
Near-miss passage: CVE-2015-8067. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: CWE for Failure to Handle Missing Parameter
Matching passage: CWE-234 Failure to Handle Missing Parameter. If too few arguments are sent to a function, the function will still pop the expected number of arguments from the stack. Potentially, a variable number of arguments could be exhausted in a function as well.
Near-miss passage: CWE-1190 DMA Device Enabled Too Early in Boot Phase. The product enables a Direct Memory Access (DMA) capable device before the security configuration settings are established, which allows an attacker to extract data from or gain privileges on the product.
Query: CVE similar to CVE-2015-4773
Matching passage: CVE-2015-4773. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Hyperion Common Security component in Oracle Hyperion 11.1.2.2, 11.1.2.3, and 11.1.2.4 allows remote authenticated users to affect availability via unknown vectors related to User Account Update.
Near-miss passage: CVE-2015-2572. CWE: UNKNOWN. CVSS: 4.599999904632568. Unspecified vulnerability in the Oracle Hyperion Smart View for Office component in Oracle Hyperion 11.1.2.5.216 and earlier, when running on Windows, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core.
Query: CVE similar to CVE-2015-8578
Matching passage: CVE-2015-8578. CWE: CWE-264. CVSS: 6.400000095367432. AVG Internet Security 2015 allocates memory with Read, Write, Execute (RWX) permissions at predictable addresses when protecting user-mode processes, which allows attackers to bypass the DEP and ASLR protection mechanisms via unspecified vectors.
Near-miss passage: CVE-2015-2371. CWE: CWE-264. CVSS: 6.900000095367432. The Windows Installer service in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a custom action script associated with a .msi package, aka "Windows Installer EoP Vulnerability."
Query: patch priority for CVE-2015-1784
Matching passage: CVE-2015-1784. CWE: CWE-434. CVSS: 8.800000190734863. In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the web application. The vulnerabilities lie in how the application validates user uploaded files and lack of security measures preventing unwanted HTTP requests.
Near-miss passage: CVE-2015-10087. CWE: CWE-434. CVSS: 8.800000190734863. ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in UpThemes Theme DesignFolio Plus 1.2 on WordPress and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 53f6ae62878076f99718e5feb589928e83c879a9. It is recommended to apply a patch to fix this issue. The identifier VDB-221809 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Query: vulnerability: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 38.0 allow remote attackers to cause a denial of service (memory corruption and application cra
Matching passage: CVE-2015-2709. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 38.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Near-miss passage: CVE-2015-4755. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in the RDBMS Security component in Oracle Database Server 12.1.0.2 allows remote attackers to affect confidentiality via unknown vectors.
Query: risk of Unspecified vulnerability in the Siebel Life Sciences component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors
Matching passage: CVE-2015-0398. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Siebel Life Sciences component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Clinical Trip Report.
Near-miss passage: CVE-2015-2635. CWE: UNKNOWN. CVSS: 6.800000190734863. Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Data Quality based on Trillium, a different vulnerability than CVE-2015-0443, CVE-2015-0444, CVE-2015-0445, CVE-2015-0446, CVE-2015-2634, CVE-2015-2636, CVE-2015-4758, and CVE-2015-4759.
Query: detection rule: Detects creation of Microsoft Office files inside of one of the default startup folders in order to achieve persistence.
Matching passage: Sigma rule: Detects creation of Microsoft Office files inside of one of the default startup folders in order to achieve persistence.. Logsource: windows / file_event. Rule: title: Potential Persistence Via Microsoft Office Startup Folder id: 0e20c89d-2264-44ae-8238-aeeaba609ece status: test description: Detects creation of Microsoft Office files inside of one of the default startup folders in order to achieve persistence. references: - https://insight-jp.nttsecurity.com/post/102hojk/operation-restylink-apt-campaign-targeting-japanese-companies - https://learn.microsoft.com/en-us/office/troubleshoot/excel/use-startup-folders author: Max Altgelt (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-06-02 modified: 2023-06-22 tags: - attack.persistence - attack.t1137 logsource: category: file_event product: windows detection: selection_word_paths: - TargetFilename|contains: \Microsoft\Word\STARTUP - TargetFilename|contains|all: - \Office - \Program Files - \STARTUP selection_word_extension: TargetFilename|endswith: - .doc - .docm - .docx - .dot - .dotm - .rtf selection_excel_paths: - TargetFilename|contains: \Microsoft\Excel\XLSTART - TargetFilename|contains|all: - \Office - \Program Files - \XLSTART selection_excel_extension: TargetFilename|endswith: - .xls - .xlsm - .xlsx - .xlt - .xltm filter_main_office: Image|endswith: - \WINWORD.exe - \EXCEL.exe condition: (all of selection_word_* or all of selection_excel_*) and not filter_main_office falsepositives: - Loading a user environment from a backup or a domain controller - Synchronization of templates level: high
Near-miss passage: Sigma rule: Detects the execution of the hacktool SafetyKatz via PE information and default Image name. Logsource: windows / process_creation. Rule: title: HackTool - SafetyKatz Execution id: b1876533-4ed5-4a83-90f3-b8645840a413 status: test description: Detects the execution of the hacktool SafetyKatz via PE information and default Image name references: - https://github.com/GhostPack/SafetyKatz author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-20 modified: 2023-02-04 tags: - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \SafetyKatz.exe - OriginalFileName: SafetyKatz.exe - Description: SafetyKatz condition: selection falsepositives: - Unlikely level: critical
Query: CVE similar to CVE-2015-10035
Matching passage: CVE-2015-10035. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability was found in gperson angular-test-reporter and classified as critical. This issue affects the function getProjectTables/addTest of the file rest-server/data-server.js. The manipulation leads to sql injection. The patch is named a29d8ae121b46ebfa96a55a9106466ab2ef166ae. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217715.
Near-miss passage: CVE-2015-10026. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability was found in tiredtyrant flairbot. It has been declared as critical. This vulnerability affects unknown code of the file flair.py. The manipulation leads to sql injection. The patch is identified as 5e112b68c6faad1d4699d02c1ebbb7daf48ef8fb. It is recommended to apply a patch to fix this issue. VDB-217618 is the identifier assigned to this vulnerability.
Query: CWE for Duplicate Key in Associative List (Alist)
Matching passage: CWE-462 Duplicate Key in Associative List (Alist). Duplicate keys in associative lists can lead to non-unique keys being mistaken for an error.
Near-miss passage: CWE-766 Critical Data Element Declared Public. The product declares a critical variable, field, or member to be public when intended security policy requires it to be private.