alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-2763
Matching passage: CVE-2015-2763. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in Websense TRITON AP-EMAIL before 8.0.0 has unknown impact and attack vectors, related to port 17703.
Near-miss passage: CVE-2015-1172. CWE: UNKNOWN. CVSS: 7.5. Unrestricted file upload vulnerability in admin/upload-file.php in the Holding Pattern theme (aka holding_pattern) 0.6 and earlier for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in an unspecified directory.
Query: exploit The SSH server in Juniper Junos OS before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R10, 12.3X48 before 12.3X48-D10, 13.2 before 13.2R8, 
Matching passage: CVE-2015-7752. CWE: CWE-399. CVSS: 7.800000190734863. The SSH server in Juniper Junos OS before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R10, 12.3X48 before 12.3X48-D10, 13.2 before 13.2R8, 13.2X51 before 13.2X51-D35, 13.3 before 13.3R6, 14.1 before 14.1R5, 14.1X53 before 14.1X53-D25, 14.2 before 14.2R3, 15.1 before 15.1R1, and 15.1X49 before 15.1X49-D20 allows remote attackers to cause a denial of service (CPU consumption) via unspecified SSH traffic.
Near-miss passage: CVE-2015-1349. CWE: CWE-399. CVSS: 5.400000095367432. named in ISC BIND 9.7.0 through 9.9.6 before 9.9.6-P2 and 9.10.x before 9.10.1-P2, when DNSSEC validation and the managed-keys feature are enabled, allows remote attackers to cause a denial of service (assertion failure and daemon exit, or daemon crash) by triggering an incorrect trust-anchor management scenario in which no key is ready for use.
Query: ATT&CK technique for Account Manipulation
Matching passage: T1098 Account Manipulation. Tactics: persistence, privilege escalation. Description: Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.(Citation: FireEye SMOKEDHAM June 2021) These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged [Valid Accounts](https://attack.mitre.org/techniques/T1078).
Near-miss passage: T1098.002 Additional Email Delegate Permissions. Tactics: persistence, privilege escalation. Description: Adversaries may grant additional permission levels to maintain persistent access to an adversary-controlled email account. For example, the <code>Add-MailboxPermission</code> [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlet, available in on-premises Exchange and in the cloud-based service Office 365, adds permissions to a mailbox.(Citation: Microsoft - Add-MailboxPermission)(Citation: FireEye APT35 2018)(Citation: Crowdstrike Hiding in Plain Sight 2018) In Google Workspace, delegation can be enabled via the Google Admin console and users can delegate accounts via their Gmail settings.(Citation: Gmail Delegation)(Citation: Google Ensuring Your Information is Safe) Adversaries may also assign mailbox folder permissions through individual folder permissions or roles. In Office 365 environments, adversaries may assign the Default or Anonymous user permissions or roles to the Top of Information Store (root), Inbox, or other mailbox folders. By assigning one or both user permissions to a folder, the adversary can utilize any other account in the tenant to maintain persistence to the target user’s mail folders.(Citation: Mandiant Defend UNC2452 White Paper) This may be used in persistent threat incidents as well as BEC (Business Email Compromise) incidents where an adversary can add [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003) to the accounts they wish to compromise. This may further enable use of additional techniques for gaining access to systems. For example, compromised business accounts are often used to send messages to other accounts in the network of the target business while creating inbox rules (ex: [Internal Spearphishing](https://attack.mitre.org/techniques/T1534)), so the messages evade spam/phishing detection mechanisms.(Citation: Bienstock, D. - Defending O365 - 2019)
Query: exploit The YCbCrImageDataDeserializer::ToDataSourceSurface function in the YCbCr implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thun
Matching passage: CVE-2015-2738. CWE: CWE-17. CVSS: 10.0. The YCbCrImageDataDeserializer::ToDataSourceSurface function in the YCbCr implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 reads data from uninitialized memory locations, which has unspecified impact and attack vectors.
Near-miss passage: CVE-2015-2751. CWE: CWE-17. CVSS: 7.099999904632568. Xen 4.3.x, 4.4.x, and 4.5.x, when using toolstack disaggregation, allows remote domains with partial management control to cause a denial of service (host lock) via unspecified domctl operations.
Query: patch priority for CVE-2015-8818
Matching passage: CVE-2015-8818. CWE: UNKNOWN. CVSS: 5.5. The cpu_physical_memory_write_rom_internal function in exec.c in QEMU (aka Quick Emulator) does not properly skip MMIO regions, which allows local privileged guest users to cause a denial of service (guest crash) via unspecified vectors.
Near-miss passage: CVE-2015-4851. CWE: UNKNOWN. CVSS: 6.800000190734863. Unspecified vulnerability in the Oracle iSupplier Portal component in Oracle E-Business Suite 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to XML input. NOTE: the previous information is from the October 2015 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability, which allows remote attackers to read arbitrary files, cause a denial of service, or conduct SMB Relay attacks via a crafted DTD in an XML request to OA_HTML/oramipp_lpr.
Query: detection rule: Detects usage of "cdb.exe" to launch arbitrary processes or commands from a debugger script file
Matching passage: Sigma rule: Detects usage of "cdb.exe" to launch arbitrary processes or commands from a debugger script file. Logsource: windows / process_creation. Rule: title: Potential Binary Proxy Execution Via Cdb.EXE id: b5c7395f-e501-4a08-94d4-57fe7a9da9d2 status: test description: Detects usage of "cdb.exe" to launch arbitrary processes or commands from a debugger script file references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Cdb/ - https://web.archive.org/web/20170715043507/http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html - https://twitter.com/nas_bench/status/1534957360032120833 author: Beyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2019-10-26 modified: 2024-04-22 tags: - attack.execution - attack.stealth - attack.t1106 - attack.t1218 - attack.t1127 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \cdb.exe - OriginalFileName: CDB.Exe selection_cli: CommandLine|contains: - ' -c ' - ' -cf ' condition: all of selection* falsepositives: - Legitimate use of debugging tools level: medium
Near-miss passage: Sigma rule: Detects potential DLL sideloading of "AVKkid.dll". Logsource: windows / image_load. Rule: title: Potential AVKkid.DLL Sideloading id: 952ed57c-8f99-453d-aee0-53a49c22f95d status: test description: Detects potential DLL sideloading of "AVKkid.dll" references: - https://research.checkpoint.com/2023/beyond-the-horizon-traveling-the-world-on-camaro-dragons-usb-flash-drives/ author: X__Junior (Nextron Systems) date: 2023-08-03 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \AVKkid.dll filter_main_legit_path: Image|contains: - C:\Program Files (x86)\G DATA\ - C:\Program Files\G DATA\ Image|endswith: \AVKKid.exe ImageLoaded|startswith: - C:\Program Files (x86)\G DATA\ - C:\Program Files\G DATA\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Query: exploit Unspecified vulnerability in the Oracle VM Server for SPARC component in Oracle Sun Systems Products Suite 3.2 allows remote attackers to affect availability via vectors related to
Matching passage: CVE-2015-4750. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in the Oracle VM Server for SPARC component in Oracle Sun Systems Products Suite 3.2 allows remote attackers to affect availability via vectors related to LDOM Manager.
Near-miss passage: CVE-2015-2853. CWE: UNKNOWN. CVSS: 6.800000190734863. Session fixation vulnerability in the WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 allows remote attackers to hijack web sessions by providing a session ID.
Query: risk of SQL injection vulnerability in SIPhone Enterprise PBX allows remote attackers to execute arbitrary SQL commands via the Username.
Matching passage: CVE-2015-1513. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in SIPhone Enterprise PBX allows remote attackers to execute arbitrary SQL commands via the Username.
Near-miss passage: CVE-2015-9301. CWE: CWE-89. CVSS: 9.800000190734863. The liveforms plugin before 3.2.0 for WordPress has SQL injection.
Query: Multiple failed authentications followed by Modify or Spoof Tool UI
Matching passage: T1685.003 Modify or Spoof Tool UI. Tactics: defense impairment. Description: Adversaries may spoof or manipulate security tool user interfaces (UIs) to falsely indicate tools are functioning normally and delay detection and response. Adversaries may present misleading or falsified security tool interfaces (UIs) that display normal or healthy status indicators, even when underlying security tools have been disabled, degraded, or otherwise tampered with. Security tools typically provide visibility into system health, alerting, and operational status; by misrepresenting this information, adversaries can undermine defender trust in these signals and obscure the true security posture of the system. This behavior is often used in conjunction with efforts to disable or modify tools, where adversaries first impair the functionality of defenses (e.g., EDR, logging agents) and then replace or mimic their interfaces to conceal the loss of visibility. By maintaining the appearance of normal operations, such as showing active protection, successful updates, or absence of threats, adversaries can delay investigation and response, enabling continued malicious activity. For example, adversaries may display a fake Windows Security interface or system tray icon indicating a “protected” or “healthy” state after disabling Windows Defender or related services.(Citation: BlackBasta)
Near-miss passage: T1685 Disable or Modify Tools. Tactics: defense impairment. Description: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.(Citation: SCADAfence_ransomware) In addition to directly targeting tools, adversaries may block or manipulate indicators and telemetry used for detection. This includes maliciously disabling or redirecting sensors such as Event Tracing for Windows (ETW), modifying event log configurations (e.g., redirecting Security logs), or interfering with logging pipelines and forwarding mechanisms (e.g., SIEM ingestion).(Citation: Microsoft Lamin Sept 2017)(Citation: ETW Palantir) More advanced techniques include leveraging legitimate drivers or debugging mechanisms to render tools non-functional, bypassing anti-tampering protections, and targeting specific defenses such as Sysmon or cloud monitoring agents. Adversaries may also disrupt broader defensive operations, including update mechanisms, logging infrastructure (e.g., syslog), or event aggregation, further degrading an organization’s ability to detect and respond to malicious activity.(Citation: Cocomazzi FIN7 Reboot)
Query: risk of The get_value function in epan/dissectors/packet-btatt.c in the Bluetooth Attribute (aka BT ATT) dissector in Wireshark 2.0.x before 2.0.1 uses an incorrect integer data type, whic
Matching passage: CVE-2015-8735. CWE: CWE-20. CVSS: 5.5. The get_value function in epan/dissectors/packet-btatt.c in the Bluetooth Attribute (aka BT ATT) dissector in Wireshark 2.0.x before 2.0.1 uses an incorrect integer data type, which allows remote attackers to cause a denial of service (invalid write operation and application crash) via a crafted packet.
Near-miss passage: CVE-2015-8217. CWE: CWE-20. CVSS: 7.5. The ff_hevc_parse_sps function in libavcodec/hevc_ps.c in FFmpeg before 2.8.2 does not validate the Chroma Format Indicator, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted High Efficiency Video Coding (HEVC) data.
Query: Sigma rule for Detects NetNTLM downgrade attack
Matching passage: Sigma rule: Detects NetNTLM downgrade attack. Logsource: windows / security. Rule: title: NetNTLM Downgrade Attack id: d3abac66-f11c-4ed0-8acb-50cc29c97eed related: - id: d67572a0-e2ec-45d6-b8db-c100d14b8ef2 type: derived status: test description: Detects NetNTLM downgrade attack references: - https://www.optiv.com/blog/post-exploitation-using-netntlm-downgrade-attacks author: Florian Roth (Nextron Systems), wagga date: 2018-03-20 modified: 2022-10-09 tags: - attack.persistence - attack.defense-impairment - attack.t1685 - attack.t1112 logsource: product: windows service: security definition: 'Requirements: Audit Policy : Object Access > Audit Registry (Success)' detection: selection: EventID: 4657 ObjectName|contains|all: - \REGISTRY\MACHINE\SYSTEM - ControlSet - \Control\Lsa ObjectValueName: - LmCompatibilityLevel - NtlmMinClientSec - RestrictSendingNTLMTraffic condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects new user account creation. Logsource: okta / okta. Rule: title: New Okta User Created id: b6c718dd-8f53-4b9f-98d8-93fdca966969 status: test description: Detects new user account creation author: Nasreddine Bencherchali (Nextron Systems) date: 2023-10-25 modified: 2026-04-27 references: - https://developer.okta.com/docs/reference/api/event-types/ tags: - attack.credential-access logsource: service: okta product: okta detection: selection: eventType: user.lifecycle.create condition: selection falsepositives: - Legitimate and authorized user creation level: informational
Query: adversary uses Artificial Intelligence
Matching passage: T1588.007 Artificial Intelligence. Tactics: resource development. Description: Adversaries may obtain access to generative artificial intelligence tools, such as large language models (LLMs), to aid various techniques during targeting. These tools may be used to inform, bolster, and enable a variety of malicious tasks, including conducting [Reconnaissance](https://attack.mitre.org/tactics/TA0043), creating basic scripts, assisting social engineering, and even developing payloads.(Citation: MSFT-AI) For example, by utilizing a publicly available LLM an adversary is essentially outsourcing or automating certain tasks to the tool. Using AI, the adversary may draft and generate content in a variety of written languages to be used in [Phishing](https://attack.mitre.org/techniques/T1566)/[Phishing for Information](https://attack.mitre.org/techniques/T1598) campaigns. The same publicly available tool may further enable vulnerability or other offensive research supporting [Develop Capabilities](https://attack.mitre.org/techniques/T1587). AI tools may also automate technical tasks by generating, refining, or otherwise enhancing (e.g., [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027)) malicious scripts and payloads.(Citation: OpenAI-CTI) Finally, AI-generated text, images, audio, and video may be used for fraud, [Impersonation](https://attack.mitre.org/techniques/T1684/001), and other malicious activities.(Citation: Google-Vishing24)(Citation: IC3-AI24)(Citation: WSJ-Vishing-AI24)
Near-miss passage: T1588.002 Tool. Tactics: resource development. Description: Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A tool can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: [PsExec](https://attack.mitre.org/software/S0029)). Adversaries may obtain tools to support their operations, including to support execution of post-compromise behaviors. Tools may also be leveraged for testing – for example, evaluating malware against commercial antivirus or endpoint detection and response (EDR) applications.(Citation: Forescout Conti Leaks 2022)(Citation: Sentinel Labs Top Tier Target 2025) Tool acquisition may involve the procurement of commercial software licenses, including for red teaming tools such as Cobalt Strike. In addition to freely downloading or purchasing software, adversaries may steal software and/or software licenses from third-party entities (including other adversaries). Threat actors may also crack trial versions of software.(Citation: Recorded Future Beacon 2019)
Query: detection rule: Detects Google Workspace login activity that's classified as suspicious by Google.
Matching passage: Sigma rule: Detects Google Workspace login activity that's classified as suspicious by Google.. Logsource: gcp / google_workspace.login. Rule: title: Suspicious Login Activity Classified By Google id: 38360161-76c4-4283-842e-efcf997dafc8 status: experimental description: Detects Google Workspace login activity that's classified as suspicious by Google. references: - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging - https://cloud.google.com/logging/docs/audit/understanding-audit-logs - https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#suspicious_login - https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#suspicious_login_less_secure_app - https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#suspicious_programmatic_login author: Tom Kluter date: 2026-04-28 tags: - attack.initial-access - attack.privilege-escalation - attack.persistence - attack.stealth - attack.t1078.004 logsource: product: gcp service: google_workspace.login detection: selection: protoPayload.Servicename: login.googleapis.com protoPayload.metadata.event.eventName: - suspicious_login_less_secure_app - suspicious_login - suspicious_programmatic_login condition: selection falsepositives: - Legitimate logins level: medium
Near-miss passage: Sigma rule: Detects potential credential dumping via Windows Error Reporting LSASS Shtinkering technique which uses the Windows Erro. Logsource: windows / process_creation. Rule: title: Potential Credential Dumping Via WER id: 9a4ccd1a-3526-4d99-b980-9f9c5d3a6ff3 status: test description: Detects potential credential dumping via Windows Error Reporting LSASS Shtinkering technique which uses the Windows Error Reporting to dump lsass references: - https://github.com/deepinstinct/Lsass-Shtinkering - https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf author: '@pbssubhash , Nasreddine Bencherchali' date: 2022-12-08 modified: 2022-12-09 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \Werfault.exe - OriginalFileName: WerFault.exe selection_cli: ParentUser|contains: - AUTHORI - AUTORI User|contains: - AUTHORI - AUTORI CommandLine|contains|all: - ' -u -p ' - ' -ip ' - ' -s ' filter_lsass: ParentImage: C:\Windows\System32\lsass.exe condition: all of selection_* and not 1 of filter_* falsepositives: - Windows Error Reporting might produce similar behavior. In that case, check the PID associated with the "-p" parameter in the CommandLine. level: high
Query: vulnerability: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka inter
Matching passage: CVE-2015-6603. CWE: CWE-119. CVSS: 10.0. libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23227354.
Near-miss passage: CVE-2015-8241. CWE: CWE-119. CVSS: 6.400000095367432. The xmlNextChar function in libxml2 2.9.2 does not properly check the state, which allows context-dependent attackers to cause a denial of service (heap-based buffer over-read and application crash) or obtain sensitive information via crafted XML data.
Query: exploit Information disclosure vulnerability in Netatmo Indoor Module firmware 100 and earlier.
Matching passage: CVE-2015-1600. CWE: CWE-200. CVSS: 7.5. Information disclosure vulnerability in Netatmo Indoor Module firmware 100 and earlier.
Near-miss passage: CVE-2015-4928. CWE: CWE-200. CVSS: 4.300000190734863. Apache Ambari before 2.1, as used in IBM Infosphere BigInsights 4.x before 4.1, includes cleartext passwords on a Configs screen, which allows physically proximate attackers to obtain sensitive information by reading password fields.