alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: mitigate Outlook Rules
Matching passage: T1137.005 Outlook Rules. Tactics: persistence. Description: Adversaries may abuse Microsoft Outlook rules to obtain persistence on a compromised system. Outlook rules allow a user to define automated behavior to manage email messages. A benign rule might, for example, automatically move an email to a particular folder in Outlook if it contains specific words from a specific sender. Malicious Outlook rules can be created that can trigger code execution when an adversary sends a specifically crafted email to that user.(Citation: SilentBreak Outlook Rules) Once malicious rules have been added to the user’s mailbox, they will be loaded when Outlook is started. Malicious rules will execute when an adversary sends a specifically crafted email to the user.(Citation: SilentBreak Outlook Rules)
Near-miss passage: T1137.001 Office Template Macros. Tactics: persistence. Description: Adversaries may abuse Microsoft Office templates to obtain persistence on a compromised system. Microsoft Office contains templates that are part of common Office applications and are used to customize styles. The base templates within the application are used each time an application starts. (Citation: Microsoft Change Normal Template) Office Visual Basic for Applications (VBA) macros (Citation: MSDN VBA in Office) can be inserted into the base template and used to execute code when the respective Office application starts in order to obtain persistence. Examples for both Word and Excel have been discovered and published. By default, Word has a Normal.dotm template created that can be modified to include a malicious macro. Excel does not have a template file created by default, but one can be added that will automatically be loaded.(Citation: enigma0x3 normal.dotm)(Citation: Hexacorn Office Template Macros) Shared templates may also be stored and pulled from remote locations.(Citation: GlobalDotName Jun 2019) Word Normal.dotm location:<br> <code>C:\Users\&lt;username&gt;\AppData\Roaming\Microsoft\Templates\Normal.dotm</code> Excel Personal.xlsb location:<br> <code>C:\Users\&lt;username&gt;\AppData\Roaming\Microsoft\Excel\XLSTART\PERSONAL.XLSB</code> Adversaries may also change the location of the base template to point to their own by hijacking the application's search order, e.g. Word 2016 will first look for Normal.dotm under <code>C:\Program Files (x86)\Microsoft Office\root\Office16\</code>, or by modifying the GlobalDotName registry key. By modifying the GlobalDotName registry key an adversary can specify an arbitrary location, file name, and file extension to use for the template that will be loaded on application startup. To abuse GlobalDotName, adversaries may first need to register the template as a trusted document or place it in a trusted location.(Citation: GlobalDotName Jun 2019) An adversary may need to enable macros to execute unrestricted depending
Query: risk of Multiple integer underflows in the ff_mjpeg_decode_frame function in libavcodec/mjpegdec.c in FFmpeg before 2.7.2 allow remote attackers to cause a denial of service (out-of-bounds
Matching passage: CVE-2015-6819. CWE: CWE-189. CVSS: 7.5. Multiple integer underflows in the ff_mjpeg_decode_frame function in libavcodec/mjpegdec.c in FFmpeg before 2.7.2 allow remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted MJPEG data.
Near-miss passage: CVE-2015-8364. CWE: CWE-189. CVSS: 6.800000190734863. Integer overflow in the ff_ivi_init_planes function in libavcodec/ivi.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 allows remote attackers to cause a denial of service (out-of-bounds heap-memory access) or possibly have unspecified other impact via crafted image dimensions in Indeo Video Interactive data.
Query: describe CVE-2015-1061
Matching passage: CVE-2015-1061. CWE: CWE-94. CVSS: 9.300000190734863. IOSurface in Apple iOS before 8.2, Apple OS X through 10.10.2, and Apple TV before 7.1 allows attackers to execute arbitrary code in a privileged context via a crafted app that leverages "type confusion" during serialized-object handling.
Near-miss passage: CVE-2015-9272. CWE: CWE-94. CVSS: 9.800000190734863. The videowhisper-video-presentation plugin 3.31.17 for WordPress allows remote attackers to execute arbitrary code because vp/vw_upload.php considers a file safe when "html" are the last four characters, as demonstrated by a .phtml file containing PHP code.
Query: vulnerability: The (1) ssh2_load_userkey and (2) ssh2_save_userkey functions in PuTTY 0.51 through 0.63 do not properly wipe SSH-2 private keys from memory, which allows local users to obtain sen
Matching passage: CVE-2015-2157. CWE: CWE-200. CVSS: 2.0999999046325684. The (1) ssh2_load_userkey and (2) ssh2_save_userkey functions in PuTTY 0.51 through 0.63 do not properly wipe SSH-2 private keys from memory, which allows local users to obtain sensitive information by reading the memory.
Near-miss passage: CVE-2015-2286. CWE: CWE-200. CVSS: 6.5. lms/templates/footer-edx-new.html in Open edX edx-platform before 2015-01-29 does not properly restrict links on the password-reset page, which allows user-assisted remote attackers to discover password-reset tokens by reading a referer log after a victim navigates from this page to a social-sharing site.
Query: write Sigma for Detects indirect command execution via Program Compatibility Assistant "pcwrun.exe" leveraging the follina (CVE-2022-301
Matching passage: Sigma rule: Detects indirect command execution via Program Compatibility Assistant "pcwrun.exe" leveraging the follina (CVE-2022-301. Logsource: windows / process_creation. Rule: title: Execute Pcwrun.EXE To Leverage Follina id: 6004abd0-afa4-4557-ba90-49d172e0a299 status: test description: Detects indirect command execution via Program Compatibility Assistant "pcwrun.exe" leveraging the follina (CVE-2022-30190) vulnerability references: - https://twitter.com/nas_bench/status/1535663791362519040 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-13 tags: - attack.stealth - attack.t1218 - attack.execution logsource: category: process_creation product: windows detection: selection: Image|endswith: \pcwrun.exe CommandLine|contains: ../ condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the creation of files with suspicious file extensions in the temporary directory that Outlook uses when opening. Logsource: windows / file_event. Rule: title: Suspicious File Created in Outlook Temporary Directory id: fabb0e80-030c-4e3e-a104-d09676991ac3 related: - id: f748c45a-f8d3-4e6f-b617-fe176f695b8f type: obsolete status: experimental description: 'Detects the creation of files with suspicious file extensions in the temporary directory that Outlook uses when opening attachments. This can be used to detect spear-phishing campaigns that use suspicious files as attachments, which may contain malicious code. ' references: - https://vipre.com/blog/svg-phishing-attacks-the-new-trick-in-the-cybercriminals-playbook/ - https://thecyberexpress.com/rogue-rdp-files-used-in-ukraine-cyberattacks/ - https://www.microsoft.com/en-us/security/blog/2024/10/29/midnight-blizzard-conducts-large-scale-spear-phishing-campaign-using-rdp-files/ author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-07-22 tags: - attack.initial-access - attack.t1566.001 logsource: product: windows category: file_event detection: selection_extension: TargetFilename|endswith: - .cpl - .hta - .iso - .rdp - .svg - .vba - .vbe - .vbs selection_location: - TargetFilename|contains: - \AppData\Local\Packages\Microsoft.Outlook_ - \AppData\Local\Microsoft\Olk\Attachments\ - TargetFilename|contains|all: - \AppData\Local\Microsoft\Windows\ - \Content.Outlook\ condition: all of selection_* falsepositives: - Opening of headers or footers in email signatures that include SVG images or legitimate SVG attachments level: high
Query: vulnerability: Springboard in Apple iOS before 8.2 allows physically proximate attackers to bypass an intended activation requirement and read the home screen by leveraging an application crash d
Matching passage: CVE-2015-1064. CWE: CWE-200. CVSS: 1.899999976158142. Springboard in Apple iOS before 8.2 allows physically proximate attackers to bypass an intended activation requirement and read the home screen by leveraging an application crash during the activation process.
Near-miss passage: CVE-2015-6632. CWE: CWE-200. CVSS: 5.0. libstagefright in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 24346430.
Query: CVE similar to CVE-2015-1851
Matching passage: CVE-2015-1851. CWE: CWE-200. CVSS: 6.800000190734863. OpenStack Cinder before 2014.1.5 (icehouse), 2014.2.x before 2014.2.4 (juno), and 2015.1.x before 2015.1.1 (kilo) allows remote authenticated users to read arbitrary files via a crafted qcow2 signature in an image to the upload-to-image command.
Near-miss passage: CVE-2015-5231. CWE: CWE-200. CVSS: 5.5. The service daemon in CRIU does not properly restrict access to non-dumpable processes, which allows local users to obtain sensitive information via (1) process dumps or (2) ptrace access.
Query: describe CVE-2015-0037
Matching passage: CVE-2015-0037. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0018, CVE-2015-0040, and CVE-2015-0066.
Near-miss passage: CVE-2015-1626. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0056 and CVE-2015-1623.
Query: exploit Multiple SQL injection vulnerabilities in the ratings module in the Users Ultra plugin before 1.5.16 for WordPress allow remote attackers to execute arbitrary SQL commands via the 
Matching passage: CVE-2015-4109. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in the ratings module in the Users Ultra plugin before 1.5.16 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) data_target or (2) data_vote parameter in a rating_vote (wp_ajax_nopriv_rating_vote) action to wp-admin/admin-ajax.php.
Near-miss passage: CVE-2015-4342. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving a cdef id.
Query: write Sigma for Identifies user login with multifactor authentication failures, which might be an indication an attacker has the passwor
Matching passage: Sigma rule: Identifies user login with multifactor authentication failures, which might be an indication an attacker has the passwor. Logsource: azure / signinlogs. Rule: title: Multifactor Authentication Interrupted id: 5496ff55-42ec-4369-81cb-00f417029e25 status: test description: Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts author: AlertIQ date: 2021-10-10 modified: 2022-12-18 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.credential-access - attack.stealth - attack.t1078.004 - attack.t1110 - attack.t1621 logsource: product: azure service: signinlogs detection: selection_50074: ResultType: 50074 ResultDescription|contains: Strong Auth required selection_500121: ResultType: 500121 ResultDescription|contains: Authentication failed during strong authentication request condition: 1 of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects suspicious processes logging on with explicit credentials. Logsource: windows / security. Rule: title: Suspicious Remote Logon with Explicit Credentials id: 941e5c45-cda7-4864-8cea-bbb7458d194a status: test description: Detects suspicious processes logging on with explicit credentials references: - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view author: oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, Tim Shelton date: 2020-10-05 modified: 2022-08-03 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078 - attack.lateral-movement logsource: product: windows service: security detection: selection: EventID: 4648 ProcessName|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe - \winrs.exe - \wmic.exe - \net.exe - \net1.exe - \reg.exe filter1: TargetServerName: localhost filter2: SubjectUserName|endswith: $ TargetUserName|endswith: $ condition: selection and not 1 of filter* falsepositives: - Administrators that use the RunAS command or scheduled tasks level: medium
Query: CVE similar to CVE-2015-1237
Matching passage: CVE-2015-1237. CWE: UNKNOWN. CVSS: 7.5. Use-after-free vulnerability in the RenderFrameImpl::OnMessageReceived function in content/renderer/render_frame_impl.cc in Google Chrome before 42.0.2311.90 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger renderer IPC messages during a detach operation.
Near-miss passage: CVE-2015-1095. CWE: UNKNOWN. CVSS: 7.199999809265137. IOHIDFamily in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 allows physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted HID device.
Query: SIEM correlation: discovery activity consistent with System Information Discovery
Matching passage: T1082 System Information Discovery. Tactics: discovery. Description: An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from [Local Storage Discovery](https://attack.mitre.org/techniques/T1680) which is an adversary's discovery of local drive, disks and/or volumes. Tools such as [Systeminfo](https://attack.mitre.org/software/S0096) can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the <code>systemsetup</code> configuration tool on macOS. Adversaries may leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather detailed system information (e.g. <code>show version</code>).(Citation: US-CERT-TA18-106A) On ESXi servers, threat actors may gather system information from various esxcli utilities, such as `system hostname get` and `system version get`.(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)(Citation: Varonis) Infrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine.(Citation: Amazon Describe Instance)(Citation: Google Instances Resource)(Citation: Microsoft Virutal Machine API) [System Information Discovery](https://attack.mitre.org/techniques/T1082) combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.(Citation: OSX.FairyTale)(Citation: 20 macOS Common Tools and Techniques)
Near-miss passage: T1087.003 Email Account. Tactics: discovery. Description: Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).(Citation: Microsoft Exchange Address Lists) In on-premises Exchange and Exchange Online, the <code>Get-GlobalAddressList</code> PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.(Citation: Microsoft getglobaladdresslist)(Citation: Black Hills Attacking Exchange MailSniper, 2016) In Google Workspace, the GAL is shared with Microsoft Outlook users through the Google Workspace Sync for Microsoft Outlook (GWSMO) service. Additionally, the Google Workspace Directory allows for users to get a listing of other users within the organization.(Citation: Google Workspace Global Access List)
Query: alert when Detects suspicious file based on their extension being created in "C:\PerfLogs\". Note that this directory mostly contai
Matching passage: Sigma rule: Detects suspicious file based on their extension being created in "C:\PerfLogs\". Note that this directory mostly contai. Logsource: windows / file_event. Rule: title: Suspicious File Created In PerfLogs id: bbb7e38c-0b41-4a11-b306-d2a457b7ac2b status: test description: Detects suspicious file based on their extension being created in "C:\PerfLogs\". Note that this directory mostly contains ".etl" files references: - Internal Research - https://labs.withsecure.com/publications/fin7-target-veeam-servers author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-05 tags: - attack.execution - attack.t1059 logsource: category: file_event product: windows detection: selection: TargetFilename|startswith: C:\PerfLogs\ TargetFilename|endswith: - .7z - .bat - .bin - .chm - .dll - .exe - .hta - .lnk - .ps1 - .psm1 - .py - .scr - .sys - .vbe - .vbs - .zip condition: selection falsepositives: - Unlikely level: medium
Near-miss passage: Sigma rule: Detect use of PDQ Deploy remote admin tool. Logsource: windows / process_creation. Rule: title: PDQ Deploy Remote Adminstartion Tool Execution id: d679950c-abb7-43a6-80fb-2a480c4fc450 related: - id: 12b8e9f5-96b2-41e1-9a42-8c6779a5c184 type: similar status: test description: Detect use of PDQ Deploy remote admin tool references: - https://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1072/T1072.md - https://www.pdq.com/pdq-deploy/ author: frack113 date: 2022-10-01 modified: 2023-01-30 tags: - attack.execution - attack.lateral-movement - attack.t1072 logsource: category: process_creation product: windows detection: selection: - Description: PDQ Deploy Console - Product: PDQ Deploy - Company: PDQ.com - OriginalFileName: PDQDeployConsole.exe condition: selection falsepositives: - Legitimate use level: medium
Query: CVE similar to CVE-2015-4604
Matching passage: CVE-2015-4604. CWE: CWE-20. CVSS: 7.5. The mget function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, does not properly maintain a certain pointer relationship, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string that is mishandled by a "Python script text executable" rule.
Near-miss passage: CVE-2015-1131. CWE: CWE-20. CVSS: 7.199999809265137. fontd in Apple Type Services (ATS) in Apple OS X before 10.10.3 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-1132, CVE-2015-1133, CVE-2015-1134, and CVE-2015-1135.
Query: detect Detects potentially suspicious loading of the Offline Registry Library (offreg.dll). Offreg.dll enables direct read/writ in logs
Matching passage: Sigma rule: Detects potentially suspicious loading of the Offline Registry Library (offreg.dll). Offreg.dll enables direct read/writ. Logsource: windows / image_load. Rule: title: Potentially Suspicious Image Load of Offreg.dll id: c9e5f013-4a6f-4d8c-9b0e-f7a4c3d26e95 status: experimental description: 'Detects potentially suspicious loading of the Offline Registry Library (offreg.dll). Offreg.dll enables direct read/write access to offline registry hives without invoking the Windows Registry API, bypassing its associated audit logging and telemetry. Attackers may abuse this to stealthily modify registry hives while evading detection mechanisms that rely on standard registry event logs. ' references: - https://learn.microsoft.com/en-us/windows/win32/devnotes/about-the-offline-registry-library - https://github.com/MSNightmare/LegacyHive author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-07-23 tags: - attack.defense-impairment - attack.persistence - attack.t1112 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \offreg.dll filter_main_system32: Image|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ filter_main_program_files: Image|startswith: - C:\Program Files\ - C:\Program Files (x86)\ filter_main_appdata_local_programs: Image|startswith: C:\Users\ Image|contains: \AppData\Local\Programs\ filter_main_defender: Image|startswith: C:\ProgramData\Microsoft\Windows Defender\Platform\ Image|endswith: \MsMpEng.exe condition: selection and not 1 of filter_main_* falsepositives: - Third-party backup or forensic software that performs offline registry parsing - Windows deployment tools (DISM, ADK) run from non-standard paths level: medium regression_tests_path: regression_data/rules/windows/image_load/image_load_susp_offreg_dll_load/info.yml
Near-miss passage: Sigma rule: Detects creation of WMI event subscription persistence method. Logsource: windows / wmi_event. Rule: title: WMI Event Subscription id: 0f06a3a5-6a09-413f-8743-e6cf35561297 status: test description: Detects creation of WMI event subscription persistence method references: - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-19-wmievent-wmieventfilter-activity-detected - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-20-wmievent-wmieventconsumer-activity-detected - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-21-wmievent-wmieventconsumertofilter-activity-detected author: Tom Ueltschi (@c_APT_ure) date: 2019-01-12 modified: 2021-11-27 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.003 logsource: product: windows category: wmi_event detection: selection: EventID: - 19 - 20 - 21 condition: selection falsepositives: - Exclude legitimate (vetted) use of WMI event subscription in your network level: medium
Query: patch priority for CVE-2015-7743
Matching passage: CVE-2015-7743. CWE: CWE-611. CVSS: 6.5. XML external entity vulnerability in PRTG Network Monitor before 16.2.23.3077/3078 allows remote authenticated users to read arbitrary files by creating a new HTTP XML/REST Value sensor that accesses a crafted XML file.
Near-miss passage: CVE-2015-3451. CWE: CWE-611. CVSS: 5.0. The _clone function in XML::LibXML before 2.0119 does not properly set the expand_entities option, which allows remote attackers to conduct XML external entity (XXE) attacks via crafted XML data to the (1) new or (2) load_xml function.
Query: exploit In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, and
Matching passage: CVE-2015-9109. CWE: CWE-476. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, and SD 820A, lack of address argument validation inqsee_fuse_write could lead to untrusted pointer dereference.
Near-miss passage: CVE-2015-3194. CWE: CWE-476. CVSS: 7.5. crypto/rsa/rsa_ameth.c in OpenSSL 1.0.1 before 1.0.1q and 1.0.2 before 1.0.2e allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an RSA PSS ASN.1 signature that lacks a mask generation function parameter.