alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: The mod_nss module before 1.0.11 in Fedora allows remote attackers to obtain cipher lists due to incorrect parsing of multi-keyword cipherstring.
Matching passage: CVE-2015-3277. CWE: CWE-200. CVSS: 7.5. The mod_nss module before 1.0.11 in Fedora allows remote attackers to obtain cipher lists due to incorrect parsing of multi-keyword cipherstring.
Near-miss passage: CVE-2015-3881. CWE: CWE-200. CVSS: 7.5. Information disclosure issue in qdPM 8.3 allows remote attackers to obtain sensitive information via a direct request to (1) core/config/databases.yml, (2) core/log/qdPM_prod.log, or (3) core/apps/qdPM/config/settings.yml.
Query: patch priority for CVE-2015-5824
Matching passage: CVE-2015-5824. CWE: CWE-310. CVSS: 4.300000190734863. The NSURL implementation in the CFNetwork SSL component in Apple iOS before 9 does not properly verify X.509 certificates from SSL servers after a certificate change, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Near-miss passage: CVE-2015-3322. CWE: CWE-310. CVSS: 5.0. Lenovo ThinkServer RD350, RD450, RD550, RD650, and TD350 servers before 1.26.0 use weak encryption to store (1) user and (2) administrator BIOS passwords, which allows attackers to decrypt the passwords via unspecified vectors.
Query: Lateral movement indicators for Artificial Intelligence
Matching passage: T1588.007 Artificial Intelligence. Tactics: resource development. Description: Adversaries may obtain access to generative artificial intelligence tools, such as large language models (LLMs), to aid various techniques during targeting. These tools may be used to inform, bolster, and enable a variety of malicious tasks, including conducting [Reconnaissance](https://attack.mitre.org/tactics/TA0043), creating basic scripts, assisting social engineering, and even developing payloads.(Citation: MSFT-AI) For example, by utilizing a publicly available LLM an adversary is essentially outsourcing or automating certain tasks to the tool. Using AI, the adversary may draft and generate content in a variety of written languages to be used in [Phishing](https://attack.mitre.org/techniques/T1566)/[Phishing for Information](https://attack.mitre.org/techniques/T1598) campaigns. The same publicly available tool may further enable vulnerability or other offensive research supporting [Develop Capabilities](https://attack.mitre.org/techniques/T1587). AI tools may also automate technical tasks by generating, refining, or otherwise enhancing (e.g., [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027)) malicious scripts and payloads.(Citation: OpenAI-CTI) Finally, AI-generated text, images, audio, and video may be used for fraud, [Impersonation](https://attack.mitre.org/techniques/T1684/001), and other malicious activities.(Citation: Google-Vishing24)(Citation: IC3-AI24)(Citation: WSJ-Vishing-AI24)
Near-miss passage: T1588 Obtain Capabilities. Tactics: resource development. Description: Adversaries may buy and/or steal capabilities that can be used during targeting. Rather than developing their own capabilities in-house, adversaries may purchase, freely download, or steal them. Activities may include the acquisition of malware, software (including licenses), exploits, certificates, and information relating to vulnerabilities. Adversaries may obtain capabilities to support their operations throughout numerous phases of the adversary lifecycle. In addition to downloading free malware, software, and exploits from the internet, adversaries may purchase these capabilities from third-party entities. Third-party entities can include technology companies that specialize in malware and exploits, criminal marketplaces, or from individuals.(Citation: NationsBuying)(Citation: PegasusCitizenLab) In addition to purchasing capabilities, adversaries may steal capabilities from third-party entities (including other adversaries). This can include stealing software licenses, malware, SSL/TLS and code-signing certificates, or raiding closed databases of vulnerabilities or exploits.(Citation: DiginotarCompromise)
Query: patch priority for CVE-2015-2344
Matching passage: CVE-2015-2344. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in VMware vRealize Automation 6.x before 6.2.4 on Linux allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-0917. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the backend in Kajona before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via the action parameter to index.php.
Query: secure coding against Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
Matching passage: CWE-75 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection). The product does not adequately filter user-controlled input for special elements with control implications.
Near-miss passage: CWE-327 Use of a Broken or Risky Cryptographic Algorithm. The product uses a broken or risky cryptographic algorithm or protocol.
Query: vulnerability: Cross-site request forgery (CSRF) vulnerability in Cisco WebEx Meetings Server 1.5(.1.131) and earlier allows remote attackers to hijack the authentication of arbitrary users, aka 
Matching passage: CVE-2015-0596. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Cisco WebEx Meetings Server 1.5(.1.131) and earlier allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuj67163.
Near-miss passage: CVE-2015-2134. CWE: CWE-352. CVSS: 6.0. Cross-site request forgery (CSRF) vulnerability in HP System Management Homepage (SMH) before 7.5.0 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.
Query: risk of XML external entity (XXE) vulnerability in the management interface in PAN-OS before 5.0.16, 6.x before 6.0.8, and 6.1.x before 6.1.4 allows remote authenticated administrators to 
Matching passage: CVE-2015-4162. CWE: UNKNOWN. CVSS: 4.0. XML external entity (XXE) vulnerability in the management interface in PAN-OS before 5.0.16, 6.x before 6.0.8, and 6.1.x before 6.1.4 allows remote authenticated administrators to obtain sensitive information via crafted XML data.
Near-miss passage: CVE-2015-2247. CWE: UNKNOWN. CVSS: 8.300000190734863. Unspecified vulnerability in Boosted Boards skateboards allows physically proximate attackers to modify skateboard movement, cause human injury, or cause physical damage via vectors related to an "injection attack" that blocks and hijacks a Bluetooth signal.
Query: vulnerability: The Disk Images component in Apple iOS before 9.1 and OS X before 10.11.1 misparses images, which allows attackers to execute arbitrary code or cause a denial of service (memory co
Matching passage: CVE-2015-6995. CWE: CWE-119. CVSS: 6.800000190734863. The Disk Images component in Apple iOS before 9.1 and OS X before 10.11.1 misparses images, which allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted app.
Near-miss passage: CVE-2015-8520. CWE: CWE-119. CVSS: 9.800000190734863. Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a crafted command, a different vulnerability than CVE-2015-8519, CVE-2015-8521, and CVE-2015-8522.
Query: adversary uses Safe Mode Boot
Matching passage: T1688 Safe Mode Boot. Tactics: defense impairment. Description: Adversaries may abuse Windows safe mode to disable endpoint defenses. Safe mode starts up the Windows operating system with a limited set of drivers and services. Third-party security software such as endpoint detection and response (EDR) tools may not start after booting Windows in safe mode. There are two versions of safe mode: Safe Mode and Safe Mode with Networking. It is possible to start additional services after a safe mode boot.(Citation: Microsoft Windows Startup Settings)(Citation: Sophos Safe Mode Boot) Adversaries may abuse safe mode to disable endpoint defenses that may not start with a limited boot. Hosts can be forced into safe mode after the next reboot via modifications to Boot Configuration Data (BCD) stores, which are files that manage boot application settings.(Citation: Microsoft bcdedit) Adversaries may also add their malicious applications to the list of minimal services that start in safe mode by modifying relevant Registry values (i.e. [Modify Registry](https://attack.mitre.org/techniques/T1112)). Malicious [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) objects may also be registered and loaded in safe mode.(Citation: CyberArk Labs Safe Mode 2016)(Citation: Cybereason safe mode boot)(Citation: BleepingComputer REvil 2021)
Near-miss passage: T1578.003 Delete Cloud Instance. Tactics: defense impairment. Description: An adversary may delete a cloud instance after they have performed malicious activities in an attempt to evade detection and remove evidence of their presence. Deleting an instance or virtual machine can remove valuable forensic artifacts and other evidence of suspicious behavior if the instance is not recoverable. An adversary may also [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002) and later terminate the instance after achieving their objectives.(Citation: Mandiant M-Trends 2020)
Query: CVE similar to CVE-2015-9460
Matching passage: CVE-2015-9460. CWE: CWE-89. CVSS: 8.800000190734863. The booking-system plugin before 2.1 for WordPress has DOPBSPBackEndTranslation::display SQL injection via the language parameter.
Near-miss passage: CVE-2015-1397. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the getCsvFile function in the Mage_Adminhtml_Block_Widget_Grid class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary SQL commands via the popularity[field_expr] parameter when the popularity[from] or popularity[to] parameter is set.
Query: detect Detects execution of "certmgr" with the "add" flag in order to install a new certificate on the system. Adversaries may in logs
Matching passage: Sigma rule: Detects execution of "certmgr" with the "add" flag in order to install a new certificate on the system. Adversaries may. Logsource: windows / process_creation. Rule: title: New Root Certificate Installed Via CertMgr.EXE id: ff992eac-6449-4c60-8c1d-91c9722a1d48 related: - id: 42821614-9264-4761-acfc-5772c3286f76 type: derived - id: 46591fae-7a4c-46ea-aec3-dff5e6d785dc type: obsolete status: test description: 'Detects execution of "certmgr" with the "add" flag in order to install a new certificate on the system. Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md - https://securelist.com/to-crypt-or-to-mine-that-is-the-question/86307/ author: oscd.community, @redcanary, Zach Stanford @svch0st date: 2023-03-05 tags: - attack.defense-impairment - attack.t1553.004 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \CertMgr.exe - OriginalFileName: CERTMGT.EXE selection_cli: CommandLine|contains|all: - /add - root condition: all of selection_* falsepositives: - Help Desk or IT may need to manually add a corporate Root CA on occasion. Need to test if GPO push doesn't trigger FP level: medium
Near-miss passage: Sigma rule: Detects a suspicious process spawning from an "mshta.exe" process, which could be indicative of a malicious HTA script e. Logsource: windows / process_creation. Rule: title: Suspicious MSHTA Child Process id: 03cc0c25-389f-4bf8-b48d-11878079f1ca status: test description: Detects a suspicious process spawning from an "mshta.exe" process, which could be indicative of a malicious HTA script execution references: - https://www.trustedsec.com/july-2015/malicious-htas/ author: Michael Haag date: 2019-01-16 modified: 2023-02-06 tags: - attack.stealth - attack.t1218.005 - car.2013-02-003 - car.2013-03-001 - car.2014-04-003 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \mshta.exe selection_child: - Image|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe - \wscript.exe - \cscript.exe - \sh.exe - \bash.exe - \reg.exe - \regsvr32.exe - \bitsadmin.exe - OriginalFileName: - Cmd.Exe - PowerShell.EXE - pwsh.dll - wscript.exe - cscript.exe - Bash.exe - reg.exe - REGSVR32.EXE - bitsadmin.exe condition: all of selection* falsepositives: - Printer software / driver installations - HP software level: high
Query: CVE similar to CVE-2015-8612
Matching passage: CVE-2015-8612. CWE: CWE-264. CVSS: 8.399999618530273. The EnableNetwork method in the Network class in plugins/mechanism/Network.py in Blueman before 2.0.3 allows local users to gain privileges via the dhcp_handler argument.
Near-miss passage: CVE-2015-1814. CWE: CWE-264. CVSS: 7.5. The API token-issuing service in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to gain privileges via a "forced API token change" involving anonymous users.
Query: rule covering Detects certificate creation with template allowing risk permission subject and risky EKU
Matching passage: Sigma rule: Detects certificate creation with template allowing risk permission subject and risky EKU. Logsource: windows / security. Rule: title: ADCS Certificate Template Configuration Vulnerability with Risky EKU id: bfbd3291-de87-4b7c-88a2-d6a5deb28668 status: test description: Detects certificate creation with template allowing risk permission subject and risky EKU references: - https://www.specterops.io/assets/resources/Certified_Pre-Owned.pdf author: Orlinum , BlueDefenZer date: 2021-11-17 modified: 2022-12-25 tags: - attack.privilege-escalation - attack.credential-access logsource: product: windows service: security definition: Certificate services loaded a template would trigger event ID 4898 and certificate Services template was updated would trigger event ID 4899. A risk permission seems to be coming if template contain specific flag with risky EKU. detection: selection10: EventID: 4898 TemplateContent|contains: - 1.3.6.1.5.5.7.3.2 - 1.3.6.1.5.2.3.4 - 1.3.6.1.4.1.311.20.2.2 - 2.5.29.37.0 selection11: TemplateContent|contains: CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT selection20: EventID: 4899 NewTemplateContent|contains: - 1.3.6.1.5.5.7.3.2 - 1.3.6.1.5.2.3.4 - 1.3.6.1.4.1.311.20.2.2 - 2.5.29.37.0 selection21: NewTemplateContent|contains: CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT condition: (selection10 and selection11) or (selection20 and selection21) falsepositives: - Administrator activity - Proxy SSL certificate with subject modification - Smart card enrollement level: high
Near-miss passage: Sigma rule: Detects execution of Remote Utilities RAT (RURAT) from an unusual location (outside of 'C:\Program Files'). Logsource: windows / process_creation. Rule: title: Remote Access Tool - RURAT Execution From Unusual Location id: e01fa958-6893-41d4-ae03-182477c5e77d status: test description: Detects execution of Remote Utilities RAT (RURAT) from an unusual location (outside of 'C:\Program Files') references: - https://redcanary.com/blog/misbehaving-rats/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-19 modified: 2023-03-05 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: - Image|endswith: - \rutserv.exe - \rfusclient.exe - Product: Remote Utilities filter: Image|startswith: - C:\Program Files\Remote Utilities - C:\Program Files (x86)\Remote Utilities condition: selection and not filter falsepositives: - Unknown level: medium
Query: CVE similar to CVE-2015-7242
Matching passage: CVE-2015-7242. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the Push-Service-Mails feature in AVM FRITZ!OS before 6.30 allows remote attackers to inject arbitrary web script or HTML via the display name in the FROM field of an SIP INVITE message.
Near-miss passage: CVE-2015-7796. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-7795, CVE-2015-7797, CVE-2015-7798, CVE-2016-1149, and CVE-2016-1150.
Query: patch priority for CVE-2015-7399
Matching passage: CVE-2015-7399. CWE: CWE-200. CVSS: 5.300000190734863. IBM WebSphere Message Broker 7 before 7.0.0.8 and 8 before 8.0.0.6 and IBM Integration Bus 9 before 9.0.0.3 and 10 before 10.0.0.0 allow remote attackers to obtain sensitive information about the HTTP server via unspecified vectors.
Near-miss passage: CVE-2015-1111. CWE: CWE-200. CVSS: 5.0. Safari in Apple iOS before 8.3 does not delete Recently Closed Tabs data in response to a history-clearing action, which allows attackers to obtain sensitive information by reading a history file.
Query: CVE similar to CVE-2015-1805
Matching passage: CVE-2015-1805. CWE: CWE-17. CVSS: 7.199999809265137. The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in the Linux kernel before 3.16 do not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allows local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an "I/O vector array overrun."
Near-miss passage: CVE-2015-1452. CWE: CWE-17. CVSS: 7.800000190734863. The Control and Provisioning of Wireless Access Points (CAPWAP) daemon in Fortinet FortiOS 5.0 Patch 7 build 4457 allows remote attackers to cause a denial of service (locked CAPWAP Access Controller) via a large number of ClientHello DTLS messages.
Query: SOC runbook when seeing Suspicious Patch System Image execution detected on endpoint
Matching passage: Playbook for T1601.001 Patch System Image. 1) Validate alert telemetry against T1601.001. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: defense impairment. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may modify the operating system of a network device to introduce new capabilities or weaken existing defenses.(Citation: Killing the myth of Cisco IOS rootkits) (Citation: Killing IOS diversity myth) (Citation: Cisco IOS Shellcode) (Citation: Cisco IOS Forensics Developments) (Citation: Juniper Netscreen of the Dead) Some network devices are built with a monolithic architecture, where
Near-miss passage: Playbook for T1601 Modify System Image. Different response path focused on defense impairment.
Query: patch priority for CVE-2015-1966
Matching passage: CVE-2015-1966. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before FP17, 6.2.1 before FP9, and 6.2.2 before FP15, as used in Security Access Manager for Mobile and other products, allow remote attackers to inject arbitrary web script or HTML via a crafted URL, related to the (1) ERROR_DESCRIPTION and (2) TOKEN:RelayState macros.
Near-miss passage: CVE-2015-5181. CWE: CWE-79. CVSS: 5.400000095367432. The JBoss console in A-MQ allows remote attackers to execute arbitrary JavaScript.
Query: CVE similar to CVE-2015-0604
Matching passage: CVE-2015-0604. CWE: CWE-20. CVSS: 5.0. The web framework on Cisco Unified IP 9900 phones with firmware 9.4(.1) and earlier allows remote attackers to upload files to arbitrary locations on a phone's filesystem via crafted HTTP requests, aka Bug ID CSCup90424.
Near-miss passage: CVE-2015-4393. CWE: CWE-20. CVSS: 6.0. The resource/endpoint for uploading files in the Services module 7.x-3.x before 7.x-3.12 for Drupal allows remote authenticated users with the "Save file information" permission to execute arbitrary code via a crafted filename.
Query: rule covering Detects Obfuscated use of stdin to execute PowerShell
Matching passage: Sigma rule: Detects Obfuscated use of stdin to execute PowerShell. Logsource: windows / process_creation. Rule: title: Invoke-Obfuscation STDIN+ Launcher id: 6c96fc76-0eb1-11eb-adc1-0242ac120002 status: test description: Detects Obfuscated use of stdin to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-15 modified: 2024-04-15 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: CommandLine|re: cmd.{0,5}(?:/c|/r).+powershell.+(?:\$\{?input\}?|noexit).+\" condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects an office suit application (Word, Excel, PowerPoint, Outlook) communicating to target systems over uncommon port. Logsource: windows / network_connection. Rule: title: Office Application Initiated Network Connection Over Uncommon Ports id: 3b5ba899-9842-4bc2-acc2-12308498bf42 status: test description: Detects an office suit application (Word, Excel, PowerPoint, Outlook) communicating to target systems over uncommon ports. references: - https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2023-07-12 modified: 2025-10-17 tags: - attack.command-and-control - attack.stealth logsource: category: network_connection product: windows detection: selection: Initiated: 'true' Image|endswith: - \excel.exe - \outlook.exe - \powerpnt.exe - \winword.exe - \wordview.exe filter_main_common_ports: DestinationPort: - 53 - 80 - 139 - 389 - 443 - 445 - 3268 filter_main_outlook_ports: Image|contains: :\Program Files\Microsoft Office\ Image|endswith: \OUTLOOK.EXE DestinationPort: - 143 - 465 - 587 - 993 - 995 condition: selection and not 1 of filter_main_* falsepositives: - Other ports can be used, apply additional filters accordingly level: medium
Query: exploit Cross-site request forgery (CSRF) vulnerability in bBlog allows remote attackers to hijack the authentication of arbitrary users.
Matching passage: CVE-2015-0905. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in bBlog allows remote attackers to hijack the authentication of arbitrary users.
Near-miss passage: CVE-2015-7936. CWE: CWE-352. CVSS: 7.5. Cross-site request forgery (CSRF) vulnerability in Motorola Solutions MOSCAD IP Gateway allows remote attackers to hijack the authentication of administrators for requests that modify a password.
Query: exploit Multiple cross-site request forgery (CSRF) vulnerabilities in the optionsPageRequest function in admin.php in WP Fastest Cache plugin before 0.8.3.5 for WordPress allow remote atta
Matching passage: CVE-2015-4089. CWE: CWE-352. CVSS: 8.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the optionsPageRequest function in admin.php in WP Fastest Cache plugin before 0.8.3.5 for WordPress allow remote attackers to hijack the authentication of unspecified victims for requests that call the (1) saveOption, (2) deleteCache, (3) deleteCssAndJsCache, or (4) addCacheTimeout method via the wpFastestCachePage parameter in the WpFastestCacheOptions/ page.
Near-miss passage: CVE-2015-7936. CWE: CWE-352. CVSS: 7.5. Cross-site request forgery (CSRF) vulnerability in Motorola Solutions MOSCAD IP Gateway allows remote attackers to hijack the authentication of administrators for requests that modify a password.