alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit Unspecified vulnerability in Oracle Java SE 7u72 and 8u25 allows local users to affect integrity via unknown vectors related to Serviceability.
Matching passage: CVE-2015-0413. CWE: UNKNOWN. CVSS: 1.899999976158142. Unspecified vulnerability in Oracle Java SE 7u72 and 8u25 allows local users to affect integrity via unknown vectors related to Serviceability.
Near-miss passage: CVE-2015-0303. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0306.
Query: describe CVE-2015-1423
Matching passage: CVE-2015-1423. CWE: CWE-89. CVSS: 6.5. Multiple SQL injection vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote administrators to execute arbitrary SQL commands via the (1) jak_delete_log[] or (2) ssp parameter to admin/index.php.
Near-miss passage: CVE-2015-3947. CWE: CWE-89. CVSS: 8.100000381469727. SQL injection vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Query: Sigma YAML for windows / file_event
Matching passage: Sigma rule: Detects the use of NPPSpy hacktool that stores cleartext passwords of users that logged in to a local file. Logsource: windows / file_event. Rule: title: HackTool - NPPSpy Hacktool Usage id: cad1fe90-2406-44dc-bd03-59d0b58fe722 status: test description: Detects the use of NPPSpy hacktool that stores cleartext passwords of users that logged in to a local file references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003/T1003.md#atomic-test-2---credential-dumping-with-nppspy - https://twitter.com/0gtweet/status/1465282548494487554 author: Florian Roth (Nextron Systems) date: 2021-11-29 modified: 2024-06-27 tags: - attack.credential-access logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: - \NPPSpy.txt - \NPPSpy.dll condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the use of powershell commands from headless ConHost window. The "--headless" flag hides the windows from the us. Logsource: windows / process_creation. Rule: title: Powershell Executed From Headless ConHost Process id: 056c7317-9a09-4bd4-9067-d051312752ea related: - id: 00ca75ab-d5ce-43be-b86c-55ff39c6abfc type: derived status: test description: 'Detects the use of powershell commands from headless ConHost window. The "--headless" flag hides the windows from the user upon execution. ' references: - https://www.huntress.com/blog/fake-browser-updates-lead-to-boinc-volunteer-computing-software author: Matt Anderson (Huntress) date: 2024-07-23 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1059.003 - attack.t1564.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \conhost.exe - OriginalFileName: CONHOST.EXE selection_cli: CommandLine|contains|all: - --headless - powershell condition: all of selection_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_conhost_headless_powershell/info.yml
Query: risk of Unrestricted file upload vulnerability in EMC M&R (aka Watch4Net) before 6.5u1 and ViPR SRM before 3.6.1 allows remote authenticated users to execute arbitrary code by uploading an
Matching passage: CVE-2015-0515. CWE: UNKNOWN. CVSS: 6.5. Unrestricted file upload vulnerability in EMC M&R (aka Watch4Net) before 6.5u1 and ViPR SRM before 3.6.1 allows remote authenticated users to execute arbitrary code by uploading and then accessing an executable file.
Near-miss passage: CVE-2015-3127. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3118, CVE-2015-3124, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, CVE-2015-4430, and CVE-2015-5117.
Query: describe CVE-2015-4177
Matching passage: CVE-2015-4177. CWE: UNKNOWN. CVSS: 5.5. The collect_mounts function in fs/namespace.c in the Linux kernel before 4.0.5 does not properly consider that it may execute after a path has been unmounted, which allows local users to cause a denial of service (system crash) by leveraging user-namespace root access for an MNT_DETACH umount2 system call.
Near-miss passage: CVE-2015-6463. CWE: UNKNOWN. CVSS: 5.800000190734863. CodeWrights HART Comm DTM components, as used with Endress+Hauser FieldCare, allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a longtag XML schema containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Query: exploit Multiple unspecified vulnerabilities in Google Chrome before 41.0.2272.76 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Matching passage: CVE-2015-1231. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in Google Chrome before 41.0.2272.76 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Near-miss passage: CVE-2015-8403. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: vulnerability: Fortinet FortiAuthenticator 3.0.0 logs the PostgreSQL usernames and passwords in cleartext, which allows remote administrators to obtain sensitive information by reading the log at
Matching passage: CVE-2015-1456. CWE: CWE-200. CVSS: 4.0. Fortinet FortiAuthenticator 3.0.0 logs the PostgreSQL usernames and passwords in cleartext, which allows remote administrators to obtain sensitive information by reading the log at debug/startup/.
Near-miss passage: CVE-2015-1323. CWE: CWE-200. CVSS: 5.5. The simulate dbus method in aptdaemon before 1.1.1+bzr982-0ubuntu3.1 as packaged in Ubuntu 15.04, before 1.1.1+bzr980-0ubuntu1.1 as packaged in Ubuntu 14.10, before 1.1.1-1ubuntu5.2 as packaged in Ubuntu 14.04 LTS, before 0.43+bzr805-0ubuntu10 as packaged in Ubuntu 12.04 LTS allows local users to obtain sensitive information, or access files with root permissions.
Query: ATT&CK technique for Remote Email Collection
Matching passage: T1114.002 Remote Email Collection. Tactics: collection. Description: Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens. Tools such as [MailSniper](https://attack.mitre.org/software/S0413) can be used to automate searches for specific keywords.
Near-miss passage: T1114 Email Collection. Tactics: collection. Description: Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques in order to maintain persistence or evade defenses.(Citation: TrustedSec OOB Communications)(Citation: CISA AA20-352A 2021) Adversaries can collect or forward email from mail servers or clients.
Query: patch priority for CVE-2015-10094
Matching passage: CVE-2015-10094. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability was found in Fastly Plugin up to 0.97 on WordPress. It has been rated as problematic. Affected by this issue is the function post of the file lib/api.php. The manipulation of the argument url leads to cross site scripting. The attack may be launched remotely. Upgrading to version 0.98 is able to address this issue. The patch is identified as d7fe42538f4d4af500e3af9678b6b06fba731656. It is recommended to upgrade the affected component. VDB-222326 is the identifier assigned to this vulnerability.
Near-miss passage: CVE-2015-6511. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in pfSense before 2.2.3 allows remote attackers to inject arbitrary web script or HTML via the server[] parameter to services_ntpd.php.
Query: risk of Unspecified vulnerability in HP Software Update before 5.005.002.002 allows local users to gain privileges via unknown vectors.
Matching passage: CVE-2015-5442. CWE: UNKNOWN. CVSS: 4.599999904632568. Unspecified vulnerability in HP Software Update before 5.005.002.002 allows local users to gain privileges via unknown vectors.
Near-miss passage: CVE-2015-2050. CWE: UNKNOWN. CVSS: 10.0. D-Link DAP-1320 Rev Ax with firmware before 1.21b05 allows attackers to execute arbitrary commands via unspecified vectors.
Query: CVE similar to CVE-2015-2885
Matching passage: CVE-2015-2885. CWE: CWE-798. CVSS: 9.800000190734863. Lens Peek-a-View has a password of 2601hx for the backdoor admin account, a password of user for the backdoor user account, and a password of guest for the backdoor guest account.
Near-miss passage: CVE-2015-7246. CWE: CWE-798. CVSS: 9.800000190734863. D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 has a default password of root for the root account and tw for the tw account, which makes it easier for remote attackers to obtain administrative access.
Query: vulnerability: Multiple cross-site scripting (XSS) vulnerabilities in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.
Matching passage: CVE-2015-3300. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allow remote attackers to inject arbitrary web script or HTML via the (1) billing_firstname, (2) billing_lastname, (3) billing_company, (4) billing_tax_id_number, (5) billing_city, (6) billing_street, (7) billing_street_2, (8) billing_postcode, (9) billing_telephone_1, (10) billing_telephone_2, (11) billing_fax, (12) shipping_firstname, (13) shipping_lastname, (14) shipping_company, (15) shipping_tax_id_number, (16) shipping_city, (17) shipping_street, (18) shipping_street_2, (19) shipping_postcode, (20) shipping_telephone_1, (21) shipping_telephone_2, or (22) shipping_fax parameter to shopping-cart/checkout/; the (23) search_by parameter in the admin/AddressesList.php page to wp-admin/admin.php; the (24) address_id, (25) address_name, (26) firstname, (27) lastname, (28) street, (29) city, (30) postcode, or (31) email parameter in the admin/AddressEdit.php page to wp-admin/admin.php; the (32) post_id or (33) rel_type parameter in the admin/AssignedCategoriesList.php page to wp-admin/admin.php; or the (34) post_type parameter in the admin/CustomFieldsList.php page to wp-admin/admin.php.
Near-miss passage: CVE-2015-4377. CWE: CWE-79. CVSS: 2.0999999046325684. Cross-site scripting (XSS) vulnerability in unspecified administration pages in the Petition module 6.x-1.x before 6.x-1.3 for Drupal allows remote authenticated users with the "create petition" permission to inject arbitrary web script or HTML via unknown vectors.
Query: write Sigma for Detects the use of a renamed SysInternals Sdelete, which is something an administrator shouldn't do (the renaming)
Matching passage: Sigma rule: Detects the use of a renamed SysInternals Sdelete, which is something an administrator shouldn't do (the renaming). Logsource: windows / process_creation. Rule: title: Renamed Sysinternals Sdelete Execution id: c1d867fe-8d95-4487-aab4-e53f2d339f90 status: test description: Detects the use of a renamed SysInternals Sdelete, which is something an administrator shouldn't do (the renaming) references: - https://learn.microsoft.com/en-us/sysinternals/downloads/sdelete - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md author: Florian Roth (Nextron Systems) date: 2022-09-06 modified: 2026-06-29 tags: - attack.impact - attack.t1485 logsource: category: process_creation product: windows detection: selection: OriginalFileName: sdelete.exe filter: Image|endswith: - \sdelete.exe - \sdelete64.exe - \sdelete64a.exe condition: selection and not filter falsepositives: - System administrator usage level: high
Near-miss passage: Sigma rule: Detects execution of Advanced Installer MSIX Package Support Framework (PSF) components, specifically AI_STUBS executabl. Logsource: windows / process_creation. Rule: title: Windows MSIX Package Support Framework AI_STUBS Execution id: af5732ed-764e-489d-826d-0447c8b36242 status: experimental description: 'Detects execution of Advanced Installer MSIX Package Support Framework (PSF) components, specifically AI_STUBS executables with original filename ''popupwrapper.exe''. This activity may indicate malicious MSIX packages build with Advanced Installer leveraging the Package Support Framework to bypass application control restrictions. ' references: - https://redcanary.com/blog/threat-intelligence/msix-installers/ - https://redcanary.com/threat-detection-report/techniques/installer-packages/ - https://learn.microsoft.com/en-us/windows/msix/package/package-support-framework - https://www.splunk.com/en_us/blog/security/msix-weaponization-threat-detection-splunk.html author: Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-03 tags: - attack.execution - attack.stealth - attack.defense-impairment - attack.t1218 - attack.t1553.005 - attack.t1204.002 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \AI_STUBS\AiStubX64Elevated.exe - \AI_STUBS\AiStubX86Elevated.exe - \AI_STUBS\AiStubX64.exe - \AI_STUBS\AiStubX86.exe OriginalFileName: popupwrapper.exe condition: selection falsepositives: - Legitimate applications packaged with Advanced Installer using Package Support Framework level: low
Query: Sigma rule for Detects the installation of a well-known TAP driver service. This could be a sign of potential preparation for data exfi
Matching passage: Sigma rule: Detects the installation of a well-known TAP driver service. This could be a sign of potential preparation for data exfi. Logsource: windows / security. Rule: title: Tap Driver Installation - Security id: 9c8afa4d-0022-48f0-9456-3712466f9701 related: - id: 8e4cf0e5-aa5d-4dc3-beff-dc26917744a9 type: derived status: test description: 'Detects the installation of a well-known TAP driver service. This could be a sign of potential preparation for data exfiltration using tunnelling techniques. ' references: - https://community.openvpn.net/openvpn/wiki/ManagingWindowsTAPDrivers author: Daniil Yugoslavskiy, Ian Davis, oscd.community date: 2019-10-24 modified: 2022-11-29 tags: - attack.exfiltration - attack.t1048 logsource: product: windows service: security definition: 'Requirements: The System Security Extension audit subcategory need to be enabled to log the EID 4697' detection: selection: EventID: 4697 ServiceFileName|contains: tap0901 condition: selection falsepositives: - Legitimate OpenVPN TAP installation level: low
Near-miss passage: Sigma rule: Detects execution of renamed Remote Utilities (RURAT) via Product PE header field. Logsource: windows / process_creation. Rule: title: Renamed Remote Utilities RAT (RURAT) Execution id: 9ef27c24-4903-4192-881a-3adde7ff92a5 status: test description: Detects execution of renamed Remote Utilities (RURAT) via Product PE header field references: - https://redcanary.com/blog/misbehaving-rats/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-19 modified: 2023-02-03 tags: - attack.collection - attack.command-and-control - attack.discovery - attack.stealth - attack.s0592 logsource: category: process_creation product: windows detection: selection: Product: Remote Utilities filter: Image|endswith: - \rutserv.exe - \rfusclient.exe condition: selection and not filter falsepositives: - Unknown level: medium
Query: explain T1070 Indicator Removal
Matching passage: T1070 Indicator Removal. Tactics: stealth. Description: Adversaries may selectively delete or modify artifacts generated to reduce indications of their presence and blend in with legitimate activity. Rather than broadly removing evidence, adversaries may target specific artifacts that appear anomalous or are likely to draw scrutiny, while leaving sufficient data intact to maintain the appearance of normal system behavior. Artifacts such as command histories, log entries, or file metadata may be altered in ways that align with expected user or system activity. Location, format, and type of artifact (such as command or login history) are often platform-specific, allowing adversaries to tailor modifications that minimize suspicion. These actions may not prevent detection entirely but can delay recognition of malicious activity or reduce the fidelity of alerts by making events appear benign or consistent with routine operations. Additionally, selectively removed or modified artifacts may still be recoverable through deeper forensic analysis, though their absence or alteration can complicate timeline reconstruction and attribution.
Near-miss passage: T1070.009 Clear Persistence. Tactics: stealth. Description: Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity. This may involve various actions, such as removing services, deleting executables, [Modify Registry](https://attack.mitre.org/techniques/T1112), [Plist File Modification](https://attack.mitre.org/techniques/T1647), or other methods of cleanup to prevent defenders from collecting evidence of their persistent presence.(Citation: Cylance Dust Storm) Adversaries may also delete accounts previously created to maintain persistence (i.e. [Create Account](https://attack.mitre.org/techniques/T1136)).(Citation: Talos - Cisco Attack 2022) In some instances, artifacts of persistence may also be removed once an adversary’s persistence is executed in order to prevent errors with the new instance of the malware.(Citation: NCC Group Team9 June 2020)
Query: patch priority for CVE-2015-7216
Matching passage: CVE-2015-7216. CWE: CWE-20. CVSS: 6.800000190734863. The gdk-pixbuf configuration in Mozilla Firefox before 43.0 on Linux GNOME platforms incorrectly enables the JasPer decoder, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted JPEG 2000 image.
Near-miss passage: CVE-2015-8704. CWE: CWE-20. CVSS: 6.5. apl_42.c in ISC BIND 9.x before 9.9.8-P3, 9.9.x, and 9.10.x before 9.10.3-P3 allows remote authenticated users to cause a denial of service (INSIST assertion failure and daemon exit) via a malformed Address Prefix List (APL) record.
Query: detection rule: Detects suspicious PowerShell scripts accessing SAM hives
Matching passage: Sigma rule: Detects suspicious PowerShell scripts accessing SAM hives. Logsource: windows / process_creation. Rule: title: PowerShell SAM Copy id: 1af57a4b-460a-4738-9034-db68b880c665 status: test description: Detects suspicious PowerShell scripts accessing SAM hives references: - https://twitter.com/splinter_code/status/1420546784250769408 author: Florian Roth (Nextron Systems) date: 2021-07-29 modified: 2023-01-06 tags: - attack.credential-access - attack.t1003.002 logsource: category: process_creation product: windows detection: selection_1: CommandLine|contains|all: - \HarddiskVolumeShadowCopy - System32\config\sam selection_2: CommandLine|contains: - Copy-Item - cp $_. - cpi $_. - copy $_. - .File]::Copy( condition: all of selection* falsepositives: - Some rare backup scenarios - PowerShell scripts fixing HiveNightmare / SeriousSAM ACLs level: high
Near-miss passage: Sigma rule: Detects scheduled task creation using "schtasks" that contain potentially suspicious or uncommon commands. Logsource: windows / process_creation. Rule: title: Suspicious Command Patterns In Scheduled Task Creation id: f2c64357-b1d2-41b7-849f-34d2682c0fad status: test description: Detects scheduled task creation using "schtasks" that contain potentially suspicious or uncommon commands references: - https://app.any.run/tasks/512c1352-6380-4436-b27d-bb62f0c020d6/ - https://twitter.com/RedDrip7/status/1506480588827467785 - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/devil-bait/NCSC-MAR-Devil-Bait.pdf author: Florian Roth (Nextron Systems) date: 2022-02-23 modified: 2024-03-19 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1053.005 logsource: product: windows category: process_creation detection: selection_schtasks: Image|endswith: \schtasks.exe CommandLine|contains: '/Create ' selection_pattern_1: CommandLine|contains: - '/sc minute ' - '/ru system ' selection_pattern_2: CommandLine|contains: - cmd /c - cmd /k - cmd /r - 'cmd.exe /c ' - 'cmd.exe /k ' - 'cmd.exe /r ' selection_uncommon: CommandLine|contains: - ' -decode ' - ' -enc ' - ' -w hidden ' - ' bypass ' - ' IEX' - .DownloadData - .DownloadFile - .DownloadString - '/c start /min ' - FromBase64String - mshta http - mshta.exe http selection_anomaly_1: CommandLine|contains: - :\ProgramData\ - :\Temp\ - :\Tmp\ - :\Users\Public\ - :\Windows\Temp\ - \AppData\ - '%AppData%' - '%Temp%' - '%tmp%' selection_anomaly_2: CommandLine|contains: - cscript - curl - wscript condition: selection_schtasks and ( all of selection_pattern_* or selection_uncommon or all of selection_anomaly_* ) falsepositives: - Software installers that run from temporary folders and also install scheduled tasks are expected to generate some false positives level: high