alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: Multiple cross-site request forgery (CSRF) vulnerabilities in Horde before 5.2.8, Horde Groupware before 5.2.11, and Horde Groupware Webmail Edition before 5.2.11 allow remote atta
Matching passage: CVE-2015-7984. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in Horde before 5.2.8, Horde Groupware before 5.2.11, and Horde Groupware Webmail Edition before 5.2.11 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary (1) commands via the cmd parameter to admin/cmdshell.php, (2) SQL queries via the sql parameter to admin/sqlshell.php, or (3) PHP code via the php parameter to admin/phpshell.php.
Near-miss passage: CVE-2015-1585. CWE: CWE-352. CVSS: 6.800000190734863. Fat Free CRM before 0.13.6 allows remote attackers to conduct cross-site request forgery (CSRF) attacks via a request without the authenticity_token, as demonstrated by a crafted HTML page that creates a new administrator account.
Query: CVE similar to CVE-2015-0477
Matching passage: CVE-2015-0477. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect integrity via unknown vectors related to Beans.
Near-miss passage: CVE-2015-0384. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in the Siebel Public Sector component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect integrity via unknown vectors related to Public Sector Portal.
Query: lateral movement using SSH Hijacking
Matching passage: T1563.001 SSH Hijacking. Tactics: lateral movement. Description: Adversaries may hijack a legitimate user's SSH session to move laterally within an environment. Secure Shell (SSH) is a standard means of remote access on Linux and macOS systems. It allows a user to connect to another system via an encrypted tunnel, commonly authenticating through a password, certificate or the use of an asymmetric encryption key pair. In order to move laterally from a compromised host, adversaries may take advantage of trust relationships established with other systems via public key authentication in active SSH sessions by hijacking an existing connection to another system. This may occur through compromising the SSH agent itself or by having access to the agent's socket. If an adversary is able to obtain root access, then hijacking SSH sessions is likely trivial.(Citation: Slideshare Abusing SSH)(Citation: SSHjack Blackhat)(Citation: Clockwork SSH Agent Hijacking)(Citation: Breach Post-mortem SSH Hijack) [SSH Hijacking](https://attack.mitre.org/techniques/T1563/001) differs from use of [SSH](https://attack.mitre.org/techniques/T1021/004) because it hijacks an existing SSH session rather than creating a new session using [Valid Accounts](https://attack.mitre.org/techniques/T1078).
Near-miss passage: T1563 Remote Service Session Hijacking. Tactics: lateral movement. Description: Adversaries may take control of preexisting sessions with remote services to move laterally in an environment. Users may use valid credentials to log into a service specifically designed to accept remote connections, such as telnet, SSH, and RDP. When a user logs into a service, a session will be established that will allow them to maintain a continuous interaction with that service. Adversaries may commandeer these sessions to carry out actions on remote systems. [Remote Service Session Hijacking](https://attack.mitre.org/techniques/T1563) differs from use of [Remote Services](https://attack.mitre.org/techniques/T1021) because it hijacks an existing session rather than creating a new session using [Valid Accounts](https://attack.mitre.org/techniques/T1078).(Citation: RDP Hijacking Medium)(Citation: Breach Post-mortem SSH Hijack)
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects attempts to delete Internet Information Services (IIS) log files via command line utilities, which is a common d. Logsource: windows / process_creation. Rule: title: IIS WebServer Log Deletion via CommandLine Utilities id: 0649be4a-aeb0-45b0-b89e-7f1668f6d9c0 related: - id: 3eb8c339-a765-48cc-a150-4364c04652bf type: similar status: experimental description: 'Detects attempts to delete Internet Information Services (IIS) log files via command line utilities, which is a common defense evasion technique used by attackers to cover their tracks. Threat actors often abuse vulnerabilities in web applications hosted on IIS servers to gain initial access and later delete IIS logs to evade detection. ' references: - https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/managing-iis-log-file-storage author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-09-02 tags: - attack.stealth - attack.t1070 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \cmd.exe - \powershell_ise.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - cmd.exe - powershell.exe - powershell_ise.exe - pwsh.dll selection_cli_del: CommandLine|contains: - 'del ' - 'erase ' - 'rm ' - 'remove-item ' - 'rmdir ' selection_cli_iis_dir: CommandLine|contains: \inetpub\logs\ condition: all of selection_* falsepositives: - Deletion of IIS logs that are older than a certain retention period as part of regular maintenance activities. - Legitimate schedule tasks or scripts that clean up log files regularly. level: medium
Near-miss passage: Sigma rule: Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspici. Logsource: linux / process_creation. Rule: title: Suspicious Git Clone - Linux id: cfec9d29-64ec-4a0f-9ffe-0fdb856d5446 status: test description: Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspicious references: - https://gist.githubusercontent.com/MichaelKoczwara/12faba9c061c12b5814b711166de8c2f/raw/e2068486692897b620c25fde1ea258c8218fe3d3/history.txt author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-03 modified: 2023-01-05 tags: - attack.reconnaissance - attack.t1593.003 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: /git CommandLine|contains: ' clone ' selection_keyword: CommandLine|contains: - exploit - Vulns - vulnerability - RCE - RemoteCodeExecution - Invoke- - CVE- - poc- - ProofOfConcept - proxyshell - log4shell - eternalblue - eternal-blue - MS17- condition: all of selection_* falsepositives: - Unknown level: medium
Query: secure coding against Inconsistent Naming Conventions for Identifiers
Matching passage: CWE-1099 Inconsistent Naming Conventions for Identifiers. The product's code, documentation, or other artifacts do not consistently use the same naming conventions for variables, callables, groups of related callables, I/O capabilities, data types, file names, or similar types of elements.
Near-miss passage: CWE-615 Inclusion of Sensitive Information in Source Code Comments. While adding general comments is very useful, some programmers tend to leave important data, such as: filenames related to the web application, old links or links which were not meant to be browsed by users, old code fragments, etc.
Query: detect Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH" in logs
Matching passage: Sigma rule: Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH". Logsource: windows / ps_script. Rule: title: Add Windows Capability Via PowerShell Script id: 155c7fd5-47b4-49b2-bbeb-eb4fab335429 related: - id: b36d01a3-ddaf-4804-be18-18a6247adfcd type: similar status: test description: Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH" and others. references: - https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse?tabs=powershell - https://www.virustotal.com/gui/file/af1c82237b6e5a3a7cdbad82cc498d298c67845d92971bada450023d1335e267/content author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-22 modified: 2023-05-09 tags: - attack.execution logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_cmdlet: ScriptBlockText|contains: 'Add-WindowsCapability ' selection_capa: ScriptBlockText|contains: -Name OpenSSH. condition: all of selection_* falsepositives: - Legitimate usage of the capabilities by administrators or users. Add additional filters accordingly. level: medium
Near-miss passage: Sigma rule: The Fax service attempts to load ualapi.dll, which is non-existent. An attacker can then (side)load their own malicious. Logsource: windows / image_load. Rule: title: Fax Service DLL Search Order Hijack id: 828af599-4c53-4ed2-ba4a-a9f835c434ea status: test description: The Fax service attempts to load ualapi.dll, which is non-existent. An attacker can then (side)load their own malicious DLL using this service. references: - https://windows-internals.com/faxing-your-way-to-system/ author: NVISO date: 2020-05-04 modified: 2022-06-02 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: Image|endswith: \fxssvc.exe ImageLoaded|endswith: ualapi.dll filter: ImageLoaded|startswith: C:\Windows\WinSxS\ condition: selection and not filter falsepositives: - Unlikely level: high
Query: CVE similar to CVE-2015-2955
Matching passage: CVE-2015-2955. CWE: CWE-78. CVSS: 7.5. Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.
Near-miss passage: CVE-2015-8557. CWE: CWE-78. CVSS: 9.0. The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.
Query: risk of epan/dissectors/packet-wcp.c in the WCP dissector in Wireshark 1.10.x before 1.10.14 and 1.12.x before 1.12.5 improperly refers to previously processed bytes, which allows remote a
Matching passage: CVE-2015-3811. CWE: CWE-17. CVSS: 5.0. epan/dissectors/packet-wcp.c in the WCP dissector in Wireshark 1.10.x before 1.10.14 and 1.12.x before 1.12.5 improperly refers to previously processed bytes, which allows remote attackers to cause a denial of service (application crash) via a crafted packet, a different vulnerability than CVE-2015-2188.
Near-miss passage: CVE-2015-1233. CWE: CWE-17. CVSS: 7.5. Google Chrome before 41.0.2272.118 does not properly handle the interaction of IPC, the Gamepad API, and Google V8, which allows remote attackers to execute arbitrary code via unspecified vectors.
Query: common weakness: Improper Export of Android Application Components
Matching passage: CWE-926 Improper Export of Android Application Components. The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.
Near-miss passage: CWE-820 Missing Synchronization. The product utilizes a shared resource in a concurrent manner but does not attempt to synchronize access to the resource.
Query: rule covering Detects the execution of the BitLocker Access Agent Update Utility (baaupdate.exe) which is not a common parent process
Matching passage: Sigma rule: Detects the execution of the BitLocker Access Agent Update Utility (baaupdate.exe) which is not a common parent process. Logsource: windows / process_creation. Rule: title: Suspicious BitLocker Access Agent Update Utility Execution id: 9f38c1db-e2ae-40bf-81d0-5b68f73fb512 related: - id: 6e8fe0a8-ba0b-4a93-8f9e-82657e7a5984 type: similar status: experimental description: 'Detects the execution of the BitLocker Access Agent Update Utility (baaupdate.exe) which is not a common parent process for other processes. Suspicious child processes spawned by baaupdate.exe could indicate an attempt at lateral movement via BitLocker DCOM & COM Hijacking. ' references: - https://github.com/rtecCyberSec/BitlockMove author: andrewdanis, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-10-18 tags: - attack.stealth - attack.t1218 - attack.lateral-movement - attack.t1021.003 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \baaupdate.exe Image|endswith: - \bitsadmin.exe - \cmd.exe - \cscript.exe - \mshta.exe - \powershell_ise.exe - \powershell.exe - \regsvr32.exe - \rundll32.exe - \schtasks.exe - \wmic.exe - \wscript.exe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects changes to the registry values related to outlook security settings. Logsource: windows / registry_set. Rule: title: Outlook Security Settings Updated - Registry id: c3cefdf4-6703-4e1c-bad8-bf422fc5015a related: - id: 6763c6c8-bd01-4687-bc8d-4fa52cf8ba08 type: similar status: test description: Detects changes to the registry values related to outlook security settings references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1137/T1137.md - https://learn.microsoft.com/en-us/outlook/troubleshoot/security/information-about-email-security-settings author: frack113 date: 2021-12-28 modified: 2026-01-09 tags: - attack.persistence - attack.t1137 logsource: category: registry_set product: windows detection: selection: TargetObject|contains|all: - \SOFTWARE\Microsoft\Office\ - \Outlook\Security\ filter_main_outlook: Image|startswith: - C:\Program Files\Microsoft Office\ - C:\Program Files (x86)\Microsoft Office\ Image|endswith: \OUTLOOK.EXE condition: selection and not 1 of filter_main_* falsepositives: - Administrative activity level: medium
Query: explain T1037 Boot or Logon Initialization Scripts
Matching passage: T1037 Boot or Logon Initialization Scripts. Tactics: persistence, privilege escalation. Description: Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.(Citation: Mandiant APT29 Eye Spy Email Nov 22)(Citation: Anomali Rocke March 2019) Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating system and whether applied locally or remotely. Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary. An adversary may also be able to escalate their privileges since some boot or logon initialization scripts run with higher privileges.
Near-miss passage: T1037.004 RC Scripts. Tactics: persistence, privilege escalation. Description: Adversaries may establish persistence by modifying RC scripts, which are executed during a Unix-like system’s startup. These files allow system administrators to map and start custom services at startup for different run levels. RC scripts require root privileges to modify. Adversaries may establish persistence by adding a malicious binary path or shell commands to <code>rc.local</code>, <code>rc.common</code>, and other RC scripts specific to the Unix-like distribution.(Citation: IranThreats Kittens Dec 2017)(Citation: Intezer HiddenWasp Map 2019) Upon reboot, the system executes the script's contents as root, resulting in persistence. Adversary abuse of RC scripts is especially effective for lightweight Unix-like distributions using the root user as default, such as ESXi hypervisors, IoT, or embedded systems.(Citation: intezer-kaiji-malware) As ESXi servers store most system files in memory and therefore discard changes on shutdown, leveraging `/etc/rc.local.d/local.sh` is one of the few mechanisms for enabling persistence across reboots.(Citation: Juniper Networks ESXi Backdoor 2022) Several Unix-like systems have moved to Systemd and deprecated the use of RC scripts. This is now a deprecated mechanism in macOS in favor of Launchd.(Citation: Apple Developer Doco Archive Launchd)(Citation: Startup Items) This technique can be used on Mac OS X Panther v10.3 and earlier versions which still execute the RC scripts.(Citation: Methods of Mac Malware Persistence) To maintain backwards compatibility some systems, such as Ubuntu, will execute the RC scripts if they exist with the correct file permissions.(Citation: Ubuntu Manpage systemd rc)
Query: patch priority for CVE-2015-6466
Matching passage: CVE-2015-6466. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Diagnosis Ping feature in the administrative web interface on Moxa EDS-405A and EDS-408A switches with firmware before 3.6 allows remote attackers to inject arbitrary web script or HTML via an unspecified field.
Near-miss passage: CVE-2015-0513. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in the administrative user interface in EMC M&R (aka Watch4Net) before 6.5u1 and ViPR SRM before 3.6.1 allow remote authenticated users to inject arbitrary web script or HTML by leveraging privileged access to set crafted values of unspecified fields.
Query: CWE for Generation of Error Message Containing Sensitive Information
Matching passage: CWE-209 Generation of Error Message Containing Sensitive Information. The product generates an error message that includes sensitive information about its environment, users, or associated data.
Near-miss passage: CWE-546 Suspicious Comment. The code contains comments that suggest the presence of bugs, incomplete functionality, or weaknesses.
Query: Outbound C2 pattern associated with Video Capture
Matching passage: T1125 Video Capture. Tactics: collection. Description: An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering information. Images may also be captured from devices or applications, potentially in specified intervals, in lieu of video files. Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture video or images. Video or image files may be written to disk and exfiltrated later. This technique differs from [Screen Capture](https://attack.mitre.org/techniques/T1113) due to use of specific devices or applications for video recording rather than capturing the victim's screen. In macOS, there are a few different malware samples that record the user's webcam such as FruitFly and Proton. (Citation: objective-see 2017 review)
Near-miss passage: T1602 Data from Configuration Repository. Tactics: collection. Description: Adversaries may collect data related to managed devices from configuration repositories. Configuration repositories are used by management systems in order to configure, manage, and control data on remote systems. Configuration repositories may also facilitate remote access and administration of devices. Adversaries may target these repositories in order to collect large quantities of sensitive system administration data. Data from configuration repositories may be exposed by various protocols and software and can store a wide variety of data, much of which may align with adversary Discovery objectives.(Citation: US-CERT-TA18-106A)(Citation: US-CERT TA17-156A SNMP Abuse 2017)
Query: Sigma rule for Detects a script interpreter wscript/cscript opening a network connection to a non-local network. Adversaries may use sc
Matching passage: Sigma rule: Detects a script interpreter wscript/cscript opening a network connection to a non-local network. Adversaries may use sc. Logsource: windows / network_connection. Rule: title: Outbound Network Connection Initiated By Script Interpreter id: 992a6cae-db6a-43c8-9cec-76d7195c96fc related: - id: 08249dc0-a28d-4555-8ba5-9255a198e08c type: derived status: test description: Detects a script interpreter wscript/cscript opening a network connection to a non-local network. Adversaries may use script to download malicious payloads. references: - https://github.com/redcanaryco/atomic-red-team/blob/28d190330fe44de6ff4767fc400cc10fa7cd6540/atomics/T1105/T1105.md author: frack113, Florian Roth (Nextron Systems) date: 2022-08-28 modified: 2024-03-13 tags: - attack.command-and-control - attack.t1105 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' Image|endswith: - \wscript.exe - \cscript.exe filter_main_local_ranges: DestinationIp|cidr: - 127.0.0.0/8 - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 filter_main_ms_ranges: DestinationIp|cidr: 20.0.0.0/11 condition: selection and not 1 of filter_main_* falsepositives: - Legitimate scripts level: high
Near-miss passage: Sigma rule: Detects System Information Discovery commands. Logsource: linux / auditd. Rule: title: System Information Discovery - Auditd id: f34047d9-20d3-4e8b-8672-0a35cc50dc71 status: test description: Detects System Information Discovery commands references: - https://github.com/redcanaryco/atomic-red-team/blob/f296668303c29d3f4c07e42bdd2b28d8dd6625f9/atomics/T1082/T1082.md author: Pawel Mazur date: 2021-09-03 modified: 2023-03-06 tags: - attack.discovery - attack.t1082 logsource: product: linux service: auditd detection: selection_1: type: PATH name: - /etc/lsb-release - /etc/redhat-release - /etc/issue selection_2: type: EXECVE a0: - uname - uptime - lsmod - hostname - env selection_3: type: EXECVE a0: grep a1|contains: - vbox - vm - xen - virtio - hv selection_4: type: EXECVE a0: kmod a1: list condition: 1 of selection_* falsepositives: - Likely level: low
Query: patch priority for CVE-2015-4211
Matching passage: CVE-2015-4211. CWE: CWE-264. CVSS: 7.199999809265137. Cisco AnyConnect Secure Mobility Client 3.1(60) on Windows does not properly validate pathnames, which allows local users to gain privileges via a crafted INF file, aka Bug ID CSCus65862.
Near-miss passage: CVE-2015-9011. CWE: CWE-264. CVSS: 9.800000190734863. An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36714882.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in the poll archive in PHPKIT 1.6.6 (Build 160014) allows remote attackers to inject arbitrary web script or HTML via the result parameter 
Matching passage: CVE-2015-1052. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the poll archive in PHPKIT 1.6.6 (Build 160014) allows remote attackers to inject arbitrary web script or HTML via the result parameter to upload_files/pk/include.php.
Near-miss passage: CVE-2015-5488. CWE: CWE-79. CVSS: 2.0999999046325684. Cross-site scripting (XSS) vulnerability in the MailChimp Signup submodule in the MailChimp module 7.x-3.x before 7.x-3.3 for Drupal allows remote authenticated users with the "administer mailchimp" permission to inject arbitrary web script or HTML via unspecified vectors.
Query: vulnerability: Siemens RUGGEDCOM ROS 3.8.0 through 4.1.x permanently enables the IP forwarding feature, which allows remote attackers to bypass a VLAN isolation protection mechanism via IP traffi
Matching passage: CVE-2015-6675. CWE: CWE-284. CVSS: 4.300000190734863. Siemens RUGGEDCOM ROS 3.8.0 through 4.1.x permanently enables the IP forwarding feature, which allows remote attackers to bypass a VLAN isolation protection mechanism via IP traffic.
Near-miss passage: CVE-2015-1376. CWE: CWE-284. CVSS: 4.0. pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not validate hostnames, which allows remote authenticated users to write to arbitrary files via an upload URL with a host other than pixabay.com.