alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: The default configuration of SGOS in Blue Coat ProxySG before 6.2.16.5, 6.5 before 6.5.7.1, and 6.6 before 6.6.2.1 forwards authentication challenges from upstream origin content s
Matching passage: CVE-2015-4334. CWE: CWE-200. CVSS: 5.0. The default configuration of SGOS in Blue Coat ProxySG before 6.2.16.5, 6.5 before 6.5.7.1, and 6.6 before 6.6.2.1 forwards authentication challenges from upstream origin content servers (OCS) when used in an explicit proxy deployment, which makes it easier for remote attackers to obtain sensitive information via a 407 (aka Proxy Authentication Required) HTTP status code, as demonstrated when using NTLM authentication.
Near-miss passage: CVE-2015-6052. CWE: CWE-200. CVSS: 4.300000190734863. The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, allow remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "VBScript and JScript ASLR Bypass."
Query: detect Detects when an attacker modifies the "REG_MULTI_SZ" value named "Extensions" to include a custom DLL to achieve persist in logs
Matching passage: Sigma rule: Detects when an attacker modifies the "REG_MULTI_SZ" value named "Extensions" to include a custom DLL to achieve persist. Logsource: windows / registry_set. Rule: title: Potential Persistence Via LSA Extensions id: 41f6531d-af6e-4c6e-918f-b946f2b85a36 status: test description: 'Detects when an attacker modifies the "REG_MULTI_SZ" value named "Extensions" to include a custom DLL to achieve persistence via lsass. The "Extensions" list contains filenames of DLLs being automatically loaded by lsass.exe. Each DLL has its InitializeLsaExtension() method called after loading. ' references: - https://persistence-info.github.io/Data/lsaaextension.html - https://twitter.com/0gtweet/status/1476286368385019906 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-21 modified: 2023-08-17 tags: - attack.persistence logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \SYSTEM\CurrentControlSet\Control\LsaExtensionConfig\LsaSrv\Extensions condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects when a GitHub Pages site of a repository is made public. This usually is part of a publishing process but could. Logsource: github / audit. Rule: title: GitHub Repository Pages Site Changed to Public id: 0c46d4f4-a2bf-4104-9597-8d653fc2bb55 status: experimental description: 'Detects when a GitHub Pages site of a repository is made public. This usually is part of a publishing process but could indicate or lead to potential unauthorized exposure of sensitive information or code. ' references: - https://docs.github.com/en/pages/getting-started-with-github-pages/creating-a-github-pages-site - https://www.sentinelone.com/blog/exploiting-repos-6-ways-threat-actors-abuse-github-other-devops-platforms - https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events author: Ivan Saakov date: 2025-10-18 tags: - attack.collection - attack.exfiltration - attack.t1567.001 logsource: product: github service: audit detection: selection: action: repo.pages_public condition: selection falsepositives: - Legitimate publishing of repository pages by authorized users level: low
Query: describe CVE-2015-5463
Matching passage: CVE-2015-5463. CWE: CWE-285. CVSS: 9.800000190734863. AxiomSL's Axiom java applet module (used for editing uploaded Excel files and associated Java RMI services) 9.5.3 and earlier allows remote attackers to (1) access data of other basic users through arbitrary SQL commands, (2) perform a horizontal and vertical privilege escalation, (3) cause a Denial of Service on global application, or (4) write/read/delete arbitrary files on server hosting the application.
Near-miss passage: CVE-2015-10033. CWE: CWE-285. CVSS: 6.5. A vulnerability, which was classified as problematic, was found in jvvlee MerlinsBoard. This affects an unknown part of the component Grade Handler. The manipulation leads to improper authorization. The identifier of the patch is 134f5481e2914b7f096cd92a22b1e6bcb8e6dfe5. It is recommended to apply a patch to fix this issue. The identifier VDB-217713 was assigned to this vulnerability.
Query: risk of ImageIO in Apple iOS before 8.4.1 and OS X before 10.10.5 does not properly initialize an unspecified data structure, which allows remote attackers to obtain sensitive information 
Matching passage: CVE-2015-5781. CWE: CWE-200. CVSS: 4.300000190734863. ImageIO in Apple iOS before 8.4.1 and OS X before 10.10.5 does not properly initialize an unspecified data structure, which allows remote attackers to obtain sensitive information from process memory via a crafted PNG image.
Near-miss passage: CVE-2015-2413. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to determine the existence of local files via a crafted module-resource request, aka "Internet Explorer Information Disclosure Vulnerability."
Query: describe CVE-2015-8869
Matching passage: CVE-2015-8869. CWE: CWE-119. CVSS: 9.100000381469727. OCaml before 4.03.0 does not properly handle sign extensions, which allows remote attackers to conduct buffer overflow attacks or obtain sensitive information as demonstrated by a long string to the String.copy function.
Near-miss passage: CVE-2015-7090. CWE: CWE-119. CVSS: 6.599999904632568. Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7086, CVE-2015-7087, CVE-2015-7088, CVE-2015-7089, CVE-2015-7091, CVE-2015-7092, and CVE-2015-7117.
Query: mitigate System Firmware
Matching passage: T1542.001 System Firmware. Tactics: stealth, persistence. Description: Adversaries may modify system firmware to persist on systems.The BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) or Extensible Firmware Interface (EFI) are examples of system firmware that operate as the software interface between the operating system and hardware of a computer.(Citation: Wikipedia BIOS)(Citation: Wikipedia UEFI)(Citation: About UEFI) System firmware like BIOS and (U)EFI underly the functionality of a computer and may be modified by an adversary to perform or assist in malicious activity. Capabilities exist to overwrite the system firmware, which may give sophisticated adversaries a means to install malicious firmware updates as a means of persistence on a system that may be difficult to detect.
Near-miss passage: T1542 Pre-OS Boot. Tactics: stealth, persistence. Description: Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system. During the booting process of a computer, firmware and various startup services are loaded before the operating system. These programs control flow of execution before the operating system takes control.(Citation: Wikipedia Booting) Adversaries may overwrite data in boot drivers or firmware such as BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) to persist on systems at a layer below the operating system. This can be particularly difficult to detect as malware at this level will not be detected by host software-based defenses.
Query: risk of The Newphoria Reversi application before 1.0.3 for Android and before 1.2 for iOS allows attackers to bypass a URL whitelist protection mechanism and obtain API access via unspecif
Matching passage: CVE-2015-5636. CWE: CWE-264. CVSS: 6.800000190734863. The Newphoria Reversi application before 1.0.3 for Android and before 1.2 for iOS allows attackers to bypass a URL whitelist protection mechanism and obtain API access via unspecified vectors.
Near-miss passage: CVE-2015-4231. CWE: CWE-264. CVSS: 3.5999999046325684. The Python interpreter in Cisco NX-OS 6.2(8a) on Nexus 7000 devices allows local users to bypass intended access restrictions and delete an arbitrary VDC's files by leveraging administrative privileges in one VDC, aka Bug ID CSCur08416.
Query: describe CVE-2015-6993
Matching passage: CVE-2015-6993. CWE: CWE-119. CVSS: 6.800000190734863. FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976, CVE-2015-6977, CVE-2015-6978, CVE-2015-6990, CVE-2015-6991, CVE-2015-7008, CVE-2015-7009, CVE-2015-7010, and CVE-2015-7018.
Near-miss passage: CVE-2015-3701. CWE: CWE-119. CVSS: 7.199999809265137. Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-3695, CVE-2015-3696, CVE-2015-3697, CVE-2015-3698, CVE-2015-3699, CVE-2015-3700, and CVE-2015-3702.
Query: detection rule: Detects suspicious child processes of Excel which could be an indicator of lateral movement leveraging the "ActivateMicr
Matching passage: Sigma rule: Detects suspicious child processes of Excel which could be an indicator of lateral movement leveraging the "ActivateMicr. Logsource: windows / process_creation. Rule: title: Potential Excel.EXE DCOM Lateral Movement Via ActivateMicrosoftApp id: 551d9c1f-816c-445b-a7a6-7a3864720d60 status: test description: 'Detects suspicious child processes of Excel which could be an indicator of lateral movement leveraging the "ActivateMicrosoftApp" Excel DCOM object. ' references: - https://posts.specterops.io/lateral-movement-abuse-the-power-of-dcom-excel-application-3c016d0d9922 - https://github.com/grayhatkiller/SharpExShell - https://learn.microsoft.com/en-us/office/vba/api/excel.xlmsapplication author: Aaron Stratton date: 2023-11-13 tags: - attack.t1021.003 - attack.lateral-movement logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \excel.exe selection_child: - OriginalFileName: - foxprow.exe - schdplus.exe - winproj.exe - Image|endswith: - \foxprow.exe - \schdplus.exe - \winproj.exe condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office add-ins can be used. Logsource: windows / ps_script. Rule: title: Code Executed Via Office Add-in XLL File id: 36fbec91-fa1b-4d5d-8df1-8d8edcb632ad status: test description: 'Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office add-ins can be used to add functionality to Office programs ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1137.006/T1137.006.md author: frack113 date: 2021-12-28 tags: - attack.persistence - attack.t1137.006 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - 'new-object ' - '-ComObject ' - .application - .RegisterXLL condition: selection falsepositives: - Unknown level: high
Query: risk of In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MSM8974, lack of length checking in OEMCrypto_DeriveKeysFromSessionKey() could lead to a 
Matching passage: CVE-2015-9179. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MSM8974, lack of length checking in OEMCrypto_DeriveKeysFromSessionKey() could lead to a buffer overflow vulnerability.
Near-miss passage: CVE-2015-7673. CWE: CWE-119. CVSS: 6.800000190734863. io-tga.c in gdk-pixbuf before 2.32.0 uses heap memory after its allocation failed, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) and possibly execute arbitrary code via a crafted Truevision TGA (TARGA) file.
Query: exploit Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel for Mac 2011 and 2016, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to 
Matching passage: CVE-2015-2523. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel for Mac 2011 and 2016, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-6073. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6068, CVE-2015-6072, CVE-2015-6075, CVE-2015-6077, CVE-2015-6079, CVE-2015-6080, and CVE-2015-6082.
Query: vulnerability: The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not properly perform type conversion for metrics values, which allows 
Matching passage: CVE-2015-1804. CWE: CWE-189. CVSS: 8.5. The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not properly perform type conversion for metrics values, which allows remote authenticated users to cause a denial of service (out-of-bounds memory access) and possibly execute arbitrary code via a crafted BDF font file.
Near-miss passage: CVE-2015-8891. CWE: CWE-189. CVSS: 7.800000190734863. Multiple integer overflows in app/aboot/aboot.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices allow attackers to bypass intended access restrictions via a crafted image, aka Android internal bug 28842418 and Qualcomm internal bug CR813930.
Query: Sigma rule for Detects when events are deleted in Kubernetes. An adversary may delete Kubernetes events in an attempt to evade detectio
Matching passage: Sigma rule: Detects when events are deleted in Kubernetes. An adversary may delete Kubernetes events in an attempt to evade detectio. Logsource: kubernetes / application / audit. Rule: title: Kubernetes Events Deleted id: 3132570d-cab2-4561-9ea6-1743644b2290 related: - id: 225d8b09-e714-479c-a0e4-55e6f29adf35 type: derived status: test description: 'Detects when events are deleted in Kubernetes. An adversary may delete Kubernetes events in an attempt to evade detection. ' references: - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Delete%20K8S%20events/ author: Leo Tsaousis (@laripping) date: 2024-03-26 tags: - attack.stealth - attack.t1070 logsource: category: application product: kubernetes service: audit detection: selection: verb: delete objectRef.resource: events condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects attempts to disable the Uncomplicated Firewall (UFW) on Linux systems. UFW is a popular firewall management tool. Logsource: linux / process_creation. Rule: title: UFW Disable Attempt id: 84c9e83c-599a-458a-a0cb-0ecce44e807a status: test description: 'Detects attempts to disable the Uncomplicated Firewall (UFW) on Linux systems. UFW is a popular firewall management tool that provides an easy-to-use interface for configuring firewall rules. Disabling UFW can leave a system vulnerable to attacks, as it may allow unauthorized access to network services and resources. ' references: - https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144 - https://manpages.debian.org/unstable/ufw/ufw-framework.8.en.html - https://www.cyberciti.biz/faq/linux-disable-firewall-command/ author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-01-18 modified: 2026-05-04 tags: - attack.defense-impairment - attack.t1686 logsource: product: linux category: process_creation detection: selection_ufw_init: Image|endswith: /ufw-init CommandLine|contains: - ' force-stop' - ' stop' - ' flush' selection_ufw_disable: CommandLine|contains|all: - 'ufw ' - disable condition: 1 of selection_* falsepositives: - Legitimate actions by system administrators to disable UFW. level: medium
Query: campaign using Office Test
Matching passage: T1137.002 Office Test. Tactics: persistence. Description: Adversaries may abuse the Microsoft Office "Office Test" Registry key to obtain persistence on a compromised system. An Office Test Registry location exists that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started. This Registry key is thought to be used by Microsoft to load DLLs for testing and debugging purposes while developing Office applications. This Registry key is not created by default during an Office installation.(Citation: Hexacorn Office Test)(Citation: Palo Alto Office Test Sofacy) There exist user and global Registry keys for the Office Test feature, such as: * <code>HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf</code> * <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Office test\Special\Perf</code> Adversaries may add this Registry key and specify a malicious DLL that will be executed whenever an Office application, such as Word or Excel, is started.
Near-miss passage: T1137 Office Application Startup. Tactics: persistence. Description: Adversaries may leverage Microsoft Office-based applications for persistence between startups. Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins. A variety of features have been discovered in Outlook that can be abused to obtain persistence, such as Outlook rules, forms, and Home Page.(Citation: SensePost Ruler GitHub) These persistence mechanisms can work within Outlook or be used through Office 365.(Citation: TechNet O365 Outlook Rules)
Query: CVE similar to CVE-2015-0430
Matching passage: CVE-2015-0430. CWE: UNKNOWN. CVSS: 1.899999976158142. Unspecified vulnerability in Oracle Sun Solaris 10 and 11 allows local users to affect confidentiality via vectors related to RPC Utility.
Near-miss passage: CVE-2015-4841. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Siebel Core - Server Framework component in Oracle Siebel CRM IP2014 and IP2015 allows remote attackers to affect confidentiality via unknown vectors related to Services.
Query: patch priority for CVE-2015-1880
Matching passage: CVE-2015-1880. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-8398. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Atlassian Confluence before 5.8.17 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to rest/prototype/1/session/check.
Query: rule covering Detects a login attempt in Google Workspace flagged as a potential attack by a government-backed threat actor
Matching passage: Sigma rule: Detects a login attempt in Google Workspace flagged as a potential attack by a government-backed threat actor. Logsource: gcp / google_workspace.login. Rule: title: Google Workspace Government Attack Warning id: eafe6f2b-cfec-4612-aec2-49563c33a087 status: experimental description: Detects a login attempt in Google Workspace flagged as a potential attack by a government-backed threat actor references: - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging - https://cloud.google.com/logging/docs/audit/understanding-audit-logs - https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#gov_attack_warning author: Tom Kluter date: 2026-04-28 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.impact - attack.stealth - attack.t1078 logsource: product: gcp service: google_workspace.login detection: selection: protoPayload.serviceName: login.googleapis.com protoPayload.metadata.event.eventName: gov_attack_warning condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects when the MSSQL "xp_cmdshell" stored procedure is used to execute commands. Logsource: windows / application. Rule: title: MSSQL XPCmdshell Suspicious Execution id: 7f103213-a04e-4d59-8261-213dddf22314 status: test description: Detects when the MSSQL "xp_cmdshell" stored procedure is used to execute commands references: - https://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/ - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-12 modified: 2024-06-26 tags: - attack.execution logsource: product: windows service: application definition: 'Requirements: MSSQL audit policy to monitor for "xp_cmdshell" must be enabled in order to receive this event in the application log (Follow this tutorial https://dba.stackexchange.com/questions/103183/is-there-any-way-to-monitor-execution-of-xp-cmdshell-in-sql-server-2012)' detection: selection: Provider_Name|contains: MSSQL EventID: 33205 Data|contains|all: - object_name:xp_cmdshell - statement:EXEC condition: selection falsepositives: - Unknown level: high
Query: describe CVE-2015-0744
Matching passage: CVE-2015-0744. CWE: CWE-399. CVSS: 7.800000190734863. Cisco DTA Control System (DTACS) 4.0.0.9 and Cisco Headend System Release allow remote attackers to cause a denial of service (CPU and memory consumption, and TCP service outage) via (1) a SYN flood or (2) another type of TCP traffic flood, aka Bug IDs CSCus50642, CSCus50662, CSCus50625, CSCus50657, and CSCus68315.
Near-miss passage: CVE-2015-3280. CWE: CWE-399. CVSS: 6.800000190734863. OpenStack Compute (nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) does not properly delete instances from compute nodes, which allows remote authenticated users to cause a denial of service (disk consumption) by deleting instances while in the resize state.
Query: exploit Cross-site scripting (XSS) vulnerability in IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 1
Matching passage: CVE-2015-1978. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-5269. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in group/overview.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users to inject arbitrary web script or HTML via a modified grouping description.
Query: risk of Cross-site request forgery (CSRF) vulnerability in the ASUS RT-G32 routers with firmware 2.0.2.6 and 2.0.3.2 allows remote attackers to hijack the authentication of administrators 
Matching passage: CVE-2015-2676. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the ASUS RT-G32 routers with firmware 2.0.2.6 and 2.0.3.2 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a request to start_apply.htm.
Near-miss passage: CVE-2015-7364. CWE: CWE-352. CVSS: 6.800000190734863. The HTML_Quickform library, as used in Revive Adserver before 3.2.2, allows remote attackers to bypass the CSRF protection mechanism via an empty token.