alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Detects suspicious user agent strings used by exploit / pentest frameworks like Metasploit in proxy logs
Matching passage: Sigma rule: Detects suspicious user agent strings used by exploit / pentest frameworks like Metasploit in proxy logs. Logsource: proxy. Rule: title: Exploit Framework User Agent id: fdd1bfb5-f60b-4a35-910e-f36ed3d0b32f status: test description: Detects suspicious user agent strings used by exploit / pentest frameworks like Metasploit in proxy logs references: - https://blog.didierstevens.com/2015/03/16/quickpost-metasploit-user-agent-strings/ author: Florian Roth (Nextron Systems) date: 2017-07-08 modified: 2025-01-18 tags: - attack.command-and-control - attack.t1071.001 logsource: category: proxy detection: selection: c-useragent: - Internet Explorer * - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.2) - Mozilla/4.0 (compatible; Metasploit RSPEC) - Mozilla/4.0 (compatible; MSIE 6.1; Windows NT) - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) - Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0) - Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; Trident/4.0; SIMBAR={7DB0F6DE-8DE7-4841-9084-28FA914B0F2E}; SLCC1; .N - Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.13 (KHTML, like Gecko) Chrome/4.0.221.6 Safari/525.13 - Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MAAU) - Mozilla/5.0 - Mozilla/4.0 (compatible; SPIPE/1.0 - Mozilla/5.0 (Windows NT 6.3; rv:39.0) Gecko/20100101 Firefox/35.0 - Sametime Community Agent - X-FORWARDED-FOR - DotDotPwn v2.1 - SIPDROID - Mozilla/5.0 (Windows NT 10.0; Win32; x32; rv:60.0) - Mozilla/6.0 (X11; Linux x86_64; rv:24.0) Gecko/20140205 Firefox/27.0 Iceweasel/25.3.0 - '*wordpress hash grabber*' - '*exploit*' - Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious modification of crontab file.. Logsource: linux / cron. Rule: title: Modifying Crontab id: af202fd3-7bff-4212-a25a-fb34606cfcbe status: test description: Detects suspicious modification of crontab file. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.003/T1053.003.md author: Pawel Mazur date: 2022-04-16 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1053.003 logsource: product: linux service: cron detection: keywords: - REPLACE condition: keywords falsepositives: - Legitimate modification of crontab level: medium
Query: patch priority for CVE-2015-2758
Matching passage: CVE-2015-2758. CWE: CWE-264. CVSS: 6.5. The ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3 Patch 4 Hotfix 16 (9.3.416.4) allows remote authenticated users to obtain sensitive information, modify the database, or possibly have other unspecified impact via a crafted URL.
Near-miss passage: CVE-2015-6643. CWE: CWE-264. CVSS: 6.599999904632568. Setup Wizard in Android 5.x before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows physically proximate attackers to modify settings or bypass a reset protection mechanism via unspecified vectors, aka internal bug 25290269.
Query: exploit Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before
Matching passage: CVE-2015-3126. CWE: UNKNOWN. CVSS: 7.5. Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2015-4429.
Near-miss passage: CVE-2015-7393. CWE: UNKNOWN. CVSS: 7.400000095367432. dcoep in BIG-IP LTM, Analytics, APM, ASM, and Link Controller 11.2.0 through 11.6.0 and 12.0.0 before 12.0.0 HF1, BIG-IP AAM 11.4.0 through 11.6.0 and 12.0.0 before 12.0.0 HF1, BIG-IP AFM and PEM 11.3.0 through 11.6.0 and 12.0.0 before 12.0.0 HF1, BIG-IP DNS 12.0.0 before 12.0.0 HF1, BIG-IP Edge Gateway, WebAccelerator, and WOM 11.2.0 through 11.3.0, BIG-IP GTM 11.2.0 through 11.6.0, BIG-IP PSM 11.2.0 through 11.4.1, Enterprise Manager 3.0.0 through 3.1.1, BIG-IQ Cloud 4.0.0 through 4.5.0, BIG-IQ Device 4.2.0 through 4.5.0, BIG-IQ Security 4.0.0 through 4.5.0, BIG-IQ ADC 4.5.0, BIG-IQ Centralized Management 4.6.0, and BIG-IQ Cloud and Orchestration 1.0.0 allows local users with advanced shell (bash) access to gain privileges via unspecified vectors.
Query: Encoded PowerShell / command-line abuse matching Disable or Modify Cloud Log
Matching passage: T1685.002 Disable or Modify Cloud Log. Tactics: defense impairment. Description: An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within the environment. If an adversary has sufficient permissions, they can disable or modify logging to avoid detection of their activities. For example, in AWS an adversary may disable CloudWatch/CloudTrail integrations prior to conducting further malicious activity. They may alternatively tamper with logging functionality, for example, by removing any associated SNS topics, disabling multi-region logging, or disabling settings that validate and/or encrypt log files.(Citation: AWS Cloud Trail)(Citation: Pacu Detection Disruption Module) In Office 365, an adversary may disable logging on mail collection activities for specific users by using the Set-MailboxAuditBypassAssociation cmdlet, by disabling M365 Advanced Auditing for the user, or by downgrading the user’s license from an Enterprise E5 to an Enterprise E3 license.(Citation: Dark Reading)
Near-miss passage: T1685.005 Clear Windows Event Logs. Tactics: defense impairment. Description: Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit. With administrator privileges, the event logs can be cleared with the following utility commands: * `wevtutil cl system` * `wevtutil cl application` * `wevtutil cl security` These logs may also be cleared through other mechanisms, such as the event viewer GUI or [PowerShell](https://attack.mitre.org/techniques/T1059/001). For example, adversaries may use the PowerShell command `Remove-EventLog -LogName Security` to delete the Security EventLog and after reboot, disable future logging. Note: events may still be generated and logged in the .evtx file between the time the command is run and the reboot.(Citation: disable_win_evt_logging) Adversaries may also attempt to clear logs by directly deleting the stored log files within `C:\Windows\System32\winevt\logs\`.
Query: risk of A vulnerability classified as critical was found in purpleparrots 491-Project. This vulnerability affects unknown code of the file update.php of the component Highscore Handler. Th
Matching passage: CVE-2015-10031. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability classified as critical was found in purpleparrots 491-Project. This vulnerability affects unknown code of the file update.php of the component Highscore Handler. The manipulation leads to sql injection. The name of the patch is a812a5e4cf72f2a635a716086fe1ee2b8fa0b1ab. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217648.
Near-miss passage: CVE-2015-3325. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in forum.php in the WP Symposium plugin before 15.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the show parameter in the QUERY_STRING to the default URI.
Query: vulnerability: Use-after-free vulnerability in content/renderer/media/webaudio_capturer_source.cc in the WebAudio implementation in Google Chrome before 43.0.2357.65 allows remote attackers to ca
Matching passage: CVE-2015-1255. CWE: UNKNOWN. CVSS: 6.800000190734863. Use-after-free vulnerability in content/renderer/media/webaudio_capturer_source.cc in the WebAudio implementation in Google Chrome before 43.0.2357.65 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by leveraging improper handling of a stop action for an audio track.
Near-miss passage: CVE-2015-8421. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: detect Detect the harvesting of wifi credentials using netsh.exe in logs
Matching passage: Sigma rule: Detect the harvesting of wifi credentials using netsh.exe. Logsource: windows / process_creation. Rule: title: Harvesting Of Wifi Credentials Via Netsh.EXE id: 42b1a5b8-353f-4f10-b256-39de4467faff status: test description: Detect the harvesting of wifi credentials using netsh.exe references: - https://blog.malwarebytes.com/threat-analysis/2020/04/new-agenttesla-variant-steals-wifi-credentials/ author: Andreas Hunkeler (@Karneades), oscd.community date: 2020-04-20 modified: 2023-02-13 tags: - attack.discovery - attack.credential-access - attack.t1040 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \netsh.exe - OriginalFileName: netsh.exe selection_cli: CommandLine|contains|all: - wlan - ' s' - ' p' - ' k' - =clear condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files ha. Logsource: windows / process_creation. Rule: title: Hacktool Execution - PE Metadata id: 37c1333a-a0db-48be-b64b-7393b2386e3b status: test description: Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed references: - https://github.com/cube0x0 - https://www.virustotal.com/gui/search/metadata%253ACube0x0/files author: Florian Roth (Nextron Systems) date: 2022-04-27 modified: 2024-01-15 tags: - attack.credential-access - attack.resource-development - attack.t1588.002 - attack.t1003 logsource: category: process_creation product: windows detection: selection: Company: Cube0x0 condition: selection falsepositives: - Unlikely level: high
Query: exploit baserCMS 3.0.2 through 3.0.8 allows remote authenticated users to execute arbitrary OS commands via unspecified vectors.
Matching passage: CVE-2015-7769. CWE: CWE-78. CVSS: 6.300000190734863. baserCMS 3.0.2 through 3.0.8 allows remote authenticated users to execute arbitrary OS commands via unspecified vectors.
Near-miss passage: CVE-2015-2845. CWE: CWE-78. CVSS: 10.0. The cpanel function in go_site.php in GoAutoDial GoAdmin CE before 3.3-1421902800 allows remote attackers to execute arbitrary commands via the $type portion of the PATH_INFO.
Query: exploit The two-factor-authentication plugin before 1.1.10 for WordPress has XSS in the admin area.
Matching passage: CVE-2015-9355. CWE: CWE-79. CVSS: 6.099999904632568. The two-factor-authentication plugin before 1.1.10 for WordPress has XSS in the admin area.
Near-miss passage: CVE-2015-1629. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "ExchangeDLP Cross Site Scripting Vulnerability."
Query: patch priority for CVE-2015-4915
Matching passage: CVE-2015-4915. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in the Integrated Lights Out Manager (ILOM) component in Oracle Sun Systems Products Suite 3.0, 3.1, and 3.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to System Management.
Near-miss passage: CVE-2015-0475. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the JD Edwards EnterpriseOne Technology component in Oracle JD Edwards Products 9.1 allows remote authenticated users to affect confidentiality via unknown vectors related to Web Runtime Security.
Query: Sigma rule for Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could i
Matching passage: Sigma rule: Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could i. Logsource: macos / process_creation. Rule: title: Suspicious Microsoft Office Child Process - MacOS id: 69483748-1525-4a6c-95ca-90dc8d431b68 status: test description: Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could indicates malicious macro execution references: - https://redcanary.com/blog/applescript/ - https://objective-see.org/blog/blog_0x4B.html author: Sohan G (D4rkCiph3r) date: 2023-01-31 modified: 2023-02-04 tags: - attack.execution - attack.persistence - attack.t1059.002 - attack.t1137.002 - attack.t1204.002 logsource: product: macos category: process_creation detection: selection: ParentImage|contains: - Microsoft Word - Microsoft Excel - Microsoft PowerPoint - Microsoft OneNote Image|endswith: - /bash - /curl - /dash - /fish - /osacompile - /osascript - /sh - /zsh - /python - /python3 - /wget condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects execution of the "wusa.exe" (Windows Update Standalone Installer) utility by a parent process that is located in. Logsource: windows / process_creation. Rule: title: Wusa.EXE Executed By Parent Process Located In Suspicious Location id: ef64fc9c-a45e-43cc-8fd8-7d75d73b4c99 status: test description: 'Detects execution of the "wusa.exe" (Windows Update Standalone Installer) utility by a parent process that is located in a suspicious location. Attackers could instantiate an instance of "wusa.exe" in order to bypass User Account Control (UAC). They can duplicate the access token from "wusa.exe" to gain elevated privileges. ' references: - https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document author: X__Junior (Nextron Systems) date: 2023-11-26 modified: 2024-08-15 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \wusa.exe selection_paths_1: ParentImage|contains: - :\Perflogs\ - :\Users\Public\ - :\Windows\Temp\ - \Appdata\Local\Temp\ - \Temporary Internet selection_paths_2: - ParentImage|contains|all: - :\Users\ - \Favorites\ - ParentImage|contains|all: - :\Users\ - \Favourites\ - ParentImage|contains|all: - :\Users\ - \Contacts\ - ParentImage|contains|all: - :\Users\ - \Pictures\ filter_main_msu: CommandLine|contains: .msu condition: selection_img and 1 of selection_paths_* and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: risk of The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in FreeBSD through 10.1 allows remote attackers to reconfigure a hop-limit setting via a small hop_limit value
Matching passage: CVE-2015-2923. CWE: CWE-20. CVSS: 6.5. The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in FreeBSD through 10.1 allows remote attackers to reconfigure a hop-limit setting via a small hop_limit value in a Router Advertisement (RA) message.
Near-miss passage: CVE-2015-6546. CWE: CWE-20. CVSS: 6.099999904632568. The vCMP host in F5 BIG-IP Analytics, APM, ASM, GTM, Link Controller, and LTM 11.0.0 before 11.6.0, BIG-IP AAM 11.4.0 before 11.6.0, BIG-IP AFM and PEM 11.3.0 before 11.6.0, BIG-IP Edge Gateway, WebAccelerator, and WOM 11.0.0 through 11.3.0, BIG-IP PSM 11.0.0 through 11.4.1 allows remote attackers to cause a denial of service via "malicious traffic."
Query: CVE similar to CVE-2015-3962
Matching passage: CVE-2015-3962. CWE: CWE-522. CVSS: 5.0. Schneider Electric StruxureWare Building Expert MPM before 2.15 does not use encryption for the client-server data stream, which allows remote attackers to discover credentials by sniffing the network.
Near-miss passage: CVE-2015-5955. CWE: CWE-522. CVSS: 5.0. ownCloud iOS app before 3.4.4 does not properly switch state between multiple instances, which might allow remote instance administrators to obtain sensitive credential and cookie information by reading authentication headers.
Query: exfiltration using Traffic Duplication
Matching passage: T1020.001 Traffic Duplication. Tactics: exfiltration. Description: Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure. Traffic mirroring is a native feature for some devices, often used for network analysis. For example, devices may be configured to forward network traffic to one or more destinations for analysis by a network analyzer or other monitoring device. (Citation: Cisco Traffic Mirroring)(Citation: Juniper Traffic Mirroring) Adversaries may abuse traffic mirroring to mirror or redirect network traffic through other infrastructure they control. Malicious modifications to network devices to enable traffic redirection may be possible through [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) or [Patch System Image](https://attack.mitre.org/techniques/T1601/001).(Citation: US-CERT-TA18-106A)(Citation: Cisco Blog Legacy Device Attacks) Many cloud-based environments also support traffic mirroring. For example, AWS Traffic Mirroring, GCP Packet Mirroring, and Azure vTap allow users to define specified instances to collect traffic from and specified targets to send collected traffic to.(Citation: AWS Traffic Mirroring)(Citation: GCP Packet Mirroring)(Citation: Azure Virtual Network TAP) Adversaries may use traffic duplication in conjunction with [Network Sniffing](https://attack.mitre.org/techniques/T1040), [Input Capture](https://attack.mitre.org/techniques/T1056), or [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) depending on the goals and objectives of the adversary.
Near-miss passage: T1020 Automated Exfiltration. Tactics: exfiltration. Description: Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.(Citation: ESET Gamaredon June 2020) When automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as [Exfiltration Over C2 Channel](https://attack.mitre.org/techniques/T1041) and [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048).
Query: weakness Using Referer Field for Authentication
Matching passage: CWE-293 Using Referer Field for Authentication. The referer field in HTTP requests can be easily modified and, as such, is not a valid means of message integrity checking.
Near-miss passage: CWE-580 clone() Method Without super.clone(). The product contains a clone() method that does not call super.clone() to obtain the new object.
Query: common weakness: PHP External Variable Modification
Matching passage: CWE-473 PHP External Variable Modification. A PHP application does not properly protect against the modification of variables from external sources, such as query parameters or cookies. This can expose the application to numerous weaknesses that would not exist otherwise.
Near-miss passage: CWE-111 Direct Use of Unsafe JNI. When a Java application uses the Java Native Interface (JNI) to call code written in another programming language, it can expose the application to weaknesses in that code, even if those weaknesses cannot occur in Java.
Query: exploit arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform mishandles IRET faults in processing NMIs that occurred during userspace execution, which might al
Matching passage: CVE-2015-5157. CWE: CWE-264. CVSS: 7.199999809265137. arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform mishandles IRET faults in processing NMIs that occurred during userspace execution, which might allow local users to gain privileges by triggering an NMI.
Near-miss passage: CVE-2015-5253. CWE: CWE-264. CVSS: 4.0. The SAML Web SSO module in Apache CXF before 2.7.18, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote authenticated users to bypass authentication via a crafted SAML response with a valid signed assertion, related to a "wrapping attack."
Query: CVE similar to CVE-2015-0491
Matching passage: CVE-2015-0491. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and Java FX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2015-0459.
Near-miss passage: CVE-2015-4905. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via vectors related to Server : DML.
Query: CVE similar to CVE-2015-10084
Matching passage: CVE-2015-10084. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability was found in irontec klear-library chloe and classified as critical. Affected by this issue is the function _prepareWhere of the file Controller/Rest/BaseController.php. The manipulation leads to sql injection. Upgrading to version marla is able to address this issue. The name of the patch is b25262de52fdaffde2a4434fc2a84408b304fbc5. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-221504.
Near-miss passage: CVE-2015-4611. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the Smoelenboek (ncgov_smoelenboek) extension before 1.0.9 for TYPO3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.