alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: CVE similar to CVE-2015-7641
Matching passage: CVE-2015-7641. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7636, CVE-2015-7637, CVE-2015-7638, CVE-2015-7639, CVE-2015-7640, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644.
Near-miss passage: CVE-2015-6011. CWE: UNKNOWN. CVSS: 5.0. Web Reference Database (aka refbase) through 0.9.6 and bleeding-edge before 2015-01-08 allows remote attackers to conduct XML injection attacks via (1) the id parameter to unapi.php or (2) the stylesheet parameter to sru.php.
Query: risk of The cipherstring parsing code in nss_compat_ossl while in multi-keyword mode does not match the expected set of ciphers for a given cipher combination, which allows attackers to ha
Matching passage: CVE-2015-3278. CWE: CWE-20. CVSS: 9.800000190734863. The cipherstring parsing code in nss_compat_ossl while in multi-keyword mode does not match the expected set of ciphers for a given cipher combination, which allows attackers to have unspecified impact via unknown vectors.
Near-miss passage: CVE-2015-0600. CWE: CWE-20. CVSS: 5.0. The mobility extension on Cisco Unified IP 9900 phones with firmware 9.4(.1) and earlier allows remote attackers to cause a denial of service (logoff) via crafted packets, aka Bug ID CSCuq12139.
Query: CVE similar to CVE-2015-1740
Matching passage: CVE-2015-1740. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1735, CVE-2015-1744, CVE-2015-1745, and CVE-2015-1766.
Near-miss passage: CVE-2015-0671. CWE: CWE-399. CVSS: 5.0. The DNS implementation in Cisco Videoscape Distribution Suite for Internet Streaming (VDS-IS) 3.2(1) allows remote attackers to cause a denial of service (CPU consumption and network-resource consumption) via crafted packets, aka Bug ID CSCun15911.
Query: exploit The Mail Drop feature in Mail in Apple OS X before 10.11 mishandles encryption parameters for attachments, which makes it easier for remote attackers to obtain sensitive informatio
Matching passage: CVE-2015-5884. CWE: CWE-200. CVSS: 3.299999952316284. The Mail Drop feature in Mail in Apple OS X before 10.11 mishandles encryption parameters for attachments, which makes it easier for remote attackers to obtain sensitive information by sniffing the network during transmission of an S/MIME e-mail message with a large attachment.
Near-miss passage: CVE-2015-3058. CWE: CWE-200. CVSS: 5.0. Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to obtain sensitive information from process memory via unspecified vectors.
Query: detect Detects regsvr32 execution to download/install/register new DLLs that are hosted on Web or FTP servers. in logs
Matching passage: Sigma rule: Detects regsvr32 execution to download/install/register new DLLs that are hosted on Web or FTP servers.. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Regsvr32 HTTP/FTP Pattern id: 867356ee-9352-41c9-a8f2-1be690d78216 related: - id: 8e2b24c9-4add-46a0-b4bb-0057b4e6187d type: obsolete status: test description: Detects regsvr32 execution to download/install/register new DLLs that are hosted on Web or FTP servers. references: - https://twitter.com/mrd0x/status/1461041276514623491 - https://twitter.com/tccontre18/status/1480950986650832903 - https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/ author: Florian Roth (Nextron Systems) date: 2023-05-24 modified: 2023-05-26 tags: - attack.stealth - attack.t1218.010 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \regsvr32.exe - OriginalFileName: REGSVR32.EXE selection_flag: CommandLine|contains: - ' /i' - ' -i' selection_protocol: CommandLine|contains: - ftp - http condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects strings used in command execution in DNS TXT Answer. Logsource: dns. Rule: title: DNS TXT Answer with Possible Execution Strings id: 8ae51330-899c-4641-8125-e39f2e07da72 status: test description: Detects strings used in command execution in DNS TXT Answer references: - https://twitter.com/stvemillertime/status/1024707932447854592 - https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Backdoors/DNS_TXT_Pwnage.ps1 author: Markus Neis date: 2018-08-08 modified: 2021-11-27 tags: - attack.command-and-control - attack.t1071.004 logsource: category: dns detection: selection: record_type: TXT answer|contains: - IEX - Invoke-Expression - cmd.exe condition: selection falsepositives: - Unknown level: high
Query: describe CVE-2015-1696
Matching passage: CVE-2015-1696. CWE: CWE-94. CVSS: 9.300000190734863. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted Journal file, aka "Windows Journal Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-1675, CVE-2015-1695, CVE-2015-1697, CVE-2015-1698, and CVE-2015-1699.
Near-miss passage: CVE-2015-0092. CWE: CWE-94. CVSS: 9.300000190734863. Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted (1) web site or (2) file, aka "Adobe Font Driver Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-0088, CVE-2015-0090, CVE-2015-0091, and CVE-2015-0093.
Query: how to detect Video Capture
Matching passage: T1125 Video Capture. Tactics: collection. Description: An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering information. Images may also be captured from devices or applications, potentially in specified intervals, in lieu of video files. Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture video or images. Video or image files may be written to disk and exfiltrated later. This technique differs from [Screen Capture](https://attack.mitre.org/techniques/T1113) due to use of specific devices or applications for video recording rather than capturing the victim's screen. In macOS, there are a few different malware samples that record the user's webcam such as FruitFly and Proton. (Citation: objective-see 2017 review)
Near-miss passage: T1056.003 Web Portal Capture. Tactics: collection, credential access. Description: Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service. This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through [External Remote Services](https://attack.mitre.org/techniques/T1133) and [Valid Accounts](https://attack.mitre.org/techniques/T1078) or as part of the initial compromise by exploitation of the externally facing web service.(Citation: Volexity Virtual Private Keylogging)
Query: write Sigma for Detects suspicious process access to LSASS.exe from processes located in uncommon locations with dbgcore.dll or dbghelp.
Matching passage: Sigma rule: Detects suspicious process access to LSASS.exe from processes located in uncommon locations with dbgcore.dll or dbghelp.. Logsource: windows / process_access. Rule: title: Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs id: 9f5c1d59-33be-4e60-bcab-85d2f566effd related: - id: 416bc4a2-7217-4519-8dc7-c3271817f1d5 type: similar status: experimental description: 'Detects suspicious process access to LSASS.exe from processes located in uncommon locations with dbgcore.dll or dbghelp.dll in the call trace. These DLLs contain functions like MiniDumpWriteDump that can be abused for credential dumping purposes. While modern tools like Mimikatz have moved to using ntdll.dll, dbgcore.dll and dbghelp.dll are still used by basic credential dumping utilities and legacy tools for LSASS memory access and process suspension techniques. ' references: - https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html - https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpwritedump author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-27 tags: - attack.credential-access - attack.defense-impairment - attack.t1003.001 - attack.t1685 logsource: category: process_access product: windows detection: selection_lsass_calltrace: TargetImage|endswith: \lsass.exe CallTrace|contains: - dbgcore.dll - dbghelp.dll selection_susp_location: SourceImage|contains: - :\Perflogs\ - :\Temp\ - :\Users\Public\ - \$Recycle.Bin\ - \AppData\Roaming\ - \Contacts\ - \Desktop\ - \Documents\ - \Downloads\ - \Favorites\ - \Favourites\ - \inetpub\wwwroot\ - \Music\ - \Pictures\ - \Start Menu\Programs\Startup\ - \Users\Default\ - \Videos\ - \Windows\Temp\ condition: all of selection_* falsepositives: - Possibly during software installation or update processes level: high regression_tests_path: regression_data/rules/windows/process_access/proc_access_win_susp_dbgcore_dbghelp_load/info.yml
Near-miss passage: Sigma rule: Detects the use of DefenderCheck, a tool to evaluate the signatures used in Microsoft Defender. It can be used to figure. Logsource: windows / process_creation. Rule: title: PUA - DefenderCheck Execution id: f0ca6c24-3225-47d5-b1f5-352bf07ecfa7 status: test description: Detects the use of DefenderCheck, a tool to evaluate the signatures used in Microsoft Defender. It can be used to figure out the strings / byte chains used in Microsoft Defender to detect a tool and thus used for AV evasion. references: - https://github.com/matterpreter/DefenderCheck author: Florian Roth (Nextron Systems) date: 2022-08-30 modified: 2023-02-04 tags: - attack.stealth - attack.t1027.005 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \DefenderCheck.exe - Description: DefenderCheck condition: selection falsepositives: - Unlikely level: high
Query: patch priority for CVE-2015-4552
Matching passage: CVE-2015-4552. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the quick edit function in xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.8.5 allows remote attackers to inject arbitrary web script or HTML via the content of a post.
Near-miss passage: CVE-2015-6337. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Cisco Application Policy Infrastructure Controller Enterprise Module (APIC-EM) 1.0.10 allows remote attackers to inject arbitrary web script or HTML via a crafted hostname in an SNMP response, aka Bug ID CSCuw47238.
Query: Encoded PowerShell / command-line abuse matching Email Account
Matching passage: T1087.003 Email Account. Tactics: discovery. Description: Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).(Citation: Microsoft Exchange Address Lists) In on-premises Exchange and Exchange Online, the <code>Get-GlobalAddressList</code> PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.(Citation: Microsoft getglobaladdresslist)(Citation: Black Hills Attacking Exchange MailSniper, 2016) In Google Workspace, the GAL is shared with Microsoft Outlook users through the Google Workspace Sync for Microsoft Outlook (GWSMO) service. Additionally, the Google Workspace Directory allows for users to get a listing of other users within the organization.(Citation: Google Workspace Global Access List)
Near-miss passage: T1087.002 Domain Account. Tactics: discovery. Description: Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges. Commands such as <code>net user /domain</code> and <code>net group /domain</code> of the [Net](https://attack.mitre.org/software/S0039) utility, <code>dscacheutil -q group</code> on macOS, and <code>ldapsearch</code> on Linux can list domain users and groups. [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets including <code>Get-ADUser</code> and <code>Get-ADGroupMember</code> may enumerate members of Active Directory groups.(Citation: CrowdStrike StellarParticle January 2022)
Query: describe CVE-2015-8153
Matching passage: CVE-2015-8153. CWE: CWE-89. CVSS: 8.800000190734863. SQL injection vulnerability in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6-MP4 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-0919. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in the administrative backend in Sefrengo before 1.6.1 allow remote administrators to execute arbitrary SQL commands via the (1) idcat or (2) idclient parameter to backend/main.php.
Query: exploit Multiple cross-site scripting (XSS) vulnerabilities in the Infra Admin UI in Cisco Identity Services Engine (ISE) 1.2(1.198) and 1.3(0.876) allow remote attackers to inject arbitra
Matching passage: CVE-2015-4268. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the Infra Admin UI in Cisco Identity Services Engine (ISE) 1.2(1.198) and 1.3(0.876) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a (1) GET or (2) POST request, aka Bug ID CSCus16052.
Near-miss passage: CVE-2015-1567. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the admin page in the GD Infinite Scroll module before 7.x-1.4 for Drupal allows remote authenticated users with the "edit gd infinite scroll settings" permission to inject arbitrary web script or HTML via unspecified vectors.
Query: campaign using Rootkit
Matching passage: T1014 Rootkit. Tactics: stealth. Description: Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information. (Citation: Symantec Windows Rootkits) Rootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, to include a hypervisor or [System Firmware](https://attack.mitre.org/techniques/T1542/001). (Citation: Wikipedia Rootkit) Rootkits have been seen for Windows, Linux, and Mac OS X systems. (Citation: CrowdStrike Linux Rootkit) (Citation: BlackHat Mac OSX Rootkit) Rootkits that reside or modify boot sectors are known as [Bootkit](https://attack.mitre.org/techniques/T1542/003)s and specifically target the boot process of the operating system.
Near-miss passage: T1684 Social Engineering. Tactics: stealth. Description: Adversaries may use social engineering techniques to influence users to take actions that result in unauthorized access, approval of changes, disclosure of sensitive information, or execution of adversary-supplied instructions (i.e., introduction of malicious payloads or software), while minimizing technical indicators. Adversaries may leverage trust-building methods across multiple channels (e.g., executive, vendor, or help desk scenarios, including AI-enabled voice interactions) to prompt user-authorized actions such as password resets, MFA changes, financial approvals, or the disclosure of sensitive information. Adversaries may also leverage common business communications and workflows such as email, collaboration platforms, voice communications, recruiting processes, help desk interactions, and SaaS consent mechanisms to make malicious requests appear routine and legitimate.(Citation: Proofpoint TA427 April 2024)(Citation: SE SentinelOne 2)(Citation: SE - Hackers Target Workday) Additionally, adversaries have persuaded victims to take actions through references of current events, harnessing relevant themes to the work role or the organizations mission. For example, adversaries may use scare tactics (i.e., threaten repercussions for non-compliance) or otherwise incite victims’ emotions in order to generate a sense of urgency to take action.(Citation: SE Proofpoint)(Citation: SE SentinelOne) This technique may include common social engineering patterns such as [Phishing](https://attack.mitre.org/techniques/T1566) and [Spearphishing Voice](https://attack.mitre.org/techniques/T1566/004), often supported by convincing and targeted narratives.(Citation: SE SentinelOne 2)(Citation: Fortinet Trends 25-26)
Query: detection rule: Uses the .NET InstallUtil.exe application in order to execute image without log
Matching passage: Sigma rule: Uses the .NET InstallUtil.exe application in order to execute image without log. Logsource: windows / process_creation. Rule: title: Suspicious Execution of InstallUtil Without Log id: d042284c-a296-4988-9be5-f424fadcc28c status: test description: Uses the .NET InstallUtil.exe application in order to execute image without log references: - https://securelist.com/moonbounce-the-dark-side-of-uefi-firmware/105468/ - https://learn.microsoft.com/en-us/dotnet/framework/tools/installutil-exe-installer-tool author: frack113 date: 2022-01-23 modified: 2022-02-04 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: Image|endswith: \InstallUtil.exe Image|contains: Microsoft.NET\Framework CommandLine|contains|all: - '/logfile= ' - /LogToConsole=false condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects commandline operations on shell history files. Logsource: macos / process_creation. Rule: title: Suspicious History File Operations id: 508a9374-ad52-4789-b568-fc358def2c65 status: test description: Detects commandline operations on shell history files references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md author: Mikhail Larin, oscd.community date: 2020-10-17 modified: 2021-11-27 tags: - attack.credential-access - attack.t1552.003 logsource: product: macos category: process_creation detection: selection: CommandLine|contains: - .bash_history - .zsh_history - .zhistory - .history - .sh_history - fish_history condition: selection falsepositives: - Legitimate administrative activity - Legitimate software, cleaning hist file level: medium
Query: describe CVE-2015-3064
Matching passage: CVE-2015-3064. CWE: CWE-284. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified vectors, a different vulnerability than CVE-2015-3060, CVE-2015-3061, CVE-2015-3062, CVE-2015-3063, CVE-2015-3065, CVE-2015-3066, CVE-2015-3067, CVE-2015-3068, CVE-2015-3069, CVE-2015-3071, CVE-2015-3072, CVE-2015-3073, and CVE-2015-3074.
Near-miss passage: CVE-2015-1000009. CWE: CWE-284. CVSS: 9.100000381469727. Open proxy in Wordpress plugin google-adsense-and-hotel-booking v1.05
Query: describe CVE-2015-4993
Matching passage: CVE-2015-4993. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF19, and 8.5.0 before CF08 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-4998.
Near-miss passage: CVE-2015-7536. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to workspaces and archived artifacts.
Query: common weakness: Unquoted Search Path or Element
Matching passage: CWE-428 Unquoted Search Path or Element. The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.
Near-miss passage: CWE-1395 Dependency on Vulnerable Third-Party Component. The product has a dependency on a third-party component that contains one or more known vulnerabilities.
Query: vulnerability: Bomgar Remote Support before 15.1.1 allows remote attackers to execute arbitrary PHP code via crafted serialized data to unspecified PHP scripts.
Matching passage: CVE-2015-0935. CWE: CWE-94. CVSS: 7.5. Bomgar Remote Support before 15.1.1 allows remote attackers to execute arbitrary PHP code via crafted serialized data to unspecified PHP scripts.
Near-miss passage: CVE-2015-7381. CWE: CWE-94. CVSS: 7.5. Multiple PHP remote file inclusion vulnerabilities in install.php in Web Reference Database (aka refbase) through 0.9.6 allow remote attackers to execute arbitrary PHP code via the (1) pathToMYSQL or (2) databaseStructureFile parameter, a different issue than CVE-2015-6008.
Query: secure coding against Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Matching passage: CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection'). The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.
Near-miss passage: CWE-392 Missing Report of Error Condition. The product encounters an error but does not provide a status code or return value to indicate that an error has occurred.
Query: exploit The TFTP server in Cisco IOS 12.2(44)SQ1, 12.2(33)XN1, 12.4(25e)JAM1, 12.4(25e)JAO5m, 12.4(23)JY, 15.0(2)ED1, 15.0(2)EY3, 15.1(3)SVF4a, and 15.2(2)JB1 and IOS XE 2.5.x, 2.6.x, 3.1.
Matching passage: CVE-2015-0681. CWE: CWE-399. CVSS: 7.099999904632568. The TFTP server in Cisco IOS 12.2(44)SQ1, 12.2(33)XN1, 12.4(25e)JAM1, 12.4(25e)JAO5m, 12.4(23)JY, 15.0(2)ED1, 15.0(2)EY3, 15.1(3)SVF4a, and 15.2(2)JB1 and IOS XE 2.5.x, 2.6.x, 3.1.xS, 3.2.xS, 3.3.xS, 3.4.xS, and 3.5.xS before 3.6.0S; 3.1.xSG, 3.2.xSG, and 3.3.xSG before 3.4.0SG; 3.2.xSE before 3.3.0SE; 3.2.xXO before 3.3.0XO; 3.2.xSQ; 3.3.xSQ; and 3.4.xSQ allows remote attackers to cause a denial of service (device hang or reload) via multiple requests that trigger improper memory management, aka Bug ID CSCts66733.
Near-miss passage: CVE-2015-4215. CWE: CWE-399. CVSS: 6.099999904632568. Cisco Wireless LAN Controller (WLC) devices with software 7.5(102.0) and 7.6(1.62) allow remote attackers to cause a denial of service (device crash) by triggering an exception during attempted forwarding of unspecified IPv6 packets to a non-IPv6 device, aka Bug ID CSCuj01046.