alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous befo
Matching passage: CVE-2015-6686. CWE: CWE-119. CVSS: 6.800000190734863. Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted set of fields, a different vulnerability than CVE-2015-6685, CVE-2015-6693, CVE-2015-6694, CVE-2015-6695, and CVE-2015-7622.
Near-miss passage: CVE-2015-4141. CWE: CWE-119. CVSS: 4.300000190734863. The WPS UPnP function in hostapd, when using WPS AP, and wpa_supplicant, when using WPS external registrar (ER), 0.7.0 through 2.4 allows remote attackers to cause a denial of service (crash) via a negative chunk length, which triggers an out-of-bounds read or heap-based buffer overflow.
Query: risk of Buffer overflow in the set_cs_start function in t1disasm.c in t1utils before 1.39 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code v
Matching passage: CVE-2015-3905. CWE: CWE-119. CVSS: 7.5. Buffer overflow in the set_cs_start function in t1disasm.c in t1utils before 1.39 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted font file.
Near-miss passage: CVE-2015-9176. CWE: CWE-119. CVSS: 7.5. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, Input_address is registered as a shared buffer and is not properly checked before use in OEMCrypto_Generic_Sign(). This allows addresses to be accessed that reside in secure/CP memory.
Query: Outbound C2 pattern associated with IDE Extensions
Matching passage: T1176.002 IDE Extensions. Tactics: persistence. Description: Adversaries may abuse an integrated development environment (IDE) extension to establish persistent access to victim systems.(Citation: Mnemonic misuse visual studio) IDEs such as Visual Studio Code, IntelliJ IDEA, and Eclipse support extensions - software components that add features like code linting, auto-completion, task automation, or integration with tools like Git and Docker. A malicious extension can be installed through an extension marketplace (i.e., [Compromise Software Dependencies and Development Tools](https://attack.mitre.org/techniques/T1195/001)) or side-loaded directly into the IDE.(Citation: Abramovsky VSCode Security)(Citation: Lakshmanan Visual Studio Marketplace) In addition to installing malicious extensions, adversaries may also leverage benign ones. For example, adversaries may establish persistent SSH tunnels via the use of the VSCode Remote SSH extension (i.e., [IDE Tunneling](https://attack.mitre.org/techniques/T1219/001)). Trust is typically established through the installation process; once installed, the malicious extension is run every time that the IDE is launched. The extension can then be used to execute arbitrary code, establish a backdoor, mine cryptocurrency, or exfiltrate data.(Citation: ExtensionTotal VSCode Extensions 2025)
Near-miss passage: T1176 Software Extensions. Tactics: persistence. Description: Adversaries may abuse software extensions to establish persistent access to victim systems. Software extensions are modular components that enhance or customize the functionality of software applications, including web browsers, Integrated Development Environments (IDEs), and other platforms.(Citation: Chrome Extension C2 Malware)(Citation: Abramovsky VSCode Security) Extensions are typically installed via official marketplaces, app stores, or manually loaded by users, and they often inherit the permissions and access levels of the host application. Malicious extensions can be introduced through various methods, including social engineering, compromised marketplaces, or direct installation by users or by adversaries who have already gained access to a system. Malicious extensions can be named similarly or identically to benign extensions in marketplaces. Security mechanisms in extension marketplaces may be insufficient to detect malicious components, allowing adversaries to bypass automated scanners or exploit trust established during the installation process. Adversaries may also abuse benign extensions to achieve their objectives, such as using legitimate functionality to tunnel data or bypass security controls. The modular nature of extensions and their integration with host applications make them an attractive target for adversaries seeking to exploit trusted software ecosystems. Detection can be challenging due to the inherent trust placed in extensions during installation and their ability to blend into normal application workflows.
Query: risk of The TripleO Heat templates (tripleo-heat-templates), when deployed via the commandline interface, allow remote attackers to spoof OpenStack Networking metadata requests by leveragi
Matching passage: CVE-2015-5303. CWE: CWE-254. CVSS: 7.5. The TripleO Heat templates (tripleo-heat-templates), when deployed via the commandline interface, allow remote attackers to spoof OpenStack Networking metadata requests by leveraging knowledge of the default value of the NeutronMetadataProxySharedSecret parameter.
Near-miss passage: CVE-2015-5759. CWE: CWE-254. CVSS: 5.0. WebKit in Apple iOS before 8.4.1 allows remote attackers to spoof clicks via a crafted web site that leverages tap events.
Query: discovery using Group Policy Discovery
Matching passage: T1615 Group Policy Discovery. Tactics: discovery. Description: Adversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and to discover patterns in domain objects that can be manipulated or used to blend in the environment. Group Policy allows for centralized management of user and computer settings in Active Directory (AD). Group policy objects (GPOs) are containers for group policy settings made up of files stored within a predictable network path `\<DOMAIN>\SYSVOL\<DOMAIN>\Policies\`.(Citation: TechNet Group Policy Basics)(Citation: ADSecurity GPO Persistence 2016) Adversaries may use commands such as <code>gpresult</code> or various publicly available PowerShell functions, such as <code>Get-DomainGPO</code> and <code>Get-DomainGPOLocalGroup</code>, to gather information on Group Policy settings.(Citation: Microsoft gpresult)(Citation: Github PowerShell Empire) Adversaries may use this information to shape follow-on behaviors, including determining potential attack paths within the target network as well as opportunities to manipulate Group Policy settings (i.e. [Domain or Tenant Policy Modification](https://attack.mitre.org/techniques/T1484)) for their benefit.
Near-miss passage: T1069 Permission Groups Discovery. Tactics: discovery. Description: Adversaries may attempt to discover group and permission settings. This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions. Adversaries may attempt to discover group permission settings in many different ways. This data may provide the adversary with information about the compromised environment that can be used in follow-on activity and targeting.(Citation: CrowdStrike BloodHound April 2018)
Query: actor TTPs: Search Open Technical Databases
Matching passage: T1596 Search Open Technical Databases. Tactics: reconnaissance. Description: Adversaries may search freely available technical databases for information about victims that can be used during targeting. Information about victims may be available in online databases and repositories, such as registrations of domains/certificates as well as public collections of network data/artifacts gathered from traffic and/or scans.(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: Circl Passive DNS)(Citation: Medium SSL Cert)(Citation: SSLShopper Lookup)(Citation: DigitalShadows CDN)(Citation: Shodan) Adversaries may search in different open databases depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
Near-miss passage: T1596.004 CDNs. Tactics: reconnaissance. Description: Adversaries may search content delivery network (CDN) data about victims that can be used during targeting. CDNs allow an organization to host content from a distributed, load balanced array of servers. CDNs may also allow organizations to customize content delivery based on the requestor’s geographical region. Adversaries may search CDN data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about content servers within a CDN. Adversaries may also seek and target CDN misconfigurations that leak sensitive information not intended to be hosted and/or do not have the same protection mechanisms (ex: login portals) as the content hosted on the organization’s website.(Citation: DigitalShadows CDN) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Drive-by Compromise](https://attack.mitre.org/techniques/T1189)).
Query: ATT&CK technique for Server
Matching passage: T1583.004 Server. Tactics: resource development. Description: Adversaries may buy, lease, rent, or obtain physical servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, such as watering hole operations in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), enabling [Phishing](https://attack.mitre.org/techniques/T1566) operations, or facilitating [Command and Control](https://attack.mitre.org/tactics/TA0011). Instead of compromising a third-party [Server](https://attack.mitre.org/techniques/T1584/004) or renting a [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003), adversaries may opt to configure and run their own servers in support of operations. Free trial periods of cloud servers may also be abused.(Citation: Free Trial PurpleUrchin)(Citation: Freejacked) Adversaries may only need a lightweight setup if most of their activities will take place using online infrastructure. Or, they may need to build extensive infrastructure if they want to test, communicate, and control other aspects of their activities on their own systems.(Citation: NYTStuxnet)
Near-miss passage: T1583.003 Virtual Private Server. Tactics: resource development. Description: Adversaries may rent Virtual Private Servers (VPSs) that can be used during targeting. There exist a variety of cloud service providers that will sell virtual machines/containers as a service. By utilizing a VPS, adversaries can make it difficult to physically tie back operations to them. The use of cloud infrastructure can also make it easier for adversaries to rapidly provision, modify, and shut down their infrastructure. Acquiring a VPS for use in later stages of the adversary lifecycle, such as Command and Control, can allow adversaries to benefit from the ubiquity and trust associated with higher reputation cloud service providers. Adversaries may also acquire infrastructure from VPS service providers that are known for renting VPSs with minimal registration information, allowing for more anonymous acquisitions of infrastructure.(Citation: TrendmicroHideoutsLease)
Query: weakness Improper Neutralization of Multiple Internal Special Elements
Matching passage: CWE-165 Improper Neutralization of Multiple Internal Special Elements. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes multiple internal special elements that could be interpreted in unexpected ways when they are sent to a downstream component.
Near-miss passage: CWE-1078 Inappropriate Source Code Style or Formatting. The source code does not follow desired style or formatting for indentation, white space, comments, etc.
Query: describe CVE-2015-1290
Matching passage: CVE-2015-1290. CWE: CWE-119. CVSS: 8.800000190734863. The Google V8 engine, as used in Google Chrome before 44.0.2403.89 and QtWebEngineCore in Qt before 5.5.1, allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a crafted web site.
Near-miss passage: CVE-2015-5624. CWE: CWE-119. CVSS: 6.800000190734863. Buffer overflow in the ExecCall method in c2lv6.ocx in the FreeBit ELPhoneBtnV6 ActiveX control allows remote attackers to execute arbitrary code via a crafted HTML document, related to the discontinued "Click to Live" service.
Query: exploit Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server before 5.3.x before 5.3.2 has unknown impact and attack vectors, a different vulnerability tha
Matching passage: CVE-2015-5206. CWE: UNKNOWN. CVSS: 9.800000190734863. Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server before 5.3.x before 5.3.2 has unknown impact and attack vectors, a different vulnerability than CVE-2015-5168.
Near-miss passage: CVE-2015-4788. CWE: UNKNOWN. CVSS: 3.299999952316284. Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect integrity and availability via unknown vectors, a different vulnerability than CVE-2015-4774 and CVE-2015-4779.
Query: SOC runbook when seeing EDR alert: possible Remote Email Collection (T1114.002)
Matching passage: Playbook for T1114.002 Remote Email Collection. 1) Validate alert telemetry against T1114.002. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: collection. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens. Too
Near-miss passage: Playbook for T1114 Email Collection. Different response path focused on collection.
Query: patch priority for CVE-2015-5876
Matching passage: CVE-2015-5876. CWE: CWE-119. CVSS: 9.300000190734863. dyld in Dev Tools in Apple iOS before 9 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Near-miss passage: CVE-2015-5917. CWE: CWE-119. CVSS: 5.0. The glob implementation in tnftpd (formerly lukemftpd), as used in Apple OS X before 10.11, allows remote attackers to cause a denial of service (memory consumption and daemon outage) via a STAT command containing a crafted pattern, as demonstrated by multiple instances of the {..,..,..}/* substring.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects file execution using the msdeploy.exe lolbin. Logsource: windows / process_creation. Rule: title: Execute Files with Msdeploy.exe id: 646bc99f-6682-4b47-a73a-17b1b64c9d34 status: test description: Detects file execution using the msdeploy.exe lolbin references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msdeploy/ - https://twitter.com/pabraeken/status/995837734379032576 - https://twitter.com/pabraeken/status/999090532839313408 author: Beyu Denis, oscd.community date: 2020-10-18 modified: 2021-11-27 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - verb:sync - -source:RunCommand - -dest:runCommand Image|endswith: \msdeploy.exe condition: selection falsepositives: - System administrator Usage level: medium
Near-miss passage: Sigma rule: Detects the modification of a user group on a Fortinet FortiGate Firewall. The group could be used to grant VPN access t. Logsource: fortigate / event. Rule: title: FortiGate - User Group Modified id: 69ffc84e-8b1a-4024-8351-e018f66b8275 status: experimental description: 'Detects the modification of a user group on a Fortinet FortiGate Firewall. The group could be used to grant VPN access to a network. ' references: - https://www.fortiguard.com/psirt/FG-IR-24-535 - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/328136827/config-user-group - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) date: 2025-11-01 tags: - attack.persistence - attack.privilege-escalation logsource: product: fortigate service: event detection: selection: action: Edit cfgpath: user.group condition: selection falsepositives: - A group can be modified for legitimate purposes. level: medium
Query: alert when Detects the execution of SharpWSUS or WSUSpendu, utilities that allow for lateral movement through WSUS. Windows Server
Matching passage: Sigma rule: Detects the execution of SharpWSUS or WSUSpendu, utilities that allow for lateral movement through WSUS. Windows Server. Logsource: windows / process_creation. Rule: title: HackTool - SharpWSUS/WSUSpendu Execution id: b0ce780f-10bd-496d-9067-066d23dc3aa5 status: test description: 'Detects the execution of SharpWSUS or WSUSpendu, utilities that allow for lateral movement through WSUS. Windows Server Update Services (WSUS) is a critical component of Windows systems and is frequently configured in a way that allows an attacker to circumvent internal networking limitations. ' references: - https://labs.nettitude.com/blog/introducing-sharpwsus/ - https://github.com/nettitude/SharpWSUS - https://web.archive.org/web/20210512154016/https://github.com/AlsidOfficial/WSUSpendu/blob/master/WSUSpendu.ps1 author: '@Kostastsale, Nasreddine Bencherchali (Nextron Systems)' date: 2022-10-07 modified: 2024-08-23 tags: - attack.execution - attack.lateral-movement - attack.t1210 logsource: product: windows category: process_creation detection: selection_wsuspendu_inject: CommandLine|contains: ' -Inject ' selection_wsuspendu_payload: CommandLine|contains: - ' -PayloadArgs ' - ' -PayloadFile ' selection_sharpwsus_commands: CommandLine|contains: - ' approve ' - ' create ' - ' check ' - ' delete ' selection_sharpwsus_flags: CommandLine|contains: - ' /payload:' - ' /payload=' - ' /updateid:' - ' /updateid=' condition: all of selection_wsuspendu_* or all of selection_sharpwsus_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects changes and updates to the user risk and MFA registration policy. Attackers can modified the policies to Bypass. Logsource: azure / auditlogs. Rule: title: User Risk and MFA Registration Policy Updated id: d4c7758e-9417-4f2e-9109-6125d66dabef status: test description: 'Detects changes and updates to the user risk and MFA registration policy. Attackers can modified the policies to Bypass MFA, weaken security thresholds, facilitate further attacks, maintain persistence. ' references: - https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-configure-mfa-policy - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities author: Harjot Singh (@cyb3rjy0t) date: 2024-08-13 tags: - attack.persistence logsource: product: azure service: auditlogs detection: selection: LoggedByService: AAD Management UX Category: Policy OperationName: Update User Risk and MFA Registration Policy condition: selection falsepositives: - Known updates by administrators. level: high
Query: risk of Multiple open redirect vulnerabilities in the Tadaa! module before 7.x-1.4 for Drupal allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks v
Matching passage: CVE-2015-3358. CWE: UNKNOWN. CVSS: 5.800000190734863. Multiple open redirect vulnerabilities in the Tadaa! module before 7.x-1.4 for Drupal allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a destination parameter, related to callbacks that (1) enable and disable modules or (2) change variables.
Near-miss passage: CVE-2015-4760. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
Query: describe CVE-2015-4655
Matching passage: CVE-2015-4655. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Synology DiskStation Manager (DSM) before 5.2-5565 Update 1 allows remote attackers to inject arbitrary web script or HTML via the "compound" parameter to entry.cgi.
Near-miss passage: CVE-2015-5151. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Slider Revolution (revslider) plugin 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the client_action parameter in a revslider_ajax_action action to wp-admin/admin-ajax.php.