alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-0445
Matching passage: CVE-2015-0445. CWE: UNKNOWN. CVSS: 6.800000190734863. Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Data Quality based on Trillium, a different vulnerability than CVE-2015-0443, CVE-2015-0444, CVE-2015-0446, CVE-2015-2634, CVE-2015-2635, CVE-2015-2636, CVE-2015-4758, and CVE-2015-4759.
Near-miss passage: CVE-2015-4911. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4803 and CVE-2015-4893.
Query: vulnerability: The Proxy Mobile IPv6 (PMIPv6) component in the CDMA implementation on Cisco ASR 5000 devices with software 19.0.M0.60737 allows remote attackers to cause a denial of service (hamg
Matching passage: CVE-2015-6340. CWE: CWE-119. CVSS: 5.0. The Proxy Mobile IPv6 (PMIPv6) component in the CDMA implementation on Cisco ASR 5000 devices with software 19.0.M0.60737 allows remote attackers to cause a denial of service (hamgr process restart) via a crafted header in a PMIPv6 packet, aka Bug ID CSCuv63280.
Near-miss passage: CVE-2015-8614. CWE: CWE-119. CVSS: 7.300000190734863. Multiple stack-based buffer overflows in the (1) conv_jistoeuc, (2) conv_euctojis, and (3) conv_sjistoeuc functions in codeconv.c in Claws Mail before 3.13.1 allow remote attackers to have unspecified impact via a crafted email, involving Japanese character set conversion.
Query: alert when Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numer
Matching passage: Sigma rule: Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numer. Logsource: windows / process_creation. Rule: title: Deletion of Volume Shadow Copies via WMI with PowerShell id: 21ff4ca9-f13a-41ad-b828-0077b2af2e40 related: - id: e17121b4-ef2a-4418-8a59-12fb1631fa9e type: derived - id: c1337eb8-921a-4b59-855b-4ba188ddcc42 type: similar status: test description: Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell - https://www.elastic.co/guide/en/security/current/volume-shadow-copy-deletion-via-powershell.html author: Tim Rauch, Elastic (idea) date: 2022-09-20 modified: 2022-12-30 tags: - attack.impact - attack.t1490 logsource: category: process_creation product: windows detection: selection_get: CommandLine|contains: - Get-WmiObject - gwmi - Get-CimInstance - gcim selection_shadowcopy: CommandLine|contains: Win32_ShadowCopy selection_delete: CommandLine|contains: - .Delete() - Remove-WmiObject - rwmi - Remove-CimInstance - rcim condition: all of selection* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the use of the `syslog` syscall with action code 5 (SYSLOG_ACTION_CLEAR), (4 is SYSLOG_ACTION_READ_CLEAR and 6 i. Logsource: linux / auditd. Rule: title: Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall id: eca5e022-d368-4043-98e5-9736fb01f72f status: experimental description: 'Detects the use of the `syslog` syscall with action code 5 (SYSLOG_ACTION_CLEAR), (4 is SYSLOG_ACTION_READ_CLEAR and 6 is SYSLOG_ACTION_CONSOLE_OFF) which clears the kernel ring buffer (dmesg logs). This can be used by attackers to hide traces after exploitation or privilege escalation. A common technique is running `dmesg -c`, which triggers this syscall internally. ' references: - https://man7.org/linux/man-pages/man2/syslog.2.html - https://man7.org/linux/man-pages/man1/dmesg.1.html author: Milad Cheraghi date: 2025-05-27 modified: 2025-12-05 tags: - attack.defense-impairment - attack.t1685.006 logsource: product: linux service: auditd definition: 'Required auditd configuration: -a always,exit -F arch=b64 -S syslog -F a0=4 -k clear_dmesg_logs -a always,exit -F arch=b64 -S syslog -F a0=5 -k clear_dmesg_logs -a always,exit -F arch=b64 -S syslog -F a0=6 -k disable_dmesg_logs -a always,exit -F arch=b32 -S syslog -F a0=4 -k clear_dmesg_logs -a always,exit -F arch=b32 -S syslog -F a0=5 -k clear_dmesg_logs -a always,exit -F arch=b32 -S syslog -F a0=6 -k disable_dmesg_logs ' detection: selection: type: SYSCALL SYSCALL: syslog a0: - 4 - 5 - 6 condition: selection falsepositives: - System administrators or scripts that intentionally clear logs - Debugging scripts level: medium
Query: mitigate Search Open Websites/Domains
Matching passage: T1593 Search Open Websites/Domains. Tactics: reconnaissance. Description: Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting. Information about victims may be available in various online sites, such as social media, new sites, or those hosting information about business operations such as hiring or requested/rewarded contracts.(Citation: Cyware Social Media)(Citation: SecurityTrails Google Hacking)(Citation: ExploitDB GoogleHacking) Adversaries may search in different online sites depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Phishing](https://attack.mitre.org/techniques/T1566)).
Near-miss passage: T1593.003 Code Repositories. Tactics: reconnaissance. Description: Adversaries may search public code repositories for information about victims that can be used during targeting. Victims may store code in repositories on various third-party websites such as GitHub, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git. Adversaries may search various public code repositories for various information about a victim. Public code repositories can often be a source of various general information about victims, such as commonly used programming languages and libraries as well as the names of employees. Adversaries may also identify more sensitive data, including accidentally leaked credentials or API keys.(Citation: GitHub Cloud Service Credentials) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Valid Accounts](https://attack.mitre.org/techniques/T1078) or [Phishing](https://attack.mitre.org/techniques/T1566)). **Note:** This is distinct from [Code Repositories](https://attack.mitre.org/techniques/T1213/003), which focuses on [Collection](https://attack.mitre.org/tactics/TA0009) from private and internally hosted code repositories.
Query: exploit Use-after-free vulnerability in Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, A
Matching passage: CVE-2015-5574. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5570, CVE-2015-5581, CVE-2015-5584, and CVE-2015-6682.
Near-miss passage: CVE-2015-8616. CWE: UNKNOWN. CVSS: 8.600000381469727. Use-after-free vulnerability in the Collator::sortWithSortKeys function in ext/intl/collator/collator_sort.c in PHP 7.x before 7.0.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging the relationships between a key buffer and a destroyed array.
Query: CVE similar to CVE-2015-2759
Matching passage: CVE-2015-2759. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3 Patch 4 Hotfix 16 (9.3.416.4) allow remote attackers to hijack the authentication of users for requests that (1) obtain sensitive information or (2) modify the database via unspecified vectors.
Near-miss passage: CVE-2015-2805. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in sec/content/sec_asa_users_local_db_add.html in the management web interface in Alcatel-Lucent OmniSwitch 6450, 6250, 6850E, 9000E, 6400, 6855, 6900, 10K, and 6860 with firmware 6.4.5.R02, 6.4.6.R01, 6.6.4.R01, 6.6.5.R02, 7.3.2.R01, 7.3.3.R01, 7.3.4.R01, and 8.1.1.R01 allows remote attackers to hijack the authentication of administrators for requests that create users via a crafted request.
Query: risk of The Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not properly escape certain characters in a Python exception-message template, which makes it easier for remot
Matching passage: CVE-2015-5216. CWE: CWE-79. CVSS: 6.099999904632568. The Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not properly escape certain characters in a Python exception-message template, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via an HTTP response.
Near-miss passage: CVE-2015-6808. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Spotlight module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a node title.
Query: weakness Use of Expired File Descriptor
Matching passage: CWE-910 Use of Expired File Descriptor. The product uses or accesses a file descriptor after it has been closed.
Near-miss passage: CWE-1311 Improper Translation of Security Attributes by Fabric Bridge. The bridge incorrectly translates security attributes from either trusted to untrusted or from untrusted to trusted when converting from one fabric protocol to another.
Query: write Sigma for Detects the usage of schtasks with the delete flag and the asterisk symbol to delete all tasks from the schedule of the
Matching passage: Sigma rule: Detects the usage of schtasks with the delete flag and the asterisk symbol to delete all tasks from the schedule of the. Logsource: windows / process_creation. Rule: title: Delete All Scheduled Tasks id: 220457c1-1c9f-4c2e-afe6-9598926222c1 status: test description: Detects the usage of schtasks with the delete flag and the asterisk symbol to delete all tasks from the schedule of the local computer, including tasks scheduled by other users. references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-delete author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-09 tags: - attack.impact - attack.t1489 logsource: category: process_creation product: windows detection: selection: Image|endswith: \schtasks.exe CommandLine|contains|all: - ' /delete ' - /tn \* - ' /f' condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Looks for potential enumeration of AWS buckets via ListBuckets.. Logsource: aws / cloudtrail. Rule: title: Potential Bucket Enumeration on AWS id: f305fd62-beca-47da-ad95-7690a0620084 related: - id: 4723218f-2048-41f6-bcb0-417f2d784f61 type: similar status: test description: Looks for potential enumeration of AWS buckets via ListBuckets. references: - https://github.com/Lifka/hacking-resources/blob/c2ae355d381bd0c9f0b32c4ead049f44e5b1573f/cloud-hacking-cheat-sheets.md - https://jamesonhacking.blogspot.com/2020/12/pivoting-to-private-aws-s3-buckets.html - https://securitycafe.ro/2022/12/14/aws-enumeration-part-ii-practical-enumeration/ author: Christopher Peacock @securepeacock, SCYTHE @scythe_io date: 2023-01-06 modified: 2024-07-10 tags: - attack.discovery - attack.t1580 - attack.t1619 logsource: product: aws service: cloudtrail detection: selection: eventSource: s3.amazonaws.com eventName: ListBuckets filter: userIdentity.type: AssumedRole condition: selection and not filter falsepositives: - Administrators listing buckets, it may be necessary to filter out users who commonly conduct this activity. level: low
Query: weakness Use of RSA Algorithm without OAEP
Matching passage: CWE-780 Use of RSA Algorithm without OAEP. The product uses the RSA algorithm but does not incorporate Optimal Asymmetric Encryption Padding (OAEP), which might weaken the encryption.
Near-miss passage: CWE-273 Improper Check for Dropped Privileges. The product attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded.
Query: Lateral movement indicators for Audio Capture
Matching passage: T1123 Audio Capture. Tactics: collection. Description: An adversary can leverage a computer's peripheral devices (e.g., microphones and webcams) or applications (e.g., voice and video call services) to capture audio recordings for the purpose of listening into sensitive conversations to gather information.(Citation: ESET Attor Oct 2019) Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture audio. Audio files may be written to disk and exfiltrated later.
Near-miss passage: T1530 Data from Cloud Storage. Tactics: collection. Description: Adversaries may access data from cloud storage. Many IaaS providers offer solutions for online data object storage such as Amazon S3, Azure Storage, and Google Cloud Storage. Similarly, SaaS enterprise platforms such as Office 365 and Google Workspace provide cloud-based document storage to users through services such as OneDrive and Google Drive, while SaaS application providers such as Slack, Confluence, Salesforce, and Dropbox may provide cloud storage solutions as a peripheral or primary use case of their platform. In some cases, as with IaaS-based cloud storage, there exists no overarching application (such as SQL or Elasticsearch) with which to interact with the stored objects: instead, data from these solutions is retrieved directly though the [Cloud API](https://attack.mitre.org/techniques/T1059/009). In SaaS applications, adversaries may be able to collect this data directly from APIs or backend cloud storage objects, rather than through their front-end application or interface (i.e., [Data from Information Repositories](https://attack.mitre.org/techniques/T1213)). Adversaries may collect sensitive data from these cloud storage solutions. Providers typically offer security guides to help end users configure systems, though misconfigurations are a common problem.(Citation: Amazon S3 Security, 2019)(Citation: Microsoft Azure Storage Security, 2019)(Citation: Google Cloud Storage Best Practices, 2019) There have been numerous incidents where cloud storage has been improperly secured, typically by unintentionally allowing public access to unauthenticated users, overly-broad access by all users, or even access for any anonymous person outside the control of the Identity Access Management system without even needing basic user permissions. This open access may expose various types of sensitive data, such as credit cards, personally identifiable information, or medical records.(Citation: Trend Micro S3 Exposed PII, 2017)(Citation: Wired Magecart S3 Buckets, 2019)(
Query: Outbound C2 pattern associated with Obtain Capabilities
Matching passage: T1588 Obtain Capabilities. Tactics: resource development. Description: Adversaries may buy and/or steal capabilities that can be used during targeting. Rather than developing their own capabilities in-house, adversaries may purchase, freely download, or steal them. Activities may include the acquisition of malware, software (including licenses), exploits, certificates, and information relating to vulnerabilities. Adversaries may obtain capabilities to support their operations throughout numerous phases of the adversary lifecycle. In addition to downloading free malware, software, and exploits from the internet, adversaries may purchase these capabilities from third-party entities. Third-party entities can include technology companies that specialize in malware and exploits, criminal marketplaces, or from individuals.(Citation: NationsBuying)(Citation: PegasusCitizenLab) In addition to purchasing capabilities, adversaries may steal capabilities from third-party entities (including other adversaries). This can include stealing software licenses, malware, SSL/TLS and code-signing certificates, or raiding closed databases of vulnerabilities or exploits.(Citation: DiginotarCompromise)
Near-miss passage: T1588.001 Malware. Tactics: resource development. Description: Adversaries may buy, steal, or download malware that can be used during targeting. Malicious software can include payloads, droppers, post-compromise tools, backdoors, packers, and C2 protocols. Adversaries may acquire malware to support their operations, obtaining a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors. In addition to downloading free malware from the internet, adversaries may purchase these capabilities from third-party entities. Third-party entities can include technology companies that specialize in malware development, criminal marketplaces (including Malware-as-a-Service, or MaaS), or from individuals. In addition to purchasing malware, adversaries may steal and repurpose malware from third-party entities (including other adversaries).
Query: CVE similar to CVE-2015-7893
Matching passage: CVE-2015-7893. CWE: CWE-20. CVSS: 8.800000190734863. SecEmailUI in Samsung Galaxy S6 does not sanitize HTML email content, allows remote attackers to execute arbitrary JavaScript.
Near-miss passage: CVE-2015-9246. CWE: CWE-20. CVSS: 9.800000190734863. An issue was discovered in Skybox Platform before 7.5.201. Remote Unauthenticated Code Execution exists via a WAR archive containing a JSP file. The WAR file is sent to /skyboxview-softwareupdate/services/CollectorSoftwareUpdate and the JSP file is reached at /opt/skyboxview/thirdparty/jboss/server/web/work/jboss.web/localhost.
Query: write Sigma for Detects listing of the inodes of the "/" directory to determine if the we are running inside of a container.
Matching passage: Sigma rule: Detects listing of the inodes of the "/" directory to determine if the we are running inside of a container.. Logsource: linux / process_creation. Rule: title: Potential Container Discovery Via Inodes Listing id: 43e26eb5-cd58-48d1-8ce9-a273f5d298d8 status: test description: Detects listing of the inodes of the "/" directory to determine if the we are running inside of a container. references: - https://blog.skyplabs.net/posts/container-detection/ - https://stackoverflow.com/questions/20010199/how-to-determine-if-a-process-runs-inside-lxc-docker tags: - attack.discovery - attack.t1082 author: Seth Hanford date: 2023-08-23 modified: 2025-11-24 logsource: category: process_creation product: linux detection: selection_ls_img: Image|endswith: /ls selection_ls_cli: - CommandLine|endswith: ' /' - CommandLine|contains: ' / ' selection_regex_inode: CommandLine|re: (?:\s-[^-\s]{0,20}i|\s--inode\s) selection_regex_dir: CommandLine|re: (?:\s-[^-\s]{0,20}d|\s--directory\s) condition: all of selection_* falsepositives: - Legitimate system administrator usage of these commands - Some container tools or deployments may use these techniques natively to determine how they proceed with execution, and will need to be filtered level: low
Near-miss passage: Sigma rule: Detects process creation with a renamed BrowserCore.exe (used to extract Azure tokens). Logsource: windows / process_creation. Rule: title: Renamed BrowserCore.EXE Execution id: 8a4519e8-e64a-40b6-ae85-ba8ad2177559 status: test description: Detects process creation with a renamed BrowserCore.exe (used to extract Azure tokens) references: - https://twitter.com/mariuszbit/status/1531631015139102720 author: Max Altgelt (Nextron Systems) date: 2022-06-02 modified: 2023-02-03 tags: - attack.credential-access - attack.stealth - attack.t1528 - attack.t1036.003 logsource: category: process_creation product: windows detection: selection: OriginalFileName: BrowserCore.exe filter_realbrowsercore: Image|endswith: \BrowserCore.exe condition: selection and not 1 of filter_* falsepositives: - Unknown level: high
Query: risk of The com_content component in Joomla! 3.x before 3.4.5 does not properly check ACLs, which allows remote attackers to obtain sensitive information via unspecified vectors.
Matching passage: CVE-2015-7899. CWE: CWE-284. CVSS: 5.0. The com_content component in Joomla! 3.x before 3.4.5 does not properly check ACLs, which allows remote attackers to obtain sensitive information via unspecified vectors.
Near-miss passage: CVE-2015-10057. CWE: CWE-284. CVSS: 9.800000190734863. A vulnerability was found in Little Apps Little Software Stats. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file inc/class.securelogin.php of the component Password Reset Handler. The manipulation leads to improper access controls. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 0.2 is able to address this issue. The identifier of the patch is 07ba8273a9311d1383f3686ac7cb32f20770ab1e. It is recommended to upgrade the affected component. The identifier VDB-218401 was assigned to this vulnerability.