alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Detects instances where an SMB service on an OpenCanary node has had a file open request.
Matching passage: Sigma rule: Detects instances where an SMB service on an OpenCanary node has had a file open request.. Logsource: opencanary / application. Rule: title: OpenCanary - SMB File Open Request id: 22777c9e-873a-4b49-855f-6072ab861a52 status: test description: Detects instances where an SMB service on an OpenCanary node has had a file open request. references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.lateral-movement - attack.collection - attack.t1021 - attack.t1005 logsource: category: application product: opencanary detection: selection: logtype: 5000 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.. Logsource: windows / wmi. Rule: title: WMI Persistence id: 0b7889b4-5577-4521-a60a-3376ee7f9f7b status: test description: Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs. references: - https://twitter.com/mattifestation/status/899646620148539397 - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/ author: Florian Roth (Nextron Systems), Gleb Sukhodolskiy, Timur Zinniatullin oscd.community date: 2017-08-22 modified: 2022-02-10 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.003 logsource: product: windows service: wmi definition: WMI Namespaces Auditing and SACL should be configured, EventID 5861 and 5859 detection requires Windows 10, 2012 and higher detection: wmi_filter_to_consumer_binding: EventID: 5861 consumer_keywords: - ActiveScriptEventConsumer - CommandLineEventConsumer - CommandLineTemplate wmi_filter_registration: EventID: 5859 filter_scmevent: Provider: SCM Event Provider Query: select * from MSFT_SCMEventLogEvent User: S-1-5-32-544 PossibleCause: Permanent condition: ( (wmi_filter_to_consumer_binding and consumer_keywords) or (wmi_filter_registration) ) and not filter_scmevent falsepositives: - Unknown (data set is too small; further testing needed) level: medium
Query: patch priority for CVE-2015-6643
Matching passage: CVE-2015-6643. CWE: CWE-264. CVSS: 6.599999904632568. Setup Wizard in Android 5.x before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows physically proximate attackers to modify settings or bypass a reset protection mechanism via unspecified vectors, aka internal bug 25290269.
Near-miss passage: CVE-2015-4545. CWE: CWE-264. CVSS: 8.0. EMC Isilon OneFS 7.1 before 7.1.1.8, 7.2.0 before 7.2.0.4, and 7.2.1 before 7.2.1.1 allows remote authenticated administrators to bypass a SmartLock root-login restriction by creating a root account and establishing a login session.
Query: risk of Open redirect vulnerability in Proxmox Mail Gateway prior to hotfix 4.0-8-097d26a9 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via
Matching passage: CVE-2015-9058. CWE: CWE-601. CVSS: 6.099999904632568. Open redirect vulnerability in Proxmox Mail Gateway prior to hotfix 4.0-8-097d26a9 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the destination parameter.
Near-miss passage: CVE-2015-4070. CWE: CWE-601. CVSS: 6.099999904632568. Open redirect vulnerability in the proxyimages function in wowproxy.php in the Wow Moodboard Lite plugin 1.1.1.1 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.
Query: detection engineering for Credential Stuffing
Matching passage: T1110.004 Credential Stuffing. Tactics: credential access. Description: Adversaries may use credentials obtained from breach dumps of unrelated accounts to gain access to target accounts through credential overlap. Occasionally, large numbers of username and password pairs are dumped online when a website or service is compromised and the user account credentials accessed. The information may be useful to an adversary attempting to compromise accounts by taking advantage of the tendency for users to use the same passwords across personal and business accounts. Credential stuffing is a risky option because it could cause numerous authentication failures and account lockouts, depending on the organization's login failure policies. Typically, management services over commonly used ports are used when stuffing credentials. Commonly targeted services include the following: * SSH (22/TCP) * Telnet (23/TCP) * FTP (21/TCP) * NetBIOS / SMB / Samba (139/TCP & 445/TCP) * LDAP (389/TCP) * Kerberos (88/TCP) * RDP / Terminal Services (3389/TCP) * HTTP/HTTP Management Services (80/TCP & 443/TCP) * MSSQL (1433/TCP) * Oracle (1521/TCP) * MySQL (3306/TCP) * VNC (5900/TCP) In addition to management services, adversaries may "target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols," as well as externally facing email applications, such as Office 365.(Citation: US-CERT TA18-068A 2018)
Near-miss passage: T1110.002 Password Cracking. Tactics: credential access. Description: Adversaries may use password cracking to attempt to recover usable credentials, such as plaintext passwords, when credential material such as password hashes are obtained. [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) can be used to obtain password hashes, this may only get an adversary so far when [Pass the Hash](https://attack.mitre.org/techniques/T1550/002) is not an option. Further, adversaries may leverage [Data from Configuration Repository](https://attack.mitre.org/techniques/T1602) in order to obtain hashed credentials for network devices.(Citation: US-CERT-TA18-106A) Techniques to systematically guess the passwords used to compute hashes are available, or the adversary may use a pre-computed rainbow table to crack hashes. Cracking hashes is usually done on adversary-controlled systems outside of the target network.(Citation: Wikipedia Password cracking) The resulting plaintext password resulting from a successfully cracked hash may be used to log into systems, resources, and services in which the account has access.
Query: detect Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attacke in logs
Matching passage: Sigma rule: Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attacke. Logsource: windows / process_creation. Rule: title: Insensitive Subfolder Search Via Findstr.EXE id: 04936b66-3915-43ad-a8e5-809eadfd1141 related: - id: bf6c39fc-e203-45b9-9538-05397c1b4f3f type: obsolete status: test description: 'Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands. ' references: - https://lolbas-project.github.io/lolbas/Binaries/Findstr/ - https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/ - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems) date: 2020-10-05 modified: 2024-03-05 tags: - attack.credential-access - attack.command-and-control - attack.stealth - attack.t1218 - attack.t1564.004 - attack.t1552.001 - attack.t1105 logsource: category: process_creation product: windows detection: selection_findstr: - CommandLine|contains: findstr - Image|endswith: findstr.exe - OriginalFileName: FINDSTR.EXE selection_cli_search_subfolder: CommandLine|contains|windash: ' -s ' selection_cli_search_insensitive: CommandLine|contains|windash: ' -i ' condition: selection_findstr and all of selection_cli_search_* falsepositives: - Administrative or software activity level: low
Near-miss passage: Sigma rule: Detects the execution of REGSVR32.exe with DLL files masquerading as other files. Logsource: windows / process_creation. Rule: title: Regsvr32 DLL Execution With Suspicious File Extension id: 089fc3d2-71e8-4763-a8a5-c97fbb0a403e related: - id: 8e2b24c9-4add-46a0-b4bb-0057b4e6187d type: obsolete status: test description: Detects the execution of REGSVR32.exe with DLL files masquerading as other files references: - https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/ - https://blog.talosintelligence.com/2021/10/threat-hunting-in-large-datasets-by.html - https://guides.lib.umich.edu/c.php?g=282942&p=1885348 - https://harfanglab.io/insidethelab/uac-0057-pressure-ukraine-poland/ author: Florian Roth (Nextron Systems), frack113 date: 2021-11-29 modified: 2025-08-27 tags: - attack.stealth - attack.t1218.010 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \regsvr32.exe - OriginalFileName: REGSVR32.EXE selection_cli: CommandLine|endswith: - .bin - .bmp - .cr2 - .dat - .eps - .gif - .ico - .jpeg - .jpg - .log - .nef - .orf - .png - .raw - .rtf - .sr2 - .temp - .tif - .tiff - .tmp - .txt condition: all of selection_* falsepositives: - Unlikely level: high
Query: patch priority for CVE-2015-2096
Matching passage: CVE-2015-2096. CWE: UNKNOWN. CVSS: 6.800000190734863. Use-after-free vulnerability in the Connect function in the WESPMonitor.WESPMonitorCtrl.1 ActiveX control in WebGate eDVR Manager allows remote attackers to execute arbitrary code via an invalid IP address and a page reload.
Near-miss passage: CVE-2015-7616. CWE: UNKNOWN. CVSS: 6.800000190734863. The ANVerifyComments method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6712, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7618, CVE-2015-7619, CVE-2015-7620, and CVE-2015-7623.
Query: secure coding against Weak Encoding for Password
Matching passage: CWE-261 Weak Encoding for Password. Obscuring a password with a trivial encoding does not protect the password.
Near-miss passage: CWE-403 Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak'). A process does not close sensitive file descriptors before invoking a child process, which allows the child to perform unauthorized I/O operations using those descriptors.
Query: exploit Cross-site scripting (XSS) vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to inject arbitrary web script or HTML via the playlistname field when crea
Matching passage: CVE-2015-8310. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to inject arbitrary web script or HTML via the playlistname field when creating a new playlist.
Near-miss passage: CVE-2015-1041. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in e107_admin/filemanager.php in e107 1.0.4 allows remote attackers to inject arbitrary web script or HTML via the e107_files/ file path in the QUERY_STRING.
Query: CVE similar to CVE-2015-0135
Matching passage: CVE-2015-0135. CWE: CWE-189. CVSS: 10.0. IBM Domino 8.5 before 8.5.3 FP6 IF4 and 9.0 before 9.0.1 FP3 IF2 allows remote attackers to execute arbitrary code or cause a denial of service (integer truncation and application crash) via a crafted GIF image, aka SPR KLYH9T7NT9.
Near-miss passage: CVE-2015-3228. CWE: CWE-189. CVSS: 6.800000190734863. Integer overflow in the gs_heap_alloc_bytes function in base/gsmalloc.c in Ghostscript 9.15 and earlier allows remote attackers to cause a denial of service (crash) via a crafted Postscript (ps) file, as demonstrated by using the ps2pdf command, which triggers an out-of-bounds read or write.
Query: risk of Juniper ScreenOS before 6.3.0r21, when ssh-pka is configured and enabled, allows remote attackers to cause a denial of service (system crash) or execute arbitrary code via crafted 
Matching passage: CVE-2015-7754. CWE: CWE-20. CVSS: 8.100000381469727. Juniper ScreenOS before 6.3.0r21, when ssh-pka is configured and enabled, allows remote attackers to cause a denial of service (system crash) or execute arbitrary code via crafted SSH negotiation.
Near-miss passage: CVE-2015-5195. CWE: CWE-20. CVSS: 7.5. ntp_openssl.m4 in ntpd in NTP before 4.2.7p112 allows remote attackers to cause a denial of service (segmentation fault) via a crafted statistics or filegen configuration command that is not enabled during compilation.
Query: rule covering Detects the use of wget to download content to a suspicious directory
Matching passage: Sigma rule: Detects the use of wget to download content to a suspicious directory. Logsource: linux / process_creation. Rule: title: Download File To Potentially Suspicious Directory Via Wget id: cf610c15-ed71-46e1-bdf8-2bd1a99de6c4 status: test description: Detects the use of wget to download content to a suspicious directory references: - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/ - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-06-02 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: /wget selection_output: - CommandLine|re: \s-O\s - CommandLine|contains: --output-document selection_path: CommandLine|contains: /tmp/ condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the creation of files with an executable or script extension by an Office application.. Logsource: windows / file_event. Rule: title: File With Uncommon Extension Created By An Office Application id: c7a74c80-ba5a-486e-9974-ab9e682bc5e4 status: test description: Detects the creation of files with an executable or script extension by an Office application. references: - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ - https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml author: Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule), Nasreddine Bencherchali (Nextron Systems) date: 2021-08-23 modified: 2025-10-17 tags: - attack.t1204.002 - attack.execution logsource: product: windows category: file_event detection: selection1: Image|endswith: - \excel.exe - \msaccess.exe - \mspub.exe - \powerpnt.exe - \visio.exe - \winword.exe selection2: TargetFilename|endswith: - .bat - .cmd - .com - .dll - .exe - .hta - .ocx - .proj - .ps1 - .scf - .scr - .sys - .vbe - .vbs - .wsf - .wsh filter_main_localassembly: TargetFilename|contains: \AppData\Local\assembly\tmp\ TargetFilename|endswith: .dll filter_optional_webservicecache: TargetFilename|contains|all: - C:\Users\ - \AppData\Local\Microsoft\Office\ - \WebServiceCache\AllUsers TargetFilename|endswith: .com filter_optional_webex: Image|endswith: \winword.exe TargetFilename|contains: \AppData\Local\Temp\webexdelta\ TargetFilename|endswith: - .dll - .exe filter_optional_backstageinappnavcache: TargetFilename|contains|all: - C:\Users\ - \AppData\Local\Microsoft\Office\ - \BackstageInAppNavCache\ TargetFilename|endswith: .com condition: all of selection* and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: high
Query: vulnerability: Unspecified vulnerability in the Oracle Sourcing component in Oracle E-Business Suite 12.1.1, 12.1.2, 12.1.3, 12.2.3, and 12.2.4 allows remote authenticated users to affect confide
Matching passage: CVE-2015-4728. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Oracle Sourcing component in Oracle E-Business Suite 12.1.1, 12.1.2, 12.1.3, 12.2.3, and 12.2.4 allows remote authenticated users to affect confidentiality via unknown vectors related to Bid/Quote creation.
Near-miss passage: CVE-2015-2767. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in Websense TRITON AP-EMAIL before 8.0.0 has unknown impact and attack vectors, related to "Autocomplete Enabled."
Query: CVE similar to CVE-2015-1947
Matching passage: CVE-2015-1947. CWE: UNKNOWN. CVSS: 7.400000095367432. Untrusted search path vulnerability in IBM InfoSphere BigInsights 3.0, 3.0.0.1, 3.0.0.2, and 4.0, when a DB2 database is used, allows local users to gain privileges via a Trojan horse library that is loaded by a setuid or setgid program.
Near-miss passage: CVE-2015-4786. CWE: UNKNOWN. CVSS: 6.900000095367432. Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-2583, CVE-2015-2624, CVE-2015-2626, CVE-2015-2640, CVE-2015-2654, CVE-2015-2656, CVE-2015-4754, CVE-2015-4764, CVE-2015-4775, CVE-2015-4776, CVE-2015-4777, CVE-2015-4778, CVE-2015-4780, CVE-2015-4781, CVE-2015-4782, CVE-2015-4783, CVE-2015-4784, CVE-2015-4785, CVE-2015-4787, CVE-2015-4789, and CVE-2015-4790.
Query: describe CVE-2015-6611
Matching passage: CVE-2015-6611. CWE: CWE-200. CVSS: 5.0. mediaserver in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, aka internal bugs 23905951, 23912202, 23953967, 23696300, 23600291, 23756261, 23541506, 23284974, 23542351, and 23542352, a different vulnerability than CVE-2015-8074.
Near-miss passage: CVE-2015-2421. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass."
Query: Sigma rule for Detects a remote thread creation of Ttdinject.exe used as proxy
Matching passage: Sigma rule: Detects a remote thread creation of Ttdinject.exe used as proxy. Logsource: windows / create_remote_thread. Rule: title: Remote Thread Creation Ttdinject.exe Proxy id: c15e99a3-c474-48ab-b9a7-84549a7a9d16 status: test description: Detects a remote thread creation of Ttdinject.exe used as proxy references: - https://lolbas-project.github.io/lolbas/Binaries/Ttdinject/ author: frack113 date: 2022-05-16 modified: 2022-06-02 tags: - attack.execution - attack.stealth - attack.t1127 logsource: product: windows category: create_remote_thread detection: selection: SourceImage|endswith: \ttdinject.exe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects files dropped by Winnti as described in RedMimicry Winnti playbook. Logsource: windows / file_event. Rule: title: Potential Winnti Dropper Activity id: 130c9e58-28ac-4f83-8574-0a4cc913b97e status: test description: Detects files dropped by Winnti as described in RedMimicry Winnti playbook references: - https://redmimicry.com/posts/redmimicry-winnti/#dropper author: Alexander Rausch date: 2020-06-24 modified: 2023-01-05 tags: - attack.stealth - attack.t1027 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: - \gthread-3.6.dll - \sigcmm-2.4.dll - \Windows\Temp\tmp.bat condition: selection falsepositives: - Unknown level: high
Query: exploit Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Ex
Matching passage: CVE-2015-1694. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1710.
Near-miss passage: CVE-2015-8072. CWE: CWE-119. CVSS: 10.0. mediaserver in Android 4.4 through 5.x before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23881715, a different vulnerability than CVE-2015-6608 and CVE-2015-8073.
Query: detection rule: Detects usage of "query.exe" a system binary to exfil information such as "sessions" and "processes" for later use
Matching passage: Sigma rule: Detects usage of "query.exe" a system binary to exfil information such as "sessions" and "processes" for later use. Logsource: windows / process_creation. Rule: title: Query Usage To Exfil Data id: 53ef0cef-fa24-4f25-a34a-6c72dfa2e6e2 status: test description: Detects usage of "query.exe" a system binary to exfil information such as "sessions" and "processes" for later use references: - https://twitter.com/MichalKoczwara/status/1553634816016498688 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-01 modified: 2023-01-19 tags: - attack.execution logsource: category: process_creation product: windows detection: selection: Image|endswith: :\Windows\System32\query.exe CommandLine|contains: - session > - process > condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detect modification of services configuration (ImagePath, FailureCommand and ServiceDLL) in registry by processes with M. Logsource: windows / process_creation. Rule: title: Potential Privilege Escalation via Service Permissions Weakness id: 0f9c21f1-6a73-4b0e-9809-cb562cb8d981 status: test description: Detect modification of services configuration (ImagePath, FailureCommand and ServiceDLL) in registry by processes with Medium integrity level references: - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment - https://pentestlab.blog/2017/03/31/insecure-registry-permissions/ author: Teymur Kheirkhabarov date: 2019-10-26 modified: 2024-12-01 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.011 logsource: product: windows category: process_creation detection: selection: IntegrityLevel: - Medium - S-1-16-8192 CommandLine|contains|all: - ControlSet - services CommandLine|contains: - \ImagePath - \FailureCommand - \ServiceDll condition: selection falsepositives: - Unknown level: high
Query: risk of Use-after-free vulnerability in the mif_process_cmpt function in libjasper/mif/mif_cod.c in the JasPer JPEG-2000 library before 1.900.2 allows remote attackers to cause a denial of
Matching passage: CVE-2015-5221. CWE: CWE-416. CVSS: 5.5. Use-after-free vulnerability in the mif_process_cmpt function in libjasper/mif/mif_cod.c in the JasPer JPEG-2000 library before 1.900.2 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file.
Near-miss passage: CVE-2015-3890. CWE: CWE-416. CVSS: 7.5. Use-after-free vulnerability in Open Litespeed before 1.3.10.