alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: patch priority for CVE-2015-9415
Matching passage: CVE-2015-9415. CWE: CWE-20. CVSS: 7.5. The bj-lazy-load plugin before 1.0 for WordPress has Remote File Inclusion.
Near-miss passage: CVE-2015-1379. CWE: CWE-20. CVSS: 7.5. The signal handler implementations in socat before 1.7.3.0 and 2.0.0-b8 allow remote attackers to cause a denial of service (process freeze or crash).
Query: exploit Cross-site scripting (XSS) vulnerability in the Taxonomy Find module 6.x-2.x through 6.x-1.2 and 7.x-2.x through 7.x-1.0 in Drupal allows remote authenticated users with certain pe
Matching passage: CVE-2015-7878. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in the Taxonomy Find module 6.x-2.x through 6.x-1.2 and 7.x-2.x through 7.x-1.0 in Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via taxonomy vocabulary and term names.
Near-miss passage: CVE-2015-5532. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in the Paid Memberships Pro (PMPro) plugin before 1.8.4.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) s parameter to membershiplevels.php, (2) memberslist.php, or (3) orders.php in adminpages/ or the (4) edit parameter to adminpages/membershiplevels.php.
Query: exploit The Multicast DNS (mDNS) responder in Synology DiskStation Manager (DSM) before 3.1 inadvertently responds to unicast queries with source addresses that are not link-local, which a
Matching passage: CVE-2015-2809. CWE: CWE-200. CVSS: 5.0. The Multicast DNS (mDNS) responder in Synology DiskStation Manager (DSM) before 3.1 inadvertently responds to unicast queries with source addresses that are not link-local, which allows remote attackers to cause a denial of service (traffic amplification) or obtain potentially sensitive information via port-5353 UDP packets to the Avahi component.
Near-miss passage: CVE-2015-1426. CWE: CWE-200. CVSS: 2.0999999046325684. Puppet Labs Facter 1.6.0 through 2.4.0 allows local users to obtains sensitive Amazon EC2 IAM instance metadata by reading a fact for an Amazon EC2 node.
Query: write Sigma for Detect usage of the "runexehelper.exe" binary as a proxy to launch other programs
Matching passage: Sigma rule: Detect usage of the "runexehelper.exe" binary as a proxy to launch other programs. Logsource: windows / process_creation. Rule: title: Lolbin Runexehelper Use As Proxy id: cd71385d-fd9b-4691-9b98-2b1f7e508714 status: test description: Detect usage of the "runexehelper.exe" binary as a proxy to launch other programs references: - https://twitter.com/0gtweet/status/1206692239839289344 - https://lolbas-project.github.io/lolbas/Binaries/Runexehelper/ author: frack113 date: 2022-12-29 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \runexehelper.exe condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects an office suit application (Word, Excel, PowerPoint, Outlook) communicating to target systems over uncommon port. Logsource: windows / network_connection. Rule: title: Office Application Initiated Network Connection Over Uncommon Ports id: 3b5ba899-9842-4bc2-acc2-12308498bf42 status: test description: Detects an office suit application (Word, Excel, PowerPoint, Outlook) communicating to target systems over uncommon ports. references: - https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2023-07-12 modified: 2025-10-17 tags: - attack.command-and-control - attack.stealth logsource: category: network_connection product: windows detection: selection: Initiated: 'true' Image|endswith: - \excel.exe - \outlook.exe - \powerpnt.exe - \winword.exe - \wordview.exe filter_main_common_ports: DestinationPort: - 53 - 80 - 139 - 389 - 443 - 445 - 3268 filter_main_outlook_ports: Image|contains: :\Program Files\Microsoft Office\ Image|endswith: \OUTLOOK.EXE DestinationPort: - 143 - 465 - 587 - 993 - 995 condition: selection and not 1 of filter_main_* falsepositives: - Other ports can be used, apply additional filters accordingly level: medium
Query: write Sigma for Rule to detect the Hybrid Connection Manager service running on an endpoint.
Matching passage: Sigma rule: Rule to detect the Hybrid Connection Manager service running on an endpoint.. Logsource: windows / microsoft-servicebus-client. Rule: title: HybridConnectionManager Service Running id: b55d23e5-6821-44ff-8a6e-67218891e49f status: test description: Rule to detect the Hybrid Connection Manager service running on an endpoint. references: - https://twitter.com/Cyb3rWard0g/status/1381642789369286662 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2021-04-12 modified: 2024-08-05 tags: - attack.persistence - attack.t1554 logsource: product: windows service: microsoft-servicebus-client detection: selection: EventID: - 40300 - 40301 - 40302 keywords: - HybridConnection - sb:// - servicebus.windows.net - HybridConnectionManage condition: selection and keywords falsepositives: - Legitimate use of Hybrid Connection Manager via Azure function apps. level: high
Near-miss passage: Sigma rule: Detects when an attacker adds a new AMSI provider via the Windows Registry to bypass AMSI (Antimalware Scan Interface) p. Logsource: windows / registry_set. Rule: title: Potential Persistence Via New AMSI Providers - Registry id: 33efc23c-6ea2-4503-8cfe-bdf82ce8f705 status: test description: 'Detects when an attacker adds a new AMSI provider via the Windows Registry to bypass AMSI (Antimalware Scan Interface) protections. Attackers may add custom AMSI providers to persist on the system and evade detection by security software that relies on AMSI for scanning scripts and other content. This technique is often used in conjunction with fileless malware and script-based attacks to maintain persistence while avoiding detection. ' references: - https://persistence-info.github.io/Data/amsi.html - https://github.com/gtworek/PSBits/blob/8d767892f3b17eefa4d0668f5d2df78e844f01d8/FakeAMSI/FakeAMSI.c author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-21 modified: 2025-10-26 tags: - attack.persistence logsource: category: registry_set product: windows detection: selection: TargetObject|contains: - \SOFTWARE\Microsoft\AMSI\Providers\ - \SOFTWARE\WOW6432Node\Microsoft\AMSI\Providers\ filter_optional_avast: Image: - C:\Program Files\Avast Software\Avast\RegSvr.exe - C:\Program Files\Avast Software\Avast\x86\RegSvr.exe TargetObject|contains: \{FB904E4E-D2C7-4C8D-8492-B620BB9896B1} filter_optional_avg: Image: - C:\Program Files\AVG\Antivirus\RegSvr.exe - C:\Program Files\AVG\Antivirus\x86\RegSvr.exe TargetObject|contains: \{FB904E4E-D2C7-4C8D-8492-B620BB9896B1} filter_optional_avira: Image: C:\Program Files\Avira\Endpoint Protection SDK\endpointprotection.exe TargetObject|contains: \{00000001-3DCC-4B48-A82E-E2071FE58E05} condition: selection and not 1 of filter_optional_* falsepositives: - Legitimate security products adding their own AMSI providers. Filter these according to your environment. level: medium regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_persistence_amsi_providers/info.yml
Query: detect Identifies IPs performing DNS lookups associated with common Tor proxies. in logs
Matching passage: Sigma rule: Identifies IPs performing DNS lookups associated with common Tor proxies.. Logsource: zeek / dns. Rule: title: DNS TOR Proxies id: a8322756-015c-42e7-afb1-436e85ed3ff5 related: - id: b55ca2a3-7cff-4dda-8bdd-c7bfa63bf544 type: similar - id: 8384bd26-bde6-4da9-8e5d-4174a7a47ca2 type: similar status: test description: Identifies IPs performing DNS lookups associated with common Tor proxies. references: - https://github.com/Azure/Azure-Sentinel/blob/f99542b94afe0ad2f19a82cc08262e7ac8e1428e/Detections/ASimDNS/imDNS_TorProxies.yaml author: Saw Winn Naung , Azure-Sentinel date: 2021-08-15 modified: 2025-09-12 tags: - attack.exfiltration - attack.t1048 logsource: service: dns product: zeek detection: selection: query|endswith: - .hiddenservice.net - .onion.ca - .onion.cab - .onion.casa - .onion.city - .onion.direct - .onion.dog - .onion.glass - .onion.gq - .onion.guide - .onion.in.net - .onion.ink - .onion.it - .onion.link - .onion.lt - .onion.lu - .onion.ly - .onion.mn - .onion.network - .onion.nu - .onion.pet - .onion.plus - .onion.pt - .onion.pw - .onion.rip - .onion.sh - .onion.si - .onion.to - .onion.top - .onion.ws - .onion - .s1.tor-gateways.de - .s2.tor-gateways.de - .s3.tor-gateways.de - .s4.tor-gateways.de - .s5.tor-gateways.de - .t2w.pw - .tor2web.ae.org - .tor2web.blutmagie.de - .tor2web.com - .tor2web.fi - .tor2web.io - .tor2web.org - .tor2web.xyz - .torlink.co condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the ld.so preload persistence file. See `man ld.so` for more information.. Logsource: linux. Rule: title: Code Injection by ld.so Preload id: 7e3c4651-c347-40c4-b1d4-d48590fdf684 status: test description: Detects the ld.so preload persistence file. See `man ld.so` for more information. references: - https://man7.org/linux/man-pages/man8/ld.so.8.html author: Christian Burkard (Nextron Systems) date: 2021-05-05 modified: 2022-10-09 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.006 logsource: product: linux detection: keywords: - /etc/ld.so.preload condition: keywords falsepositives: - Rare temporary workaround for library misconfiguration level: high
Query: actor TTPs: Windows Host Firewall
Matching passage: T1686.003 Windows Host Firewall. Tactics: defense impairment. Description: Adversaries may disable or modify the Windows host firewall to bypass controls limiting network usage. This can include disabling the Windows host firewall entirely, suppressing specific profiles (domain, private, public), or adding, deleting, and modifying firewall rules to allow or restrict traffic.(Citation: Nearest Neighbor Volexity) Adversaries may perform these modifications through multiple mechanisms depending on the Windows operating system and access level. For example, adversaries may use command-line utilities (e.g., `netsh advfirewall` or PowerShell cmdlets like `Set-NetFirewallProfile`, `New-NetFirewallRule`), Windows Registry modifications (e.g., altering firewall states and rule configurations via registry keys), or the Windows Control Panel to modify firewall settings through the Windows Security interface. By disabling or modifying Windows firewall services, adversaries may enable access to remote services, open ports for command and control traffic, or configure rules for further actions.
Near-miss passage: T1686 Disable or Modify System Firewall. Tactics: defense impairment. Description: Adversaries may disable or modify host-based or network firewalls to impair defensive mechanisms and enable further action. Once an adversary has gathered sufficient privileges, they can tamper with firewall services, policies, or rule sets to remove restrictions on inbound or outbound traffic. For example, this may include turning off firewall profiles, altering existing rules to permit previously blocked ports or protocols, or adding new rules that create covert communication paths (e.g., adding a new firewall rule for a well-known protocol (such as RDP) using a non-traditional and potentially less securitized port.(Citation: change_rdp_port_conti) Adversaries may disable or modify firewalls using different behaviors, depending on the platform. For example, in ESXi, firewall rules may be modified directly via the esxcli (e.g., via esxcli network firewall set) or via the vCenter user interface.(Citation: Broadcom ESXi Firewall)(Citation: Trellix Rnasomhouse 2024)
Query: patch priority for CVE-2015-3692
Matching passage: CVE-2015-3692. CWE: CWE-284. CVSS: 6.800000190734863. Apple Mac EFI before 2015-001, as used in OS X before 10.10.4 and other products, does not enforce a locking protection mechanism upon being woken from sleep, which allows local users to conduct EFI flash attacks by leveraging root privileges.
Near-miss passage: CVE-2015-3062. CWE: CWE-284. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified vectors, a different vulnerability than CVE-2015-3060, CVE-2015-3061, CVE-2015-3063, CVE-2015-3064, CVE-2015-3065, CVE-2015-3066, CVE-2015-3067, CVE-2015-3068, CVE-2015-3069, CVE-2015-3071, CVE-2015-3072, CVE-2015-3073, and CVE-2015-3074.
Query: secure coding against Processor Optimization Removal or Modification of Security-critical Code
Matching passage: CWE-1037 Processor Optimization Removal or Modification of Security-critical Code. The developer builds a security-critical protection mechanism into the software, but the processor optimizes the execution of the program such that the mechanism is removed or modified.
Near-miss passage: CWE-127 Buffer Under-read. The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations prior to the targeted buffer.
Query: exploit The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to obtain sensitive order det
Matching passage: CVE-2015-3302. CWE: CWE-284. CVSS: 7.5. The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to obtain sensitive order detail information by leveraging a "broken authentication mechanism."
Near-miss passage: CVE-2015-3672. CWE: CWE-284. CVSS: 7.199999809265137. Admin Framework in Apple OS X before 10.10.4 does not properly handle authentication errors, which allows local users to obtain admin privileges via unspecified vectors.
Query: CVE similar to CVE-2015-6019
Matching passage: CVE-2015-6019. CWE: UNKNOWN. CVSS: 8.5. The management portal on ZyXEL PMG5318-B20A devices with firmware 1.00AANC0b5 does not terminate sessions upon a logout action, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation.
Near-miss passage: CVE-2015-2548. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in the Tablet Input Band in Windows Shell in Microsoft Windows Vista SP2 and Windows 7 SP1 allows remote attackers to execute arbitrary code via a crafted web site, aka "Microsoft Tablet Input Band Use After Free Vulnerability."
Query: risk of Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and A
Matching passage: CVE-2015-5113. CWE: CWE-416. CVSS: 6.800000190734863. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-4448, CVE-2015-5095, CVE-2015-5099, CVE-2015-5101, CVE-2015-5111, and CVE-2015-5114.
Near-miss passage: CVE-2015-0568. CWE: CWE-416. CVSS: 7.800000190734863. Use-after-free vulnerability in the msm_set_crop function in drivers/media/video/msm/msm_camera.c in the MSM-Camera driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges or cause a denial of service (memory corruption) via an application that makes a crafted ioctl call.
Query: CVE similar to CVE-2015-0307
Matching passage: CVE-2015-0307. CWE: CWE-119. CVSS: 8.5. Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allow remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via unspecified vectors.
Near-miss passage: CVE-2015-6136. CWE: CWE-119. CVSS: 9.300000190734863. The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, allow remote attackers to execute arbitrary code via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability."
Query: common weakness: Use of Function with Inconsistent Implementations
Matching passage: CWE-474 Use of Function with Inconsistent Implementations. The code uses a function that has inconsistent implementations across operating systems and versions.
Near-miss passage: CWE-477 Use of Obsolete Function. The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
Query: indicators of Identify Roles
Matching passage: T1591.004 Identify Roles. Tactics: reconnaissance. Description: Adversaries may gather information about identities and roles within the victim organization that can be used during targeting. Information about business roles may reveal a variety of targetable details, including identifiable information for key personnel as well as what data/resources they have access to. Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about business roles may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: ThreatPost Broadvoice Leak) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566)).
Near-miss passage: T1591.001 Determine Physical Locations. Tactics: reconnaissance. Description: Adversaries may gather the victim's physical location(s) that can be used during targeting. Information about physical locations of a target organization may include a variety of details, including where key resources and infrastructure are housed. Physical locations may also indicate what legal jurisdiction and/or authorities the victim operates within. Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Physical locations of a target organization may also be exposed to adversaries via online or other accessible data sets (ex: [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594) or [Social Media](https://attack.mitre.org/techniques/T1593/001)).(Citation: ThreatPost Broadvoice Leak)(Citation: SEC EDGAR Search) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Hardware Additions](https://attack.mitre.org/techniques/T1200)).
Query: exploit Multiple integer overflows in libstagefright in Mozilla Firefox before 38.0 allow remote attackers to execute arbitrary code via crafted sample metadata in an MPEG-4 video file, a 
Matching passage: CVE-2015-4496. CWE: CWE-189. CVSS: 9.300000190734863. Multiple integer overflows in libstagefright in Mozilla Firefox before 38.0 allow remote attackers to execute arbitrary code via crafted sample metadata in an MPEG-4 video file, a related issue to CVE-2015-1538.
Near-miss passage: CVE-2015-7674. CWE: CWE-189. CVSS: 6.800000190734863. Integer overflow in the pixops_scale_nearest function in pixops/pixops.c in gdk-pixbuf before 2.32.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted GIF image file, which triggers a heap-based buffer overflow.
Query: Suspicious Regsvcs/Regasm execution detected on endpoint
Matching passage: T1218.009 Regsvcs/Regasm. Tactics: stealth. Description: Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) assemblies. Both are binaries that may be digitally signed by Microsoft. (Citation: MSDN Regsvcs) (Citation: MSDN Regasm) Both utilities may be used to bypass application control through use of attributes within the binary to specify code that should be run before registration or unregistration: <code>[ComRegisterFunction]</code> or <code>[ComUnregisterFunction]</code> respectively. The code with the registration and unregistration attributes will be executed even if the process is run under insufficient privileges and fails to execute. (Citation: LOLBAS Regsvcs)(Citation: LOLBAS Regasm)
Near-miss passage: T1218 System Binary Proxy Execution. Tactics: stealth. Description: Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system.(Citation: LOLBAS Project) Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands. Similarly, on Linux systems adversaries may abuse trusted binaries such as <code>split</code> to proxy execution of malicious commands.(Citation: split man page)(Citation: GTFO split)