alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: actor TTPs: Vulnerability Scanning
Matching passage: T1595.002 Vulnerability Scanning. Tactics: reconnaissance. Description: Adversaries may scan victims for vulnerabilities that can be used during targeting. Vulnerability scans typically check if the configuration of a target host/application (ex: software and version) potentially aligns with the target of a specific exploit the adversary may seek to use. These scans may also include more broad attempts to [Gather Victim Host Information](https://attack.mitre.org/techniques/T1592) that can be used to identify more commonly known, exploitable vulnerabilities. Vulnerability scans typically harvest running software and version numbers via server banners, listening ports, or other network artifacts.(Citation: OWASP Vuln Scanning) Information from these scans may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)).
Near-miss passage: T1595.001 Scanning IP Blocks. Tactics: reconnaissance. Description: Adversaries may scan victim IP blocks to gather information that can be used during targeting. Public IP addresses may be allocated to organizations by block, or a range of sequential addresses. Adversaries may scan IP blocks in order to [Gather Victim Network Information](https://attack.mitre.org/techniques/T1590), such as which IP addresses are actively in use as well as more detailed information about hosts assigned these addresses. Scans may range from simple pings (ICMP requests and responses) to more nuanced scans that may reveal host software/versions via server banners or other network artifacts.(Citation: Botnet Scan) Information from these scans may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133)).
Query: risk of CFNetwork HTTPProtocol in Apple iOS before 9.2 and OS X before 10.11.2 allows man-in-the-middle attackers to bypass the HSTS protection mechanism via a crafted URL.
Matching passage: CVE-2015-7094. CWE: CWE-20. CVSS: 2.5999999046325684. CFNetwork HTTPProtocol in Apple iOS before 9.2 and OS X before 10.11.2 allows man-in-the-middle attackers to bypass the HSTS protection mechanism via a crafted URL.
Near-miss passage: CVE-2015-9207. CWE: CWE-20. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 617, SD 650/52, SD 800, SD 808, and SD 810, lack of input validation in playready_getadditional_responsedata could lead to a buffer overread.
Query: describe CVE-2015-5383
Matching passage: CVE-2015-5383. CWE: CWE-200. CVSS: 7.5. Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory.
Near-miss passage: CVE-2015-7050. CWE: CWE-200. CVSS: 4.300000190734863. WebKit in Apple iOS before 9.2 and Safari before 9.0.2 misparses content extensions, which allows remote attackers to obtain sensitive browsing-history information via a crafted web site.
Query: CVE similar to CVE-2015-4194
Matching passage: CVE-2015-4194. CWE: CWE-200. CVSS: 5.0. The web-based administrative interface in Cisco WebEx Meeting Center provides different error messages for failed login attempts depending on whether the username exists or corresponds to a privileged account, which allows remote attackers to enumerate account names and obtain sensitive information via a series of requests, aka Bug ID CSCuf28861.
Near-miss passage: CVE-2015-5268. CWE: CWE-200. CVSS: 4.300000190734863. The rating component in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 mishandles group-based authorization checks, which allows remote authenticated users to obtain sensitive information by reading a rating value.
Query: exploit Huawei E587 Mobile WiFi with firmware before 11.203.30.00.00 allows remote attackers to bypass authentication, change configurations, send messages, and cause a denial of service (
Matching passage: CVE-2015-3911. CWE: CWE-284. CVSS: 9.0. Huawei E587 Mobile WiFi with firmware before 11.203.30.00.00 allows remote attackers to bypass authentication, change configurations, send messages, and cause a denial of service (device restart) via unspecified vectors.
Near-miss passage: CVE-2015-6848. CWE: CWE-284. CVSS: 8.5. EMC Isilon OneFS 7.1.x before 7.1.1.5, 7.2.0.x before 7.2.0.3, and 7.2.1.x before 7.2.1.1, when the RFC 2307 feature is configured but SFU is not universally present, allows remote authenticated AD users to obtain root privileges via unspecified vectors.
Query: describe CVE-2015-0996
Matching passage: CVE-2015-0996. CWE: CWE-200. CVSS: 2.0999999046325684. Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 rely on a hardcoded cleartext password to control read access to Project files and Project Configuration files, which makes it easier for local users to obtain sensitive information by discovering this password.
Near-miss passage: CVE-2015-7763. CWE: CWE-200. CVSS: 5.0. rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not properly initialize padding at the end of an Rx acknowledgement (ACK) packet, which allows remote attackers to obtain sensitive information by (1) conducting a replay attack or (2) sniffing the network.
Query: exploit Cross-site scripting (XSS) vulnerability in help/rt/large_search.html in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to inject arbitrary web script or HTML vi
Matching passage: CVE-2015-2840. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in help/rt/large_search.html in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to inject arbitrary web script or HTML via the searchQuery parameter.
Near-miss passage: CVE-2015-3275. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in the SCORM module in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allow remote attackers to inject arbitrary web script or HTML via a crafted organization name to (1) mod/scorm/player.php or (2) mod/scorm/prereqs.php.
Query: vulnerability: In all Qualcomm products with Android releases from CAF using the Linux kernel, an untrusted pointer dereference can occur in a TrustZone syscall.
Matching passage: CVE-2015-9072. CWE: CWE-476. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, an untrusted pointer dereference can occur in a TrustZone syscall.
Near-miss passage: CVE-2015-8922. CWE: CWE-476. CVSS: 5.5. The read_CodersInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted 7z file, related to the _7z_folder struct.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects Obfuscated use of stdin to execute PowerShell. Logsource: windows / process_creation. Rule: title: Invoke-Obfuscation STDIN+ Launcher id: 6c96fc76-0eb1-11eb-adc1-0242ac120002 status: test description: Detects Obfuscated use of stdin to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-15 modified: 2024-04-15 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: CommandLine|re: cmd.{0,5}(?:/c|/r).+powershell.+(?:\$\{?input\}?|noexit).+\" condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the use of powershell commands from headless ConHost window. The "--headless" flag hides the windows from the us. Logsource: windows / process_creation. Rule: title: Powershell Executed From Headless ConHost Process id: 056c7317-9a09-4bd4-9067-d051312752ea related: - id: 00ca75ab-d5ce-43be-b86c-55ff39c6abfc type: derived status: test description: 'Detects the use of powershell commands from headless ConHost window. The "--headless" flag hides the windows from the user upon execution. ' references: - https://www.huntress.com/blog/fake-browser-updates-lead-to-boinc-volunteer-computing-software author: Matt Anderson (Huntress) date: 2024-07-23 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1059.003 - attack.t1564.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \conhost.exe - OriginalFileName: CONHOST.EXE selection_cli: CommandLine|contains|all: - --headless - powershell condition: all of selection_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_conhost_headless_powershell/info.yml
Query: vulnerability: Cross-site scripting (XSS) vulnerability in the console in Puppet Enterprise before 2015.2.1 allows remote attackers to inject arbitrary web script or HTML via the string parameter
Matching passage: CVE-2015-6502. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the console in Puppet Enterprise before 2015.2.1 allows remote attackers to inject arbitrary web script or HTML via the string parameter, related to Login Redirect.
Near-miss passage: CVE-2015-2217. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Ultimate PHP Board (aka myUPB) before 2.2.8 allow remote attackers to inject arbitrary web script or HTML via the (1) q parameter to search.php or (2) avatar parameter to profile.php.
Query: patch priority for CVE-2015-0754
Matching passage: CVE-2015-0754. CWE: CWE-20. CVSS: 7.5. Cisco Finesse 10.5(1) allows remote authenticated users to obtain sensitive information or cause a denial of service (CPU and memory consumption) via a crafted XML document, aka Bug ID CSCut95810.
Near-miss passage: CVE-2015-0701. CWE: CWE-20. CVSS: 10.0. Cisco UCS Central Software before 1.3(1a) allows remote attackers to execute arbitrary commands via a crafted HTTP request, aka Bug ID CSCut46961.
Query: detect Detects when an security threat is detected in Okta. in logs
Matching passage: Sigma rule: Detects when an security threat is detected in Okta.. Logsource: okta / okta. Rule: title: Okta Security Threat Detected id: 5c82f0b9-3c6d-477f-a318-0e14a1df73e0 status: test description: Detects when an security threat is detected in Okta. references: - https://okta.github.io/okta-help/en/prod/Content/Topics/Security/threat-insight/configure-threatinsight-system-log.htm - https://developer.okta.com/docs/reference/api/system-log/ - https://developer.okta.com/docs/reference/api/event-types/ author: Austin Songer @austinsonger date: 2021-09-12 modified: 2026-04-27 tags: - attack.command-and-control logsource: product: okta service: okta detection: selection: eventType: security.threat.detected condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects suspicious Windows Error Reporting manager (wermgr.exe) execution location.. Logsource: windows / process_creation. Rule: title: Suspicious Execution Location Of Wermgr.EXE id: 5394fcc7-aeb2-43b5-9a09-cac9fc5edcd5 related: - id: 396f6630-f3ac-44e3-bfc8-1b161bc00c4e type: similar status: test description: Detects suspicious Windows Error Reporting manager (wermgr.exe) execution location. references: - https://www.trendmicro.com/en_us/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html - https://www.echotrail.io/insights/search/wermgr.exe - https://github.com/binderlabs/DirCreate2System author: Florian Roth (Nextron Systems) date: 2022-10-14 modified: 2023-08-23 tags: - attack.execution logsource: category: process_creation product: windows detection: selection: Image|endswith: \wermgr.exe filter_main_legit_location: Image|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: Persistence mechanism resembling Social Media
Matching passage: T1593.001 Social Media. Tactics: reconnaissance. Description: Adversaries may search social media for information about victims that can be used during targeting. Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff. Adversaries may search in different social media sites depending on what information they seek to gather. Threat actors may passively harvest data from these sites, as well as use information gathered to create fake profiles/groups to elicit victim’s into revealing specific information (i.e. [Spearphishing Service](https://attack.mitre.org/techniques/T1598/001)).(Citation: Cyware Social Media) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003)).
Near-miss passage: T1593.002 Search Engines. Tactics: reconnaissance. Description: Adversaries may use search engines to collect information about victims that can be used during targeting. Search engine services typical crawl online sites to index context and may provide users with specialized syntax to search for specific keywords or specific types of content (i.e. filetypes).(Citation: SecurityTrails Google Hacking)(Citation: ExploitDB GoogleHacking) Adversaries may craft various search engine queries depending on what information they seek to gather. Threat actors may use search engines to harvest general information about victims, as well as use specialized queries to look for spillages/leaks of sensitive information such as network details or credentials. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Valid Accounts](https://attack.mitre.org/techniques/T1078) or [Phishing](https://attack.mitre.org/techniques/T1566)).
Query: vulnerability: The avenirsoft-directdownload plugin 1.0 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=avenir_plugin.
Matching passage: CVE-2015-9442. CWE: CWE-352. CVSS: 6.5. The avenirsoft-directdownload plugin 1.0 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=avenir_plugin.
Near-miss passage: CVE-2015-5182. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in the jolokia API in A-MQ.
Query: describe CVE-2015-1134
Matching passage: CVE-2015-1134. CWE: CWE-20. CVSS: 7.199999809265137. fontd in Apple Type Services (ATS) in Apple OS X before 10.10.3 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-1131, CVE-2015-1132, CVE-2015-1133, and CVE-2015-1135.
Near-miss passage: CVE-2015-6104. CWE: CWE-20. CVSS: 9.300000190734863. The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted embedded font, aka "Windows Graphics Memory Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-6103.
Query: exploit Buffer overflow in libc in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary code via a crafted packag
Matching passage: CVE-2015-7039. CWE: CWE-119. CVSS: 6.800000190734863. Buffer overflow in libc in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary code via a crafted package, a different vulnerability than CVE-2015-7038.
Near-miss passage: CVE-2015-2380. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, and Word 2013 RT SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Query: CVE similar to CVE-2015-1000000
Matching passage: CVE-2015-1000000. CWE: CWE-434. CVSS: 9.800000190734863. Remote file upload vulnerability in mailcwp v1.99 wordpress plugin
Near-miss passage: CVE-2015-1784. CWE: CWE-434. CVSS: 8.800000190734863. In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the web application. The vulnerabilities lie in how the application validates user uploaded files and lack of security measures preventing unwanted HTTP requests.
Query: Sigma rule for Detects a network connection initiated by the Add-In deployment cache updating utility "AddInutil.exe". This could indic
Matching passage: Sigma rule: Detects a network connection initiated by the Add-In deployment cache updating utility "AddInutil.exe". This could indic. Logsource: windows / network_connection. Rule: title: Network Connection Initiated By AddinUtil.EXE id: 5205613d-2a63-4412-a895-3a2458b587b3 status: test description: 'Detects a network connection initiated by the Add-In deployment cache updating utility "AddInutil.exe". This could indicate a potential command and control communication as this tool doesn''t usually initiate network activity. ' references: - https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html author: Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri) date: 2023-09-18 modified: 2024-07-16 tags: - attack.stealth - attack.t1218 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' Image|endswith: \addinutil.exe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects unusual parent or children of the wab.exe (Windows Contacts) and Wabmig.exe (Microsoft Address Book Import Tool). Logsource: windows / process_creation. Rule: title: Wab/Wabmig Unusual Parent Or Child Processes id: 63d1ccc0-2a43-4f4b-9289-361b308991ff status: test description: Detects unusual parent or children of the wab.exe (Windows Contacts) and Wabmig.exe (Microsoft Address Book Import Tool) processes as seen being used with bumblebee activity references: - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime - https://thedfirreport.com/2022/09/26/bumblebee-round-two/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-12 modified: 2022-09-27 tags: - attack.execution - attack.stealth logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \WmiPrvSE.exe - \svchost.exe - \dllhost.exe Image|endswith: - \wab.exe - \wabmig.exe selection_child: ParentImage|endswith: - \wab.exe - \wabmig.exe condition: 1 of selection_* falsepositives: - Unknown level: high
Query: Sigma rule for Detects network connections via finger.exe, which can be abused by threat actors to retrieve remote commands for executi
Matching passage: Sigma rule: Detects network connections via finger.exe, which can be abused by threat actors to retrieve remote commands for executi. Logsource: windows / network_connection. Rule: title: Network Connection Initiated via Finger.EXE id: 2fdaf50b-9fd5-449f-ba69-f17248119af6 related: - id: c082c2b0-525b-4dbc-9a26-a57dc4692074 type: similar - id: af491bca-e752-4b44-9c86-df5680533dbc type: similar status: experimental description: 'Detects network connections via finger.exe, which can be abused by threat actors to retrieve remote commands for execution on Windows devices. In one ClickFix malware campaign, adversaries leveraged the finger protocol to fetch commands from a remote server. Since the finger utility is not commonly used in modern Windows environments, its presence already raises suspicion. Investigating such network connections can also help identify potential malicious infrastructure used by threat actors ' references: - https://www.bleepingcomputer.com/news/security/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-19 tags: - attack.command-and-control - attack.t1071.004 - attack.execution - attack.t1059.003 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' Image|endswith: \finger.exe condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the removal of folders from the "ProtectedFolders" list of of exploit guard. This could indicate an attacker try. Logsource: windows / registry_delete. Rule: title: Folder Removed From Exploit Guard ProtectedFolders List - Registry id: 272e55a4-9e6b-4211-acb6-78f51f0b1b40 status: test description: Detects the removal of folders from the "ProtectedFolders" list of of exploit guard. This could indicate an attacker trying to launch an encryption process or trying to manipulate data inside of the protected folder references: - https://www.microsoft.com/security/blog/2017/10/23/windows-defender-exploit-guard-reduce-the-attack-surface-against-next-generation-malware/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-05 modified: 2023-02-08 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_delete product: windows detection: selection: EventType: DeleteValue TargetObject|contains: SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\ProtectedFolders condition: selection falsepositives: - Legitimate administrators removing applications (should always be investigated) level: high
Query: explain CWE-306
Matching passage: CWE-306 Missing Authentication for Critical Function. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Near-miss passage: CWE-7 J2EE Misconfiguration: Missing Custom Error Page. The default error page of a web application should not display sensitive information about the product.