alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: CVE similar to CVE-2015-1068
Matching passage: CVE-2015-1068. CWE: CWE-399. CVSS: 6.800000190734863. WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Near-miss passage: CVE-2015-0885. CWE: CWE-399. CVSS: 5.0. checkpw 1.02 and earlier allows remote attackers to cause a denial of service (infinite loop) via a -- (dash dash) in a username.
Query: patch priority for CVE-2015-8983
Matching passage: CVE-2015-8983. CWE: CWE-190. CVSS: 8.100000381469727. Integer overflow in the _IO_wstr_overflow function in libio/wstrops.c in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors related to computing a size in bytes, which triggers a heap-based buffer overflow.
Near-miss passage: CVE-2015-2519. CWE: CWE-190. CVSS: 9.300000190734863. Integer overflow in Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to execute arbitrary code via a crafted .jnt file, aka "Windows Journal Integer Overflow RCE Vulnerability."
Query: risk of In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD
Matching passage: CVE-2015-9167. CWE: CWE-191. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, and SD 820A, in an EMM command, an integer underflow can occur.
Near-miss passage: CVE-2015-9198. CWE: CWE-191. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, and SDX20, integer underflow vulnerability in function qsee_register_log_buff may lead to arbitrary writing of secure memory.
Query: intelligence brief on T1569.002
Matching passage: T1569.002 Service Execution. Tactics: execution. Description: Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (<code>services.exe</code>) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as <code>sc.exe</code> and [Net](https://attack.mitre.org/software/S0039). [PsExec](https://attack.mitre.org/software/S0029) can also be used to execute commands or payloads via a temporary Windows service created through the service control manager API.(Citation: Russinovich Sysinternals) Tools such as [PsExec](https://attack.mitre.org/software/S0029) and <code>sc.exe</code> can accept remote servers as arguments and may be used to conduct remote execution. Adversaries may leverage these mechanisms to execute malicious content. This can be done by either executing a new or modified service. This technique is the execution used in conjunction with [Windows Service](https://attack.mitre.org/techniques/T1543/003) during service persistence or privilege escalation.
Near-miss passage: T1569.003 Systemctl. Tactics: execution. Description: Adversaries may abuse systemctl to execute commands or programs. Systemctl is the primary interface for systemd, the Linux init system and service manager. Typically invoked from a shell, Systemctl can also be integrated into scripts or applications. Adversaries may use systemctl to execute commands or programs as [Systemd Service](https://attack.mitre.org/techniques/T1543/002)s. Common subcommands include: `systemctl start`, `systemctl stop`, `systemctl enable`, `systemctl disable`, and `systemctl status`.(Citation: Red Hat Systemctl 2022)
Query: common weakness: Runtime Resource Management Control Element in a Component Built to Run on Application Servers
Matching passage: CWE-1065 Runtime Resource Management Control Element in a Component Built to Run on Application Servers. The product uses deployed components from application servers, but it also uses low-level functions/methods for management of resources, instead of the API provided by the application server.
Near-miss passage: CWE-344 Use of Invariant Value in Dynamically Changing Context. The product uses a constant value, name, or reference, but this value can (or should) vary across different environments.
Query: patch priority for CVE-2015-6184
Matching passage: CVE-2015-6184. CWE: UNKNOWN. CVSS: 8.100000381469727. The CAttrArray object implementation in Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and memory corruption) via a malformed Cascading Style Sheets (CSS) token sequence in conjunction with modifications to HTML elements, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6048 and CVE-2015-6049.
Near-miss passage: CVE-2015-8616. CWE: UNKNOWN. CVSS: 8.600000381469727. Use-after-free vulnerability in the Collator::sortWithSortKeys function in ext/intl/collator/collator_sort.c in PHP 7.x before 7.0.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging the relationships between a key buffer and a destroyed array.
Query: SIEM correlation: command and control activity consistent with Communication Through Removable Media
Matching passage: T1092 Communication Through Removable Media. Tactics: command and control. Description: Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system.(Citation: ESET Sednit USBStealer 2014) Both systems would need to be compromised, with the likelihood that an Internet-connected system was compromised first and the second through lateral movement by [Replication Through Removable Media](https://attack.mitre.org/techniques/T1091). Commands and files would be relayed from the disconnected system to the Internet-connected system to which the adversary has direct access.
Near-miss passage: T1219 Remote Access Tools. Tactics: command and control. Description: An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy) Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access. Remote access tools may be installed and used post-compromise as an alternate communications channel for redundant access or to establish an interactive remote desktop session with the target system. It may also be used as a malware component to establish a reverse connection or back-connect to a service or adversary-controlled system. Installation of many remote access tools may also include persistence (e.g., the software's installation routine creates a [Windows Service](https://attack.mitre.org/techniques/T1543/003)). Remote access modules/features may also exist as part of otherwise existing software (e.g., Google Chrome’s Remote Desktop).(Citation: Google Chrome Remote Desktop)(Citation: Chrome Remote Desktop)
Query: alert when Detects usage of a base64 encoded "IEX" cmdlet in a process command line
Matching passage: Sigma rule: Detects usage of a base64 encoded "IEX" cmdlet in a process command line. Logsource: windows / process_creation. Rule: title: PowerShell Base64 Encoded IEX Cmdlet id: 88f680b8-070e-402c-ae11-d2914f2257f1 status: test description: Detects usage of a base64 encoded "IEX" cmdlet in a process command line references: - Internal Research author: Florian Roth (Nextron Systems) date: 2019-08-23 modified: 2023-04-06 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: - CommandLine|base64offset|contains: - IEX ([ - iex ([ - iex (New - IEX (New - IEX([ - iex([ - iex(New - IEX(New - IEX((' - iex((' - CommandLine|contains: - SQBFAFgAIAAoAFsA - kARQBYACAAKABbA - JAEUAWAAgACgAWw - aQBlAHgAIAAoAFsA - kAZQB4ACAAKABbA - pAGUAeAAgACgAWw - aQBlAHgAIAAoAE4AZQB3A - kAZQB4ACAAKABOAGUAdw - pAGUAeAAgACgATgBlAHcA - SQBFAFgAIAAoAE4AZQB3A - kARQBYACAAKABOAGUAdw - JAEUAWAAgACgATgBlAHcA condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects SMB server connections to shares without signing or encryption enabled. This could indicate potential lateral mo. Logsource: windows / smbserver-connectivity. Rule: title: Unsigned or Unencrypted SMB Connection to Share Established id: 8d91f6e4-9f3b-4c21-ae41-2c5b7d9f7a12 status: experimental description: 'Detects SMB server connections to shares without signing or encryption enabled. This could indicate potential lateral movement activity using unsecured SMB shares. ' author: Mohamed Abdelghani date: 2025-10-19 references: - https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/overview-server-message-block-signing tags: - attack.lateral-movement - attack.t1021.002 logsource: product: windows service: smbserver-connectivity detection: selection_shares: EventID: 4000 ShareName|contains: - IPC$ - ADMIN$ - C$ selection_status: - SigningUsed: 'false' - EncyptionUsed: 'false' filter_main_local_ips: - ClientAddress|cidr: - 127.0.0.0/8 - 169.254.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 - ClientAddress|contains: - '00000000000000000000000000000001' - FE80000000000000 - FC00000000000000 - 0200????7F - 0200????A9FE condition: all of selection_* and not 1 of filter_main_* falsepositives: - Connections from local or private IP addresses to SMB shares without signing or encryption enabled for older systems or misconfigured environments. Apply additional tuning as needed. level: medium
Query: vulnerability: Cross-site scripting (XSS) vulnerability in IBM Content Template Catalog 4.x before 4.1.4 for WebSphere Portal 8.0.x and 4.x before 4.3.1 for WebSphere Portal 8.5.x allows remote a
Matching passage: CVE-2015-0195. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in IBM Content Template Catalog 4.x before 4.1.4 for WebSphere Portal 8.0.x and 4.x before 4.3.1 for WebSphere Portal 8.5.x allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-6509. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in pfSense before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) proxypass parameter to system_advanced_misc.php; (2) adaptiveend, (3) adaptivestart, (4) maximumstates, (5) maximumtableentries, or (6) aliasesresolveinterval parameter to system_advanced_firewall.php; (7) proxyurl, (8) proxyuser, or (9) proxyport parameter to system_advanced_misc.php; or (10) name, (11) notification_name, (12) ipaddress, (13) password, (14) smtpipaddress, (15) smtpport, (16) smtpfromaddress, (17) smtpnotifyemailaddress, (18) smtpusername, or (19) smtppassword parameter to system_advanced_notifications.php.
Query: ATT&CK technique for Unix Shell
Matching passage: T1059.004 Unix Shell. Tactics: execution. Description: Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution.(Citation: DieNet Bash)(Citation: Apple ZShell) Unix shells can control every aspect of a system, with certain commands requiring elevated privileges. Unix shells also support scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops. Common uses of shell scripts include long or repetitive tasks, or the need to run the same set of commands on multiple systems. Adversaries may abuse Unix shells to execute various commands or payloads. Interactive shells may be accessed through command and control channels or during lateral movement such as with [SSH](https://attack.mitre.org/techniques/T1021/004). Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence. Some systems, such as embedded devices, lightweight Linux distributions, and ESXi servers, may leverage stripped-down Unix shells via Busybox, a small executable that contains a variety of tools, including a simple shell.
Near-miss passage: T1059.009 Cloud API. Tactics: execution. Description: Adversaries may abuse cloud APIs to execute malicious commands. APIs available in cloud environments provide various functionalities and are a feature-rich method for programmatic access to nearly all aspects of a tenant. These APIs may be utilized through various methods such as command line interpreters (CLIs), in-browser Cloud Shells, [PowerShell](https://attack.mitre.org/techniques/T1059/001) modules like Azure for PowerShell(Citation: Microsoft - Azure PowerShell), or software developer kits (SDKs) available for languages such as [Python](https://attack.mitre.org/techniques/T1059/006). Cloud API functionality may allow for administrative access across all major services in a tenant such as compute, storage, identity and access management (IAM), networking, and security policies. With proper permissions (often via use of credentials such as [Application Access Token](https://attack.mitre.org/techniques/T1550/001) and [Web Session Cookie](https://attack.mitre.org/techniques/T1550/004)), adversaries may abuse cloud APIs to invoke various functions that execute malicious actions. For example, CLI and PowerShell functionality may be accessed through binaries installed on cloud-hosted or on-premises hosts or accessed through a browser-based cloud shell offered by many cloud platforms (such as AWS, Azure, and GCP). These cloud shells are often a packaged unified environment to use CLI and/or scripting modules hosted as a container in the cloud environment.
Query: SOC alert related to Access Token Manipulation
Matching passage: T1134 Access Token Manipulation. Tactics: stealth, privilege escalation. Description: Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token. An adversary can use built-in Windows API functions to copy access tokens from existing processes; this is known as token stealing. These token can then be applied to an existing process (i.e. [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001)) or used to spawn a new process (i.e. [Create Process with Token](https://attack.mitre.org/techniques/T1134/002)). An adversary must already be in a privileged user context (i.e. administrator) to steal a token. However, adversaries commonly use token stealing to elevate their security context from the administrator level to the SYSTEM level. An adversary can then use a token to authenticate to a remote system as the account for that token if the account has appropriate permissions on the remote system.(Citation: Pentestlab Token Manipulation) Any standard user can use the <code>runas</code> command, and the Windows API functions, to create impersonation tokens; it does not require access to an administrator account. There are also other mechanisms, such as Active Directory fields, that can be used to modify access tokens.
Near-miss passage: T1134.002 Create Process with Token. Tactics: stealth, privilege escalation. Description: Adversaries may create a new process with an existing token to escalate privileges and bypass access controls. Processes can be created with the token and resulting security context of another user using features such as <code>CreateProcessWithTokenW</code> and <code>runas</code>.(Citation: Microsoft RunAs) Creating processes with a token not associated with the current user may require the credentials of the target user, specific privileges to impersonate that user, or access to the token to be used. For example, the token could be duplicated via [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) or created via [Make and Impersonate Token](https://attack.mitre.org/techniques/T1134/003) before being used to create a process. While this technique is distinct from [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001), the techniques can be used in conjunction where a token is duplicated and then used to create a new process.
Query: patch priority for CVE-2015-1896
Matching passage: CVE-2015-1896. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in the FastBackMount process in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.11.1 allows remote attackers to execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-6156. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6148.
Query: detection rule: Detects suspicious patterns in program names or folders that are often found in malicious samples or hacktools
Matching passage: Sigma rule: Detects suspicious patterns in program names or folders that are often found in malicious samples or hacktools. Logsource: windows / process_creation. Rule: title: Suspicious Program Names id: efdd8dd5-cee8-4e59-9390-7d4d5e4dd6f6 status: test description: Detects suspicious patterns in program names or folders that are often found in malicious samples or hacktools references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md author: Florian Roth (Nextron Systems) date: 2022-02-11 modified: 2023-03-22 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_image: - Image|contains: - \CVE-202 - \CVE202 - Image|endswith: - \poc.exe - \artifact.exe - \artifact64.exe - \artifact_protected.exe - \artifact32.exe - \artifact32big.exe - obfuscated.exe - obfusc.exe - \meterpreter selection_commandline: CommandLine|contains: - inject.ps1 - Invoke-CVE - pupy.ps1 - payload.ps1 - beacon.ps1 - PowerView.ps1 - bypass.ps1 - obfuscated.ps1 - obfusc.ps1 - obfus.ps1 - obfs.ps1 - evil.ps1 - MiniDogz.ps1 - _enc.ps1 - \shell.ps1 - \rshell.ps1 - revshell.ps1 - \av.ps1 - \av_test.ps1 - adrecon.ps1 - mimikatz.ps1 - \PowerUp_ - powerup.ps1 - \Temp\a.ps1 - \Temp\p.ps1 - \Temp\1.ps1 - Hound.ps1 - encode.ps1 - powercat.ps1 condition: 1 of selection* falsepositives: - Legitimate tools that accidentally match on the searched patterns level: high
Near-miss passage: Sigma rule: Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.. Logsource: windows / process_creation. Rule: title: Cloudflared Tunnel Connections Cleanup id: 7050bba1-1aed-454e-8f73-3f46f09ce56a status: test description: Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections. references: - https://github.com/cloudflare/cloudflared - https://developers.cloudflare.com/cloudflare-one/connections/connect-apps author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-17 modified: 2023-12-21 tags: - attack.command-and-control - attack.t1102 - attack.t1090 - attack.t1572 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - ' tunnel ' - 'cleanup ' CommandLine|contains: - '-config ' - '-connector-id ' condition: selection falsepositives: - Legitimate usage of Cloudflared. level: medium
Query: risk of ImageIO in Apple iOS before 8.4.1 and OS X before 10.10.5 does not properly initialize an unspecified data structure, which allows remote attackers to obtain sensitive information 
Matching passage: CVE-2015-5782. CWE: CWE-200. CVSS: 4.300000190734863. ImageIO in Apple iOS before 8.4.1 and OS X before 10.10.5 does not properly initialize an unspecified data structure, which allows remote attackers to obtain sensitive information from process memory via a crafted TIFF image.
Near-miss passage: CVE-2015-1932. CWE: CWE-200. CVSS: 5.0. IBM WebSphere Application Server 7.x before 7.0.0.39, 8.0.x before 8.0.0.11, and 8.5.x before 8.5.5.7 and WebSphere Virtual Enterprise before 7.0.0.7 allow remote attackers to obtain potentially sensitive information about the proxy-server software by reading the HTTP Via header.