alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of The php_str_replace_in_subject function in ext/standard/string.c in PHP 7.x before 7.0.0 allows remote attackers to execute arbitrary code via a crafted value in the third argument
Matching passage: CVE-2015-6527. CWE: UNKNOWN. CVSS: 7.300000190734863. The php_str_replace_in_subject function in ext/standard/string.c in PHP 7.x before 7.0.0 allows remote attackers to execute arbitrary code via a crafted value in the third argument to the str_ireplace function.
Near-miss passage: CVE-2015-8441. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: patch priority for CVE-2015-7580
Matching passage: CVE-2015-7580. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node.
Near-miss passage: CVE-2015-4385. CWE: CWE-79. CVSS: 2.0999999046325684. Cross-site scripting (XSS) vulnerability in unspecified administration pages in the Imagefield Info module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the "Administer image styles" permission to inject arbitrary web script or HTML via unspecified vectors.
Query: vulnerability: Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before
Matching passage: CVE-2015-3093. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3078, CVE-2015-3089, and CVE-2015-3090.
Near-miss passage: CVE-2015-6284. CWE: CWE-119. CVSS: 7.800000190734863. Buffer overflow in the Conference Control Protocol API implementation in Cisco TelePresence Server software before 4.1(2.33) on 7010, MSE 8710, Multiparty Media 310 and 320, and Virtual Machine devices allows remote attackers to cause a denial of service (device crash) via a crafted URL, aka Bug ID CSCuu28277.
Query: vulnerability: The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly perform boolean-ty
Matching passage: CVE-2015-0286. CWE: CWE-17. CVSS: 5.0. The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly perform boolean-type comparisons, which allows remote attackers to cause a denial of service (invalid read operation and application crash) via a crafted X.509 certificate to an endpoint that uses the certificate-verification feature.
Near-miss passage: CVE-2015-0173. CWE: CWE-17. CVSS: 4.300000190734863. The HTTP connection-management functionality in Internet Pass-Thru (IPT) before 2.1.0.2 in IBM WebSphere MQ, when HTTPS is disabled, does not properly generate MQIPT Session IDs, which makes it easier for remote attackers to bypass intended restrictions on MQ message data by predicting an ID value.
Query: Outbound C2 pattern associated with Data Manipulation
Matching passage: T1565 Data Manipulation. Tactics: impact. Description: Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data.(Citation: Sygnia Elephant Beetle Jan 2022) By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making. The type of modification and the impact it will have depends on the target application and process as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
Near-miss passage: T1565.002 Transmitted Data Manipulation. Tactics: impact. Description: Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating transmitted data, adversaries may attempt to affect a business process, organizational understanding, and decision making. Manipulation may be possible over a network connection or between system processes where there is an opportunity deploy a tool that will intercept and change information. The type of modification and the impact it will have depends on the target transmission mechanism as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
Query: risk of Multiple use-after-free vulnerabilities in epan/dissectors/packet-dec-dnart.c in the DEC DNA Routing Protocol dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 
Matching passage: CVE-2015-0562. CWE: UNKNOWN. CVSS: 5.0. Multiple use-after-free vulnerabilities in epan/dissectors/packet-dec-dnart.c in the DEC DNA Routing Protocol dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 allow remote attackers to cause a denial of service (application crash) via a crafted packet, related to the use of packet-scope memory instead of pinfo-scope memory.
Near-miss passage: CVE-2015-0085. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in Microsoft Office 2007 SP3, Excel 2007 SP3, PowerPoint 2007 SP3, Word 2007 SP3, Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Word 2010 SP2, Office 2013 Gold and SP1, Word 2013 Gold and SP1, Office 2013 RT Gold and SP1, Word 2013 RT Gold and SP1, Excel Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2, Excel Services on SharePoint Server 2013 Gold and SP1, Word Automation Services on SharePoint Server 2013 Gold and SP1, Web Applications 2010 SP2, Office Web Apps Server 2010 SP2, Web Apps Server 2013 Gold and SP1, SharePoint Server 2007 SP3, Windows SharePoint Services 3.0 SP3, SharePoint Foundation 2010 SP2, SharePoint Server 2010 SP2, SharePoint Foundation 2013 Gold and SP1, and SharePoint Server 2013 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Component Use After Free Vulnerability."
Query: CWE for Improper Check for Unusual or Exceptional Conditions
Matching passage: CWE-754 Improper Check for Unusual or Exceptional Conditions. The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
Near-miss passage: CWE-693 Protection Mechanism Failure. The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
Query: detect Detects attempts to delete Internet Information Services (IIS) log files via command line utilities, which is a common d in logs
Matching passage: Sigma rule: Detects attempts to delete Internet Information Services (IIS) log files via command line utilities, which is a common d. Logsource: windows / process_creation. Rule: title: IIS WebServer Log Deletion via CommandLine Utilities id: 0649be4a-aeb0-45b0-b89e-7f1668f6d9c0 related: - id: 3eb8c339-a765-48cc-a150-4364c04652bf type: similar status: experimental description: 'Detects attempts to delete Internet Information Services (IIS) log files via command line utilities, which is a common defense evasion technique used by attackers to cover their tracks. Threat actors often abuse vulnerabilities in web applications hosted on IIS servers to gain initial access and later delete IIS logs to evade detection. ' references: - https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/managing-iis-log-file-storage author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-09-02 tags: - attack.stealth - attack.t1070 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \cmd.exe - \powershell_ise.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - cmd.exe - powershell.exe - powershell_ise.exe - pwsh.dll selection_cli_del: CommandLine|contains: - 'del ' - 'erase ' - 'rm ' - 'remove-item ' - 'rmdir ' selection_cli_iis_dir: CommandLine|contains: \inetpub\logs\ condition: all of selection_* falsepositives: - Deletion of IIS logs that are older than a certain retention period as part of regular maintenance activities. - Legitimate schedule tasks or scripts that clean up log files regularly. level: medium
Near-miss passage: Sigma rule: Detects a suspicious call to the user32.dll function that locks the user workstation. Logsource: windows / process_creation. Rule: title: Suspicious Workstation Locking via Rundll32 id: 3b5b0213-0460-4e3f-8937-3abf98ff7dcc status: test description: Detects a suspicious call to the user32.dll function that locks the user workstation references: - https://app.any.run/tasks/2aef9c63-f944-4763-b3ef-81eee209d128/ author: frack113 date: 2022-06-04 modified: 2023-02-09 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_call_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE selection_call_parent: ParentImage|endswith: \cmd.exe selection_call_cli: CommandLine|contains: user32.dll, selection_function: CommandLine|contains: LockWorkStation condition: all of selection_* falsepositives: - Scripts or links on the user desktop used to lock the workstation instead of Windows+L or the menu option level: medium
Query: Lateral movement indicators for Cloud Firewall
Matching passage: T1686.001 Cloud Firewall. Tactics: defense impairment. Description: Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources. Cloud environments typically utilize restrictive security groups and firewall rules that only allow network activity from trusted IP addresses via expected ports and protocols. An adversary with appropriate permissions may introduce new firewall rules or policies to allow access into a victim cloud environment and/or move laterally from the cloud control plane to the data plane. For example, an adversary may use a script or utility that creates new ingress rules in existing security groups (or creates new security groups entirely) to allow any TCP/IP connectivity to a cloud-hosted instance. They may also remove networking limitations to support traffic associated with malicious activity (such as cryptomining).(Citation: Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022)(Citation: Expel AWS)
Near-miss passage: T1686 Disable or Modify System Firewall. Tactics: defense impairment. Description: Adversaries may disable or modify host-based or network firewalls to impair defensive mechanisms and enable further action. Once an adversary has gathered sufficient privileges, they can tamper with firewall services, policies, or rule sets to remove restrictions on inbound or outbound traffic. For example, this may include turning off firewall profiles, altering existing rules to permit previously blocked ports or protocols, or adding new rules that create covert communication paths (e.g., adding a new firewall rule for a well-known protocol (such as RDP) using a non-traditional and potentially less securitized port.(Citation: change_rdp_port_conti) Adversaries may disable or modify firewalls using different behaviors, depending on the platform. For example, in ESXi, firewall rules may be modified directly via the esxcli (e.g., via esxcli network firewall set) or via the vCenter user interface.(Citation: Broadcom ESXi Firewall)(Citation: Trellix Rnasomhouse 2024)
Query: risk of Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 do not properly constrain impersonation levels, which allows local users 
Matching passage: CVE-2015-2524. CWE: CWE-264. CVSS: 7.199999809265137. Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 do not properly constrain impersonation levels, which allows local users to gain privileges via a crafted application, aka "Windows Task Management Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2528.
Near-miss passage: CVE-2015-7430. CWE: CWE-264. CVSS: 8.399999618530273. The Hadoop connector 1.1.1, 2.4, 2.5, and 2.7.0-0 before 2.7.0-3 for IBM Spectrum Scale and General Parallel File System (GPFS) allows local users to read or write to arbitrary GPFS data via unspecified vectors.
Query: describe CVE-2015-2461
Matching passage: CVE-2015-2461. CWE: CWE-20. CVSS: 9.300000190734863. ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "OpenType Font Parsing Vulnerability," a different vulnerability than CVE-2015-2458 and CVE-2015-2459.
Near-miss passage: CVE-2015-1326. CWE: CWE-20. CVSS: 8.800000190734863. python-dbusmock before version 0.15.1 AddTemplate() D-Bus method call or DBusTestCase.spawn_server_template() method could be tricked into executing malicious code if an attacker supplies a .pyc file.
Query: rule covering Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller
Matching passage: Sigma rule: Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller. Logsource: windows / process_creation. Rule: title: HackTool - SharpLdapWhoami Execution id: d9367cbb-c2e0-47ce-bdc0-128cb6da898d status: test description: Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller references: - https://github.com/bugch3ck/SharpLdapWhoami author: Florian Roth (Nextron Systems) date: 2022-08-29 modified: 2023-02-04 tags: - attack.discovery - attack.t1033 - car.2016-03-001 logsource: category: process_creation product: windows detection: selection_name: Image|endswith: \SharpLdapWhoami.exe selection_pe: - OriginalFileName|contains: SharpLdapWhoami - Product: SharpLdapWhoami selection_flags1: CommandLine|endswith: - ' /method:ntlm' - ' /method:kerb' - ' /method:nego' - ' /m:nego' - ' /m:ntlm' - ' /m:kerb' condition: 1 of selection* falsepositives: - Programs that use the same command line flags level: high
Near-miss passage: Sigma rule: Detects suspicious application installed by looking at the added shortcut to the app resolver cache. Logsource: windows / shell-core. Rule: title: Suspicious Application Installed id: 83c161b6-ca67-4f33-8ad0-644a0737cf07 status: test description: Detects suspicious application installed by looking at the added shortcut to the app resolver cache references: - https://nasbench.medium.com/finding-forensic-goodness-in-obscure-windows-event-logs-60e978ea45a3 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-14 tags: - attack.execution logsource: product: windows service: shell-core detection: selection_name: EventID: 28115 Name|contains: - Zenmap - AnyDesk - wireshark - openvpn selection_packageid: EventID: 28115 AppID|contains: - zenmap.exe - prokzult ad - wireshark - openvpn condition: 1 of selection_* falsepositives: - Packages or applications being legitimately used by users or administrators level: medium
Query: Sigma rule for Detects scripts or commands that disabled the Powershell command history by removing psreadline module
Matching passage: Sigma rule: Detects scripts or commands that disabled the Powershell command history by removing psreadline module. Logsource: windows / ps_script. Rule: title: Disable Powershell Command History id: 602f5669-6927-4688-84db-0d4b7afb2150 status: test description: Detects scripts or commands that disabled the Powershell command history by removing psreadline module references: - https://twitter.com/DissectMalware/status/1062879286749773824 author: Ali Alwashali date: 2022-08-21 tags: - attack.stealth - attack.t1070.003 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - Remove-Module - psreadline condition: selection falsepositives: - Legitimate script that disables the command history level: high
Near-miss passage: Sigma rule: Detects suspicious launch of a renamed version of the PSEXESVC service with, which is not often used by legitimate admin. Logsource: windows / process_creation. Rule: title: Renamed PsExec Service Execution id: 51ae86a2-e2e1-4097-ad85-c46cb6851de4 status: test description: Detects suspicious launch of a renamed version of the PSEXESVC service with, which is not often used by legitimate administrators references: - https://learn.microsoft.com/en-us/sysinternals/downloads/psexec - https://www.youtube.com/watch?v=ro2QuZTIMBM author: Florian Roth (Nextron Systems) date: 2022-07-21 tags: - attack.execution logsource: category: process_creation product: windows detection: selection: OriginalFileName: psexesvc.exe filter: Image: C:\Windows\PSEXESVC.exe condition: selection and not filter falsepositives: - Legitimate administrative tasks level: high
Query: Sigma rule for Detects the use of IOX - a tool for port forwarding and intranet proxy purposes
Matching passage: Sigma rule: Detects the use of IOX - a tool for port forwarding and intranet proxy purposes. Logsource: windows / process_creation. Rule: title: PUA- IOX Tunneling Tool Execution id: d7654f02-e04b-4934-9838-65c46f187ebc status: test description: Detects the use of IOX - a tool for port forwarding and intranet proxy purposes references: - https://github.com/EddieIvan01/iox author: Florian Roth (Nextron Systems) date: 2022-10-08 modified: 2024-11-23 tags: - attack.command-and-control - attack.t1090 logsource: category: process_creation product: windows detection: selection: Image|endswith: \iox.exe selection_commandline: CommandLine|contains: - '.exe fwd -l ' - '.exe fwd -r ' - '.exe proxy -l ' - '.exe proxy -r ' selection_hashes: Hashes|contains: - MD5=9DB2D314DD3F704A02051EF5EA210993 - SHA1=039130337E28A6623ECF9A0A3DA7D92C5964D8DD - SHA256=C6CF82919B809967D9D90EA73772A8AA1C1EB3BC59252D977500F64F1A0D6731 condition: 1 of selection* falsepositives: - Legitimate use level: high
Near-miss passage: Sigma rule: Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-d. Logsource: windows / process_creation. Rule: title: Potential Mpclient.DLL Sideloading Via Defender Binaries id: 7002aa10-b8d4-47ae-b5ba-51ab07e228b9 related: - id: 418dc89a-9808-4b87-b1d7-e5ae0cb6effc type: similar status: test description: Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory. references: - https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool author: Bhabesh Raj date: 2022-08-01 modified: 2023-08-04 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: product: windows category: process_creation detection: selection: Image|endswith: - \MpCmdRun.exe - \NisSrv.exe filter_main_known_locations: Image|startswith: - C:\Program Files (x86)\Windows Defender\ - C:\Program Files\Microsoft Security Client\ - C:\Program Files\Windows Defender\ - C:\ProgramData\Microsoft\Windows Defender\Platform\ - C:\Windows\WinSxS\ condition: selection and not 1 of filter_main_* falsepositives: - Unlikely level: high
Query: exploit Techno Project Japan Enisys Gw before 1.4.1 allows remote authenticated users to write to arbitrary files and consequently execute arbitrary code via unspecified vectors.
Matching passage: CVE-2015-5669. CWE: UNKNOWN. CVSS: 6.5. Techno Project Japan Enisys Gw before 1.4.1 allows remote authenticated users to write to arbitrary files and consequently execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-3038. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3041, CVE-2015-3042, and CVE-2015-3043.
Query: explain T1005 Data from Local System
Matching passage: T1005 Data from Local System. Tactics: collection. Description: Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration. Adversaries may do this using a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), such as [cmd](https://attack.mitre.org/software/S0106) as well as a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008), which have functionality to interact with the file system to gather information.(Citation: show_run_config_cmd_cisco) Adversaries may also use [Automated Collection](https://attack.mitre.org/techniques/T1119) on the local system.
Near-miss passage: T1114.002 Remote Email Collection. Tactics: collection. Description: Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens. Tools such as [MailSniper](https://attack.mitre.org/software/S0413) can be used to automate searches for specific keywords.