alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: telemetry for T1681
Matching passage: T1681 Search Threat Vendor Data. Tactics: reconnaissance. Description: Threat actors may seek information/indicators from closed or open threat intelligence sources gathered about their own campaigns, as well as those conducted by other adversaries that may align with their target industries, capabilities/objectives, or other operational concerns. These reports may include descriptions of behavior, detailed breakdowns of attacks, atomic indicators such as malware hashes or IP addresses, timelines of a group’s activity, and more. Adversaries may change their behavior when planning their future operations. Adversaries have been observed replacing atomic indicators mentioned in blog posts in under a week.(Citation: Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023) Adversaries have also been seen searching for their own domain names in threat vendor data and then taking them down, likely to avoid seizure or further investigation.(Citation: Sentinel One Contagious Interview ClickFix September 2025) This technique is distinct from [Threat Intel Vendors](https://attack.mitre.org/techniques/T1597/001) in that it describes threat actors performing reconnaissance on their own activity, not in search of victim information.
Near-miss passage: T1590.001 Domain Properties. Tactics: reconnaissance. Description: Adversaries may gather information about the victim's network domain(s) that can be used during targeting. Information about domains and their properties may include a variety of details, including what domain(s) the victim owns as well as administrative data (ex: name, registrar, etc.) and more directly actionable information such as contacts (email addresses and phone numbers), business addresses, and name servers. Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about victim domains and their properties may also be exposed to adversaries via online or other accessible data sets (ex: [WHOIS](https://attack.mitre.org/techniques/T1596/002)).(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: Circl Passive DNS) Where third-party cloud providers are in use, this information may also be exposed through publicly available API endpoints, such as GetUserRealm and autodiscover in Office 365 environments.(Citation: Azure Active Directory Reconnaisance)(Citation: Office 265 Azure Domain Availability) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596), [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593), or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566)).
Query: explain CWE-827
Matching passage: CWE-827 Improper Control of Document Type Definition. The product does not restrict a reference to a Document Type Definition (DTD) to the intended control sphere. This might allow attackers to reference arbitrary DTDs, possibly causing the product to expose files, consume excessive system resources, or execute arbitrary http requests on behalf of the attacker.
Near-miss passage: CWE-939 Improper Authorization in Handler for Custom URL Scheme. The product uses a handler for a custom URL scheme, but it does not properly restrict which actors can invoke the handler using the scheme.
Query: describe CVE-2015-7729
Matching passage: CVE-2015-7729. CWE: CWE-94. CVSS: 6.5. Eval injection in test-net.xsjs in the Web-based Development Workbench in SAP HANA Developer Edition DB 1.00.091.00.1418659308 allows remote authenticated users to execute arbitrary XSJS code via unspecified vectors, aka SAP Security Note 2153892.
Near-miss passage: CVE-2015-5970. CWE: CWE-94. CVSS: 5.300000190734863. The ChangePassword RPC method in Novell ZENworks Configuration Management (ZCM) 11.3 and 11.4 allows remote attackers to conduct XPath injection attacks, and read arbitrary text files, via a malformed query involving a system entity reference.
Query: exploit Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Priv
Matching passage: CVE-2015-4791. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Privileges.
Near-miss passage: CVE-2015-0990. CWE: UNKNOWN. CVSS: 4.400000095367432. Untrusted search path vulnerability in Ecava IntegraXor SCADA Server before 4.2.4488 allows local users to gain privileges via a renamed DLL in the default install directory.
Query: CVE similar to CVE-2015-8575
Matching passage: CVE-2015-8575. CWE: CWE-200. CVSS: 4.0. The sco_sock_bind function in net/bluetooth/sco.c in the Linux kernel before 4.3.4 does not verify an address length, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted application.
Near-miss passage: CVE-2015-8095. CWE: CWE-200. CVSS: 5.0. The recycle bin feature in the Monster Menus module 7.x-1.21 before 7.x-1.24 for Drupal does not properly remove nodes from view, which allows remote attackers to obtain sensitive information via an unspecified URL pattern.
Query: vulnerability: Motorola Scanner SDK uses weak permissions for (1) CoreScanner.exe, (2) rsmdriverproviderservice.exe, and (3) ScannerService.exe, which allows local users to gain privileges via un
Matching passage: CVE-2015-1496. CWE: CWE-264. CVSS: 7.199999809265137. Motorola Scanner SDK uses weak permissions for (1) CoreScanner.exe, (2) rsmdriverproviderservice.exe, and (3) ScannerService.exe, which allows local users to gain privileges via unspecified vectors.
Near-miss passage: CVE-2015-9015. CWE: CWE-264. CVSS: 7.800000190734863. An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36714120.
Query: risk of Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous befo
Matching passage: CVE-2015-5094. CWE: CWE-119. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3095, CVE-2015-5087, CVE-2015-5100, CVE-2015-5102, CVE-2015-5103, CVE-2015-5104, and CVE-2015-5115.
Near-miss passage: CVE-2015-1768. CWE: CWE-119. CVSS: 7.199999809265137. win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted application, aka "Win32k Memory Corruption Elevation of Privilege Vulnerability."
Query: adversary uses Commonly Used Port
Matching passage: T1043 Commonly Used Port. Tactics: command and control. Description: **This technique has been deprecated. Please use [Non-Standard Port](https://attack.mitre.org/techniques/T1571) where appropriate.** Adversaries may communicate over a commonly used port to bypass firewalls or network detection systems and to blend with normal network activity to avoid more detailed inspection. They may use commonly open ports such as * TCP:80 (HTTP) * TCP:443 (HTTPS) * TCP:25 (SMTP) * TCP/UDP:53 (DNS) They may use the protocol associated with the port or a completely different protocol. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), examples of common ports are * TCP/UDP:135 (RPC) * TCP/UDP:22 (SSH) * TCP/UDP:3389 (RDP)
Near-miss passage: T1090.003 Multi-hop Proxy. Tactics: command and control. Description: Adversaries may chain together multiple proxies to disguise the source of malicious traffic. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source. For example, adversaries may construct or use onion routing networks – such as the publicly available [Tor](https://attack.mitre.org/software/S0183) network – to transport encrypted C2 traffic through a compromised population, allowing communication with any device within the network.(Citation: Onion Routing) Adversaries may also use operational relay box (ORB) networks composed of virtual private servers (VPS), Internet of Things (IoT) devices, smart devices, and end-of-life routers to obfuscate their operations.(Citation: ORB Mandiant) In the case of network infrastructure, it is possible for an adversary to leverage multiple compromised devices to create a multi-hop proxy chain (i.e., [Network Devices](https://attack.mitre.org/techniques/T1584/008)). By leveraging [Patch System Image](https://attack.mitre.org/techniques/T1601/001) on routers, adversaries can add custom code to the affected network devices that will implement onion routing between those nodes. This method is dependent upon the [Network Boundary Bridging](https://attack.mitre.org/techniques/T1599) method allowing the adversaries to cross the protected network boundary of the Internet perimeter and into the organization’s Wide-Area Network (WAN). Protocols such as ICMP may be used as a transport. Similarly, adversaries may abuse peer-to-peer (P2P) and blockchain-oriented infrastructure to implement routing between a decentralized network of peers.(Citation: NGLite Trojan)
Query: describe CVE-2015-7866
Matching passage: CVE-2015-7866. CWE: UNKNOWN. CVSS: 7.199999809265137. Unquoted Windows search path vulnerability in the Smart Maximize Helper (nvSmartMaxApp.exe) in the Control Panel in the NVIDIA GPU graphics driver R340 before 341.92, R352 before 354.35, and R358 before 358.87 on Windows allows local users to gain privileges via a Trojan horse application, as demonstrated by C:\Program.exe.
Near-miss passage: CVE-2015-2111. CWE: UNKNOWN. CVSS: 2.0999999046325684. Unspecified vulnerability in HP Intelligent Provisioning 1.40 through 1.60 on Windows Server 2008 R2 and 2012 allows local users to obtain sensitive information via unknown vectors.
Query: risk of Multiple cross-site scripting (XSS) vulnerabilities in the Quick Edit module 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject a
Matching passage: CVE-2015-6753. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in the Quick Edit module 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via an (1) entity title, related to in-place editing, or a (2) node title.
Near-miss passage: CVE-2015-10032. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability was found in HealthMateWeb. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file createaccount.php. The manipulation of the argument username/password/first_name/last_name/company/phone leads to cross site scripting. The attack can be launched remotely. The patch is named 472776c25b1046ecaf962c46fed7c713c72c28e3. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217663.
Query: rule covering Detects changes to the "ServiceDLL" value related to a service in the registry. This is often used as a method of persis
Matching passage: Sigma rule: Detects changes to the "ServiceDLL" value related to a service in the registry. This is often used as a method of persis. Logsource: windows / registry_set. Rule: title: ServiceDll Hijack id: 612e47e9-8a59-43a6-b404-f48683f45bd6 status: test description: 'Detects changes to the "ServiceDLL" value related to a service in the registry. This is often used as a method of persistence. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1543.003/T1543.003.md#atomic-test-4---tinyturla-backdoor-service-w64time - https://www.hexacorn.com/blog/2013/09/19/beyond-good-ol-run-key-part-4/ author: frack113 date: 2022-02-04 modified: 2024-04-03 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 logsource: category: registry_set product: windows detection: selection: TargetObject|contains|all: - \System\ - ControlSet - \Services\ TargetObject|endswith: \Parameters\ServiceDll filter_main_printextensionmanger: Details: C:\Windows\system32\spool\drivers\x64\3\PrintConfig.dll filter_main_domain_controller: Image: C:\Windows\system32\lsass.exe TargetObject|endswith: \Services\NTDS\Parameters\ServiceDll Details: '%%systemroot%%\system32\ntdsa.dll' filter_main_poqexec: Image: C:\Windows\System32\poqexec.exe filter_optional_safetica: Image|endswith: \regsvr32.exe Details: C:\Windows\System32\STAgent.dll condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Administrative scripts - Installation of a service level: medium
Near-miss passage: Sigma rule: Detects PowerShell scripts set ACL to of a file or a folder. Logsource: windows / ps_script. Rule: title: PowerShell Script Change Permission Via Set-Acl - PsScript id: cae80281-ef23-44c5-873b-fd48d2666f49 related: - id: 0944e002-e3f6-4eb5-bf69-3a3067b53d73 type: derived - id: bdeb2cff-af74-4094-8426-724dc937f20a type: derived - id: 3bf1d859-3a7e-44cb-8809-a99e066d3478 type: derived status: test description: Detects PowerShell scripts set ACL to of a file or a folder references: - https://github.com/redcanaryco/atomic-red-team/blob/74438b0237d141ee9c99747976447dc884cb1a39/atomics/T1505.005/T1505.005.md author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-07-18 tags: - attack.defense-impairment - attack.t1222 logsource: product: windows category: ps_script definition: bade5735-5ab0-4aa7-a642-a11be0e40872 detection: selection: ScriptBlockText|contains|all: - 'Set-Acl ' - '-AclObject ' - '-Path ' condition: selection falsepositives: - Unknown level: low
Query: describe CVE-2015-6768
Matching passage: CVE-2015-6768. CWE: CWE-264. CVSS: 7.5. The DOM implementation in Google Chrome before 47.0.2526.73 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2015-6770.
Near-miss passage: CVE-2015-1356. CWE: CWE-264. CVSS: 4.400000095367432. Siemens SIMATIC STEP 7 (TIA Portal) before 13 SP1 determines a user's privileges on the basis of project-file fields that lack integrity protection, which allows remote attackers to establish arbitrary authorization data via a modified file.
Query: Sigma rule for Detects the creation of a new named pipe using the "mkfifo" utility in a potentially suspicious location
Matching passage: Sigma rule: Detects the creation of a new named pipe using the "mkfifo" utility in a potentially suspicious location. Logsource: linux / process_creation. Rule: title: Potentially Suspicious Named Pipe Created Via Mkfifo id: 999c3b12-0a8c-40b6-8e13-dd7d62b75c7a related: - id: 9d779ce8-5256-4b13-8b6f-b91c602b43f4 type: derived status: test description: Detects the creation of a new named pipe using the "mkfifo" utility in a potentially suspicious location references: - https://dev.to/0xbf/use-mkfifo-to-create-named-pipe-linux-tips-5bbk - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-16 tags: - attack.execution logsource: category: process_creation product: linux detection: selection: Image|endswith: /mkfifo CommandLine|contains: ' /tmp/' condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of "Diskshadow.exe" in script mode to execute an script with a potentially uncommon extension. Initial. Logsource: windows / process_creation. Rule: title: Diskshadow Script Mode - Uncommon Script Extension Execution id: 1dde5376-a648-492e-9e54-4241dd9b0c7f related: - id: fa1a7e52-3d02-435b-81b8-00da14dd66c1 type: similar - id: 9f546b25-5f12-4c8d-8532-5893dcb1e4b8 type: similar - id: 56b1dde8-b274-435f-a73a-fb75eb81262a type: similar - id: 0c2f8629-7129-4a8a-9897-7e0768f13ff2 type: similar status: test description: 'Detects execution of "Diskshadow.exe" in script mode to execute an script with a potentially uncommon extension. Initial baselining of the allowed extension list is required. ' references: - https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/ - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration - https://medium.com/@cyberjyot/lolbin-execution-via-diskshadow-f6ff681a27a4 - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow - https://www.lifars.com/wp-content/uploads/2022/01/GriefRansomware_Whitepaper-2.pdf - https://www.zscaler.com/blogs/security-research/technical-analysis-crytox-ransomware - https://research.checkpoint.com/2022/evilplayout-attack-against-irans-state-broadcaster/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-09-15 modified: 2024-03-05 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: diskshadow.exe - Image|endswith: \diskshadow.exe selection_flag: CommandLine|contains|windash: '-s ' filter_main_ext: CommandLine|contains: .txt condition: all of selection_* and not 1 of filter_main_* falsepositives: - False postitve might occur with legitimate or uncommon extensions used internally. Initial baseline is required. level: medium
Query: risk of Cisco Modular Encoding Platform D9036 Software before 02.04.70 has hardcoded (1) root and (2) guest passwords, which makes it easier for remote attackers to obtain access via an SS
Matching passage: CVE-2015-6412. CWE: CWE-255. CVSS: 9.800000190734863. Cisco Modular Encoding Platform D9036 Software before 02.04.70 has hardcoded (1) root and (2) guest passwords, which makes it easier for remote attackers to obtain access via an SSH session, aka Bug ID CSCut88070.
Near-miss passage: CVE-2015-9240. CWE: CWE-255. CVSS: 7.5. Due to a bug in the the default sign in functionality in the keystone node module before 0.3.16, incomplete email addresses could be matched. A correct password is still required to complete sign in.
Query: Encoded PowerShell / command-line abuse matching Password Managers
Matching passage: T1555.005 Password Managers. Tactics: credential access. Description: Adversaries may acquire user credentials from third-party password managers.(Citation: ise Password Manager February 2019) Password managers are applications designed to store user credentials, normally in an encrypted database. Credentials are typically accessible after a user provides a master password that unlocks the database. After the database is unlocked, these credentials may be copied to memory. These databases can be stored as files on disk.(Citation: ise Password Manager February 2019) Adversaries may acquire user credentials from password managers by extracting the master password and/or plain-text credentials from memory.(Citation: FoxIT Wocao December 2019)(Citation: Github KeeThief) Adversaries may extract credentials from memory via [Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212).(Citation: NVD CVE-2019-3610) Adversaries may also try brute forcing via [Password Guessing](https://attack.mitre.org/techniques/T1110/001) to obtain the master password of a password manager.(Citation: Cyberreason Anchor December 2019)
Near-miss passage: T1555.002 Securityd Memory. Tactics: credential access. Description: An adversary with root access may gather credentials by reading `securityd`’s memory. `securityd` is a service/daemon responsible for implementing security protocols such as encryption and authorization.(Citation: Apple Dev SecurityD) A privileged adversary may be able to scan through `securityd`'s memory to find the correct sequence of keys to decrypt the user’s logon keychain. This may provide the adversary with various plaintext passwords, such as those for users, WiFi, mail, browsers, certificates, secure notes, etc.(Citation: OS X Keychain)(Citation: OSX Keydnap malware) In OS X prior to El Capitan, users with root access can read plaintext keychain passwords of logged-in users because Apple’s keychain implementation allows these credentials to be cached so that users are not repeatedly prompted for passwords.(Citation: OS X Keychain)(Citation: External to DA, the OS X Way) Apple’s `securityd` utility takes the user’s logon password, encrypts it with PBKDF2, and stores this master key in memory. Apple also uses a set of keys and algorithms to encrypt the user’s password, but once the master key is found, an adversary need only iterate over the other values to unlock the final password.(Citation: OS X Keychain)
Query: describe CVE-2015-7877
Matching passage: CVE-2015-7877. CWE: CWE-89. CVSS: 9.800000190734863. Multiple SQL injection vulnerabilities in the User Dashboard module 7.x before 7.x-1.4 for Drupal allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-5078. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the insert function in application/controllers/admin/dataentry.php in LimeSurvey 2.06+ allows remote authenticated users to execute arbitrary SQL commands via the closedate parameter.
Query: CVE similar to CVE-2015-5296
Matching passage: CVE-2015-5296. CWE: CWE-20. CVSS: 5.400000095367432. Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 supports connections that are encrypted but unsigned, which allows man-in-the-middle attackers to conduct encrypted-to-unencrypted downgrade attacks by modifying the client-server data stream, related to clidfs.c, libsmb_server.c, and smbXcli_base.c.
Near-miss passage: CVE-2015-6164. CWE: CWE-20. CVSS: 6.800000190734863. Microsoft Internet Explorer 9 through 11 improperly implements a cross-site scripting (XSS) protection mechanism, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, aka "Internet Explorer XSS Filter Bypass Vulnerability."
Query: explain CWE-326
Matching passage: CWE-326 Inadequate Encryption Strength. The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
Near-miss passage: CWE-639 Authorization Bypass Through User-Controlled Key. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.