alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Outbound C2 pattern associated with Python
Matching passage: T1059.006 Python. Tactics: execution. Description: Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the <code>python.exe</code> interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.(Citation: Zscaler APT31 Covid-19 October 2020) Python comes with many built-in packages to interact with the underlying system, such as file operations and device I/O. Adversaries can use these libraries to download and execute commands or other scripts as well as perform various malicious behaviors.
Near-miss passage: T1059.009 Cloud API. Tactics: execution. Description: Adversaries may abuse cloud APIs to execute malicious commands. APIs available in cloud environments provide various functionalities and are a feature-rich method for programmatic access to nearly all aspects of a tenant. These APIs may be utilized through various methods such as command line interpreters (CLIs), in-browser Cloud Shells, [PowerShell](https://attack.mitre.org/techniques/T1059/001) modules like Azure for PowerShell(Citation: Microsoft - Azure PowerShell), or software developer kits (SDKs) available for languages such as [Python](https://attack.mitre.org/techniques/T1059/006). Cloud API functionality may allow for administrative access across all major services in a tenant such as compute, storage, identity and access management (IAM), networking, and security policies. With proper permissions (often via use of credentials such as [Application Access Token](https://attack.mitre.org/techniques/T1550/001) and [Web Session Cookie](https://attack.mitre.org/techniques/T1550/004)), adversaries may abuse cloud APIs to invoke various functions that execute malicious actions. For example, CLI and PowerShell functionality may be accessed through binaries installed on cloud-hosted or on-premises hosts or accessed through a browser-based cloud shell offered by many cloud platforms (such as AWS, Azure, and GCP). These cloud shells are often a packaged unified environment to use CLI and/or scripting modules hosted as a container in the cloud environment.
Query: vulnerability: The SoapClient implementation in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly
Matching passage: CVE-2015-4600. CWE: UNKNOWN. CVSS: 9.800000190734863. The SoapClient implementation in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to "type confusion" issues in the (1) SoapClient::__getLastRequest, (2) SoapClient::__getLastResponse, (3) SoapClient::__getLastRequestHeaders, (4) SoapClient::__getLastResponseHeaders, (5) SoapClient::__getCookies, and (6) SoapClient::__setCookie methods.
Near-miss passage: CVE-2015-0877. CWE: UNKNOWN. CVSS: 7.5. Unrestricted file upload vulnerability in app/lib/mlf.pl in C-BOARD Moyuku before 1.03b3 allows remote attackers to execute arbitrary code by uploading a file with a \0 character in its name.
Query: patch priority for CVE-2015-9010
Matching passage: CVE-2015-9010. CWE: CWE-264. CVSS: 9.800000190734863. An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36393101.
Near-miss passage: CVE-2015-1292. CWE: CWE-264. CVSS: 5.0. The NavigatorServiceWorker::serviceWorker function in modules/serviceworkers/NavigatorServiceWorker.cpp in Blink, as used in Google Chrome before 45.0.2454.85, allows remote attackers to bypass the Same Origin Policy by accessing a Service Worker.
Query: CVE similar to CVE-2015-2760
Matching passage: CVE-2015-2760. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3 Patch 4 Hotfix 16 (9.3.416.4) allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-9279. CWE: CWE-79. CVSS: 6.099999904632568. MailEnable before 8.60 allows Stored XSS via malformed use of "<img/src" with no ">" character in the body of an e-mail message.
Query: vulnerability: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, and
Matching passage: CVE-2015-9111. CWE: CWE-476. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, and SD 820A, in a QTEE syscall handler, an untrusted pointer dereference can occur.
Near-miss passage: CVE-2015-0003. CWE: CWE-476. CVSS: 6.900000095367432. win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges or cause a denial of service (NULL pointer dereference) via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
Query: detection rule: Detects the creation of an administrator account on a Fortinet FortiGate Firewall.
Matching passage: Sigma rule: Detects the creation of an administrator account on a Fortinet FortiGate Firewall.. Logsource: fortigate / event. Rule: title: FortiGate - New Administrator Account Created id: cd0a4943-0edd-42cf-b50c-06f77a10d4c1 status: experimental description: Detects the creation of an administrator account on a Fortinet FortiGate Firewall. references: - https://www.fortiguard.com/psirt/FG-IR-24-535 - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/390485493/config-system-admin - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) date: 2025-11-01 tags: - attack.persistence - attack.t1136.001 logsource: product: fortigate service: event detection: selection: action: Add cfgpath: system.admin condition: selection falsepositives: - An administrator account can be created for legitimate purposes. Investigate the account details to determine if it is authorized. level: medium
Near-miss passage: Sigma rule: Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the c. Logsource: windows / ps_module. Rule: title: Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell Module id: 2f211361-7dce-442d-b78a-c04039677378 related: - id: 1b9dc62e-6e9e-42a3-8990-94d7a10007f7 type: derived status: test description: Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block cited in the reference section below references: - https://github.com/danielbohannon/Invoke-Obfuscation/blob/f20e7f843edd0a3a7716736e9eddfa423395dd26/Out-ObfuscatedStringCommand.ps1#L873-L888 author: Daniel Bohannon (@Mandiant/@FireEye), oscd.community date: 2019-11-08 modified: 2022-12-31 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_payload: - Payload|re: \$PSHome\[\s*\d{1,3}\s*\]\s*\+\s*\$PSHome\[ - Payload|re: \$ShellId\[\s*\d{1,3}\s*\]\s*\+\s*\$ShellId\[ - Payload|re: \$env:Public\[\s*\d{1,3}\s*\]\s*\+\s*\$env:Public\[ - Payload|re: \$env:ComSpec\[(\s*\d{1,3}\s*,){2} - Payload|re: \*mdr\*\W\s*\)\.Name - Payload|re: \$VerbosePreference\.ToString\( - Payload|re: \[String\]\s*\$VerbosePreference condition: selection_payload falsepositives: - Unknown level: high
Query: exploit The IKEv1 implementation in Cisco Adaptive Security Appliance (ASA) software 7.2 and 8.2 before 8.2(5.58), 8.3 and 8.4 before 8.4(7.29), 8.5 through 8.7 before 8.7(1.17), 9.0 befor
Matching passage: CVE-2015-6327. CWE: CWE-399. CVSS: 7.800000190734863. The IKEv1 implementation in Cisco Adaptive Security Appliance (ASA) software 7.2 and 8.2 before 8.2(5.58), 8.3 and 8.4 before 8.4(7.29), 8.5 through 8.7 before 8.7(1.17), 9.0 before 9.0(4.37), 9.1 before 9.1(6.8), 9.2 before 9.2(4), and 9.3 before 9.3(3) allows remote attackers to cause a denial of service (device reload) via crafted ISAKMP UDP packets, aka Bug ID CSCus94026.
Near-miss passage: CVE-2015-2013. CWE: CWE-399. CVSS: 5.0. IBM WebSphere MQ 7.0.1 before 7.0.1.13 allows remote attackers to cause a denial of service (channel-agent abend and process outage) via a crafted selection string in an MQI call.
Query: exploit Cross-site scripting (XSS) vulnerability in the HTTP module in Cisco Security Manager (CSM) 4.7(0)SP1(1) allows remote attackers to inject arbitrary web script or HTML via a crafte
Matching passage: CVE-2015-0727. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the HTTP module in Cisco Security Manager (CSM) 4.7(0)SP1(1) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCut27789.
Near-miss passage: CVE-2015-3626. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the DHCP Monitor page in the Web User Interface (WebUI) in Fortinet FortiOS before 5.2.4 on FortiGate devices allows remote attackers to inject arbitrary web script or HTML via a crafted hostname.
Query: threat report mentioning Standard Encoding
Matching passage: T1132.001 Standard Encoding. Tactics: command and control. Description: Adversaries may encode data with a standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system that adheres to existing protocol specifications. Common data encoding schemes include ASCII, Unicode, hexadecimal, Base64, and MIME.(Citation: Wikipedia Binary-to-text Encoding)(Citation: Wikipedia Character Encoding) Some data encoding systems may also result in data compression, such as gzip.
Near-miss passage: T1132.002 Non-Standard Encoding. Tactics: command and control. Description: Adversaries may encode data with a non-standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a non-standard data encoding system that diverges from existing protocol specifications. Non-standard data encoding schemes may be based on or related to standard data encoding schemes, such as a modified Base64 encoding for the message body of an HTTP request.(Citation: Wikipedia Binary-to-text Encoding)(Citation: Wikipedia Character Encoding)
Query: CVE similar to CVE-2015-1284
Matching passage: CVE-2015-1284. CWE: CWE-20. CVSS: 7.5. The LocalFrame::isURLAllowed function in core/frame/LocalFrame.cpp in Blink, as used in Google Chrome before 44.0.2403.89, does not properly check for a page's maximum number of frames, which allows remote attackers to cause a denial of service (invalid count value and use-after-free) or possibly have unspecified other impact via crafted JavaScript code that makes many createElement calls for IFRAME elements.
Near-miss passage: CVE-2015-4329. CWE: CWE-20. CVSS: 6.5. The administrator web interface in Cisco TelePresence Video Communication Server (VCS) X8.5.2 allows remote authenticated users to execute arbitrary OS commands via crafted HTTP requests, aka Bug ID CSCuv11796.
Query: SIEM correlation: exfiltration activity consistent with Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
Matching passage: T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol. Tactics: exfiltration. Description: Adversaries may steal data by exfiltrating it over an asymmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Asymmetric encryption algorithms are those that use different keys on each end of the channel. Also known as public-key cryptography, this requires pairs of cryptographic keys that can encrypt/decrypt data from the corresponding key. Each end of the communication channels requires a private key (only in the procession of that entity) and the public key of the other entity. The public keys of each entity are exchanged before encrypted communications begin. Network protocols that use asymmetric encryption (such as HTTPS/TLS/SSL) often utilize symmetric encryption once keys are exchanged. Adversaries may opt to use these encrypted mechanisms that are baked into a protocol.
Near-miss passage: T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol. Tactics: exfiltration. Description: Adversaries may steal data by exfiltrating it over a symmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Symmetric encryption algorithms are those that use shared or the same keys/secrets on each end of the channel. This requires an exchange or pre-arranged agreement/possession of the value used to encrypt and decrypt data. Network protocols that use asymmetric encryption often utilize symmetric encryption once keys are exchanged, but adversaries may opt to manually share keys and implement symmetric cryptographic algorithms (ex: RC4, AES) vice using mechanisms that are baked into a protocol. This may result in multiple layers of encryption (in protocols that are natively encrypted such as HTTPS) or encryption in protocols that not typically encrypted (such as HTTP or FTP).
Query: vulnerability: The Sandbox subsystem in Apple OS X before 10.11.1 allows local users to gain privileges via vectors involving NVRAM parameters.
Matching passage: CVE-2015-5945. CWE: CWE-20. CVSS: 7.199999809265137. The Sandbox subsystem in Apple OS X before 10.11.1 allows local users to gain privileges via vectors involving NVRAM parameters.
Near-miss passage: CVE-2015-8360. CWE: CWE-20. CVSS: 9.800000190734863. An unspecified resource in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 allows remote attackers to execute arbitrary Java code via serialized data to the JMS port.
Query: describe CVE-2015-6519
Matching passage: CVE-2015-6519. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in Arab Portal 3 allows remote attackers to execute arbitrary SQL commands via the showemail parameter in a signup action to members.php.
Near-miss passage: CVE-2015-7387. CWE: CWE-89. CVSS: 7.5. ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions and execute arbitrary SQL commands via an allowed query followed by a disallowed one in the query parameter to event/runQuery.do, as demonstrated by "SELECT 1;INSERT INTO." Fixed in Build 11200.
Query: Suspicious Scheduled Transfer execution detected on endpoint
Matching passage: T1029 Scheduled Transfer. Tactics: exfiltration. Description: Adversaries may schedule data exfiltration to be performed only at certain times of day or at certain intervals. This could be done to blend traffic patterns with normal activity or availability. When scheduled exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as [Exfiltration Over C2 Channel](https://attack.mitre.org/techniques/T1041) or [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048).
Near-miss passage: T1567 Exfiltration Over Web Service. Tactics: exfiltration. Description: Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services. Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Query: vulnerability: install.php in Web Reference Database (aka refbase) through 0.9.6 allows remote attackers to execute arbitrary commands via the adminPassword parameter, a different issue than CVE-
Matching passage: CVE-2015-6008. CWE: CWE-78. CVSS: 7.5. install.php in Web Reference Database (aka refbase) through 0.9.6 allows remote attackers to execute arbitrary commands via the adminPassword parameter, a different issue than CVE-2015-7381.
Near-miss passage: CVE-2015-4237. CWE: CWE-78. CVSS: 4.599999904632568. The CLI parser in Cisco NX-OS 4.1(2)E1(1), 6.2(11b), 6.2(12), 7.2(0)ZZ(99.1), 7.2(0)ZZ(99.3), and 9.1(1)SV1(3.1.8) on Nexus devices allows local users to execute arbitrary OS commands via crafted characters in a filename, aka Bug IDs CSCuv08491, CSCuv08443, CSCuv08480, CSCuv08448, CSCuu99291, CSCuv08434, and CSCuv08436.
Query: vulnerability: Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB, a different vuln
Matching passage: CVE-2015-0506. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB, a different vulnerability than CVE-2015-0508.
Near-miss passage: CVE-2015-0456. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle WebCenter Portal component in Oracle Fusion Middleware 11.1.1.8.0 allows remote attackers to affect integrity via unknown vectors related to Portlet Services.
Query: risk of Race condition in a certain Red Hat patch to the PRNG lock implementation in the ssleay_rand_bytes function in OpenSSL, as distributed in openssl-1.0.1e-25.el7 in Red Hat Enterpris
Matching passage: CVE-2015-3216. CWE: CWE-189. CVSS: 4.300000190734863. Race condition in a certain Red Hat patch to the PRNG lock implementation in the ssleay_rand_bytes function in OpenSSL, as distributed in openssl-1.0.1e-25.el7 in Red Hat Enterprise Linux (RHEL) 7 and other products, allows remote attackers to cause a denial of service (application crash) by establishing many TLS sessions to a multithreaded server, leading to use of a negative value for a certain length field.
Near-miss passage: CVE-2015-3808. CWE: CWE-189. CVSS: 7.800000190734863. The dissect_lbmr_pser function in epan/dissectors/packet-lbmr.c in the LBMR dissector in Wireshark 1.12.x before 1.12.5 does not reject a zero length, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
Query: common weakness: Incorrect Provision of Specified Functionality
Matching passage: CWE-684 Incorrect Provision of Specified Functionality. The code does not function according to its published specifications, potentially leading to incorrect usage.
Near-miss passage: CWE-640 Weak Password Recovery Mechanism for Forgotten Password. The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
Query: Sigma rule for Detects a PDQDeploy service installation which indicates that PDQDeploy was installed on the machines. PDQDeploy can be
Matching passage: Sigma rule: Detects a PDQDeploy service installation which indicates that PDQDeploy was installed on the machines. PDQDeploy can be. Logsource: windows / system. Rule: title: New PDQDeploy Service - Server Side id: ee9ca27c-9bd7-4cee-9b01-6e906be7cae3 status: test description: 'Detects a PDQDeploy service installation which indicates that PDQDeploy was installed on the machines. PDQDeploy can be abused by attackers to remotely install packages or execute commands on target machines ' references: - https://documentation.pdq.com/PDQDeploy/13.0.3.0/index.html?windows-services.htm author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-22 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 logsource: product: windows service: system detection: selection_root: Provider_Name: Service Control Manager EventID: 7045 selection_service: - ImagePath|contains: PDQDeployService.exe - ServiceName: - PDQDeploy - PDQ Deploy condition: all of selection_* falsepositives: - Legitimate use of the tool level: medium
Near-miss passage: Sigma rule: Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe". This is often used by attack. Logsource: windows / process_creation. Rule: title: Loaded Module Enumeration Via Tasklist.EXE id: 34275eb8-fa19-436b-b959-3d9ecd53fa1f status: test description: 'Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe". This is often used by attackers in order to find the specific process identifier (PID) that is using the DLL in question. In order to dump the process memory or perform other nefarious actions. ' references: - https://www.n00py.io/2021/05/dumping-plaintext-rdp-credentials-from-svchost-exe/ - https://pentestlab.blog/tag/svchost/ author: Swachchhanda Shrawan Poudel date: 2024-02-12 modified: 2024-03-13 tags: - attack.t1003 - attack.credential-access logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \tasklist.exe - OriginalFileName: tasklist.exe selection_flags: CommandLine|contains|windash: -m selection_module: CommandLine|contains: rdpcorets.dll condition: all of selection_* falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-0675
Matching passage: CVE-2015-0675. CWE: CWE-284. CVSS: 8.300000190734863. The failover ipsec implementation in Cisco Adaptive Security Appliance (ASA) Software 9.1 before 9.1(6), 9.2 before 9.2(3.3), and 9.3 before 9.3(3) does not properly validate failover communication messages, which allows remote attackers to reconfigure an ASA device, and consequently obtain administrative control, by sending crafted UDP packets over the local network to the failover interface, aka Bug ID CSCur21069.
Near-miss passage: CVE-2015-1115. CWE: CWE-284. CVSS: 4.400000095367432. The Telephony component in Apple iOS before 8.3 allows attackers to bypass a sandbox protection mechanism and access unintended telephone capabilities via a crafted app.