alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-2562
Matching passage: CVE-2015-2562. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in the Web-Dorado ECommerce WD (com_ecommercewd) component 1.2.5 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) search_category_id, (2) sort_order, or (3) filter_manufacturer_ids in a displayproducts action to index.php.
Near-miss passage: CVE-2015-6516. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in cygnux.org sysPass 1.0.9 and earlier allows remote authenticated users to execute arbitrary SQL commands via the search parameter to ajax/ajax_search.php.
Query: patch priority for CVE-2015-5210
Matching passage: CVE-2015-5210. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in Apache Ambari before 2.1.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the targetURI parameter.
Near-miss passage: CVE-2015-0545. CWE: UNKNOWN. CVSS: 10.0. EMC Unisphere for VMAX 8.x before 8.0.3.4 sets up the Java Debugging Wire Protocol (JDWP) service, which allows remote attackers to execute arbitrary code via unspecified vectors.
Query: rule covering Detect modification of TreatAs key to enable "rundll32.exe -sta" command
Matching passage: Sigma rule: Detect modification of TreatAs key to enable "rundll32.exe -sta" command. Logsource: windows / registry_set. Rule: title: COM Hijacking via TreatAs id: dc5c24af-6995-49b2-86eb-a9ff62199e82 status: test description: Detect modification of TreatAs key to enable "rundll32.exe -sta" command references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1546.015/T1546.015.md - https://www.youtube.com/watch?v=3gz1QmiMhss&t=1251s author: frack113 date: 2022-08-28 modified: 2025-07-11 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.015 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: TreatAs\(Default) filter_office: Image|startswith: C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ Image|endswith: \OfficeClickToRun.exe filter_office2: Image: - C:\Program Files\Microsoft Office\root\integration\integrator.exe - C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe filter_svchost: Image: C:\Windows\system32\svchost.exe filter_misexec: Image: - C:\Windows\system32\msiexec.exe - C:\Windows\SysWOW64\msiexec.exe condition: selection and not 1 of filter_* falsepositives: - Legitimate use level: medium
Near-miss passage: Sigma rule: Detects instances where an HTTP service on an OpenCanary node has had login attempt via Form POST.. Logsource: opencanary / application. Rule: title: OpenCanary - HTTP POST Login Attempt id: af1ac430-df6b-4b38-b976-0b52f07a0252 status: test description: 'Detects instances where an HTTP service on an OpenCanary node has had login attempt via Form POST. ' references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.initial-access - attack.t1190 logsource: category: application product: opencanary detection: selection: logtype: 3001 condition: selection falsepositives: - Unlikely level: high
Query: detection engineering for Relocate Malware
Matching passage: T1070.010 Relocate Malware. Tactics: stealth. Description: Once a payload is delivered, adversaries may reproduce copies of the same malware on the victim system to remove evidence of their presence and/or avoid defenses. Copying malware payloads to new locations may also be combined with [File Deletion](https://attack.mitre.org/techniques/T1070/004) to cleanup older artifacts. Relocating malware may be a part of many actions intended to evade defenses. For example, adversaries may copy and rename payloads to better blend into the local environment (i.e., [Match Legitimate Resource Name or Location](https://attack.mitre.org/techniques/T1036/005)).(Citation: DFIR Report Trickbot June 2023) Payloads may also be repositioned to target [File/Path Exclusions](https://attack.mitre.org/techniques/T1564/012) as well as specific locations associated with establishing [Persistence](https://attack.mitre.org/tactics/TA0003).(Citation: Latrodectus APR 2024) Relocating malicious payloads may also hinder defensive analysis, especially to separate these payloads from earlier events (such as [User Execution](https://attack.mitre.org/techniques/T1204) and [Phishing](https://attack.mitre.org/techniques/T1566)) that may have generated alerts or otherwise drawn attention from defenders. Moving payloads into target directories does not alter the Creation timestamp, thereby evading detection logic reliant on modifications to this artifact (i.e., [Timestomp](https://attack.mitre.org/techniques/T1070/006)).
Near-miss passage: T1070 Indicator Removal. Tactics: stealth. Description: Adversaries may selectively delete or modify artifacts generated to reduce indications of their presence and blend in with legitimate activity. Rather than broadly removing evidence, adversaries may target specific artifacts that appear anomalous or are likely to draw scrutiny, while leaving sufficient data intact to maintain the appearance of normal system behavior. Artifacts such as command histories, log entries, or file metadata may be altered in ways that align with expected user or system activity. Location, format, and type of artifact (such as command or login history) are often platform-specific, allowing adversaries to tailor modifications that minimize suspicion. These actions may not prevent detection entirely but can delay recognition of malicious activity or reduce the fidelity of alerts by making events appear benign or consistent with routine operations. Additionally, selectively removed or modified artifacts may still be recoverable through deeper forensic analysis, though their absence or alteration can complicate timeline reconstruction and attribution.
Query: describe CVE-2015-0218
Matching passage: CVE-2015-0218. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in auth/shibboleth/logout.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger a logout.
Near-miss passage: CVE-2015-4242. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Cisco FireSIGHT System Software 5.4.1.2 and 6.0.0 in FireSIGHT Management Center allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu94721.
Query: exploit The plural form formula in ngettext family of calls in php-gettext before 1.0.12 allows remote attackers to execute arbitrary code.
Matching passage: CVE-2015-8980. CWE: CWE-20. CVSS: 9.800000190734863. The plural form formula in ngettext family of calls in php-gettext before 1.0.12 allows remote attackers to execute arbitrary code.
Near-miss passage: CVE-2015-2140. CWE: CWE-20. CVSS: 6.5. HP Systems Insight Manager (SIM) before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors.
Query: describe CVE-2015-3843
Matching passage: CVE-2015-3843. CWE: CWE-264. CVSS: 9.300000190734863. The SIM Toolkit (STK) framework in Android before 5.1.1 LMY48I allows attackers to (1) intercept or (2) emulate unspecified Telephony STK SIM commands via an application that sends a crafted Intent, related to com/android/internal/telephony/cat/AppInterface.java, aka internal bug 21697171.
Near-miss passage: CVE-2015-7468. CWE: CWE-264. CVSS: 4.300000190734863. Report Builder in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to bypass intended restrictions on administrator tasks via unspecified vectors.
Query: playbook for alert: EDR alert: possible Clear Persistence (T1070.009)
Matching passage: Playbook for T1070.009 Clear Persistence. 1) Validate alert telemetry against T1070.009. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity. This may involve various actions, such as removing services, deleting executables, [Modify Registry](https://attack.mitre.org/techniques/T1112), [Plist File Modification](https://attack.mitre.org/techniques/T1647), or other methods of cleanup to prevent defender
Near-miss passage: Playbook for T1070 Indicator Removal. Different response path focused on stealth.
Query: describe CVE-2015-6056
Matching passage: CVE-2015-6056. CWE: CWE-119. CVSS: 9.300000190734863. The (1) JScript and (2) VBScript engines in Microsoft Internet Explorer 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-7090. CWE: CWE-119. CVSS: 6.599999904632568. Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7086, CVE-2015-7087, CVE-2015-7088, CVE-2015-7089, CVE-2015-7091, CVE-2015-7092, and CVE-2015-7117.
Query: CVE similar to CVE-2015-1374
Matching passage: CVE-2015-1374. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to hijack the authentication of administrators for requests that conduct (1) cross-site scripting (XSS), (2) SQL injection, or (3) unrestricted file upload attacks.
Near-miss passage: CVE-2015-3380. CWE: CWE-352. CVSS: 5.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the Feature Set module for Drupal allow remote attackers to hijack the authentication of administrators for requests that (1) enable or (2) disable a module via unspecified vectors.
Query: describe CVE-2015-9024
Matching passage: CVE-2015-9024. CWE: CWE-284. CVSS: 5.5. In all Android releases from CAF using the Linux kernel, some interfaces were improperly exposed to QTEE applications.
Near-miss passage: CVE-2015-3407. CWE: CWE-284. CVSS: 5.0. Module::Signature before 0.74 allows remote attackers to bypass signature verification for files via a signature file that does not list the files.
Query: CVE similar to CVE-2015-10017
Matching passage: CVE-2015-10017. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability has been found in HPI-Information-Systems ProLOD and classified as critical. This vulnerability affects unknown code. The manipulation of the argument this leads to sql injection. The name of the patch is 3f710905458d49c77530bd3cbcd8960457566b73. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217552.
Near-miss passage: CVE-2015-9395. CWE: CWE-89. CVSS: 8.800000190734863. The users-ultra plugin before 1.5.64 for WordPress has SQL Injection via an ajax action.
Query: containment actions for Suspicious Device Registration execution detected on endpoint
Matching passage: Playbook for T1098.005 Device Registration. 1) Validate alert telemetry against T1098.005. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: persistence, privilege escalation. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance. MFA systems, such as Duo or Okta, allow users to associate devices with their accounts in order to complete MFA requirements. An advers
Near-miss passage: Playbook for T1098.006 Additional Container Cluster Roles. Different response path focused on persistence, privilege escalation.
Query: vulnerability: Directory traversal vulnerability in the SFTP server in Huawei AR 120, 150, 160, 200, 500, 1200, 2200, 3200, and 3600 routers with software before V200R006SPH003 allows remote auth
Matching passage: CVE-2015-8228. CWE: CWE-22. CVSS: 4.0. Directory traversal vulnerability in the SFTP server in Huawei AR 120, 150, 160, 200, 500, 1200, 2200, 3200, and 3600 routers with software before V200R006SPH003 allows remote authenticated users to access arbitrary directories via unspecified vectors.
Near-miss passage: CVE-2015-5471. CWE: CWE-22. CVSS: 5.300000190734863. Absolute path traversal vulnerability in include/user/download.php in the Swim Team plugin 1.44.10777 for WordPress allows remote attackers to read arbitrary files via a full pathname in the file parameter.
Query: vulnerability: A certain backport in the TCP Fast Open implementation for the Linux kernel before 3.18 does not properly maintain a count value, which allow local users to cause a denial of servi
Matching passage: CVE-2015-3332. CWE: CWE-399. CVSS: 4.900000095367432. A certain backport in the TCP Fast Open implementation for the Linux kernel before 3.18 does not properly maintain a count value, which allow local users to cause a denial of service (system crash) via the Fast Open feature, as demonstrated by visiting the chrome://flags/#enable-tcp-fast-open URL when using certain 3.10.x through 3.16.x kernel builds, including longterm-maintenance releases and ckt (aka Canonical Kernel Team) builds.
Near-miss passage: CVE-2015-0731. CWE: CWE-399. CVSS: 6.099999904632568. The ISDN implementation in Cisco IOS 15.3S allows remote attackers to cause a denial of service (device reload) via malformed Q931 SETUP messages, aka Bug ID CSCut37890.
Query: CVE similar to CVE-2015-2382
Matching passage: CVE-2015-2382. CWE: CWE-200. CVSS: 2.0999999046325684. win32k.sys in the kernel-mode drivers in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to obtain sensitive information from kernel memory via a crafted application, aka "Win32k Information Disclosure Vulnerability," a different vulnerability than CVE-2015-2381.
Near-miss passage: CVE-2015-3236. CWE: CWE-200. CVSS: 5.0. cURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication credentials for a previous connection when reusing a reset (curl_easy_reset) connection handle to send a request to the same host name, which allows remote attackers to obtain sensitive information via unspecified vectors.
Query: detection rule: Detects weak passwords or often abused passwords (seen used by threat actors) via the CLI. An example would be a threat
Matching passage: Sigma rule: Detects weak passwords or often abused passwords (seen used by threat actors) via the CLI. An example would be a threat. Logsource: windows / process_creation. Rule: title: Weak or Abused Passwords In CLI id: 91edcfb1-2529-4ac2-9ecc-7617f895c7e4 status: test description: 'Detects weak passwords or often abused passwords (seen used by threat actors) via the CLI. An example would be a threat actor creating a new user via the net command and providing the password inline ' references: - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/espionage-asia-governments - https://thedfirreport.com/2022/09/26/bumblebee-round-two/ - https://www.microsoft.com/en-us/security/blog/2022/10/25/dev-0832-vice-society-opportunistic-ransomware-campaigns-impacting-us-education-sector/ - https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-14 modified: 2024-02-23 tags: - attack.execution - attack.stealth logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - '123456789' - 123123qwE - Asd123.aaaa - Decryptme - P@ssw0rd! - Pass8080 - password123 - test@202 condition: selection falsepositives: - Legitimate usage of the passwords by users via commandline (should be discouraged) - Other currently unknown false positives level: medium
Near-miss passage: Sigma rule: Detects when a GitHub repository is archived or unarchived, which may indicate unauthorized changes to repository status. Logsource: github / audit. Rule: title: GitHub Repository Archive Status Changed id: dca8991c-cb16-4128-abf8-6b11e5cd156f status: experimental description: 'Detects when a GitHub repository is archived or unarchived, which may indicate unauthorized changes to repository status. ' references: - https://docs.github.com/en/repositories/archiving-a-github-repository/archiving-repositories - https://www.sentinelone.com/blog/exploiting-repos-6-ways-threat-actors-abuse-github-other-devops-platforms - https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events author: Ivan Saakov date: 2025-10-18 tags: - attack.persistence - attack.impact - attack.defense-impairment logsource: product: github service: audit detection: selection: action: - repo.archived - repo.unarchived condition: selection falsepositives: - Archiving or unarchiving a repository is often legitimate. Investigate this action to determine if it was authorized. level: low
Query: vulnerability: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in 82Flex WEIPDCRM and classified as problematic. Affected by this issue is some unknown functionality. The manipulation l
Matching passage: CVE-2015-10007. CWE: CWE-79. CVSS: 6.099999904632568. ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in 82Flex WEIPDCRM and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross site scripting. The attack may be launched remotely. The name of the patch is 43bad79392332fa39e31b95268e76fbda9fec3a4. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217184. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Near-miss passage: CVE-2015-0737. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Cisco FireSIGHT System Software 5.3.1.1 allow remote attackers to inject arbitrary web script or HTML via a crafted (1) GET or (2) POST parameter, aka Bug ID CSCuu11099.
Query: patch priority for CVE-2015-3400
Matching passage: CVE-2015-3400. CWE: CWE-200. CVSS: 4.300000190734863. sharenfs 0.6.4, when built with commits bcdd594 and 7d08880 from the zfs repository, provides world readable access to the shared zfs file system, which might allow remote authenticated users to obtain sensitive information by reading shared files.
Near-miss passage: CVE-2015-0310. CWE: CWE-200. CVSS: 7.800000190734863. Adobe Flash Player before 13.0.0.262 and 14.x through 16.x before 16.0.0.287 on Windows and OS X and before 11.2.202.438 on Linux does not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism on Windows, and have an unspecified impact on other platforms, via unknown vectors, as exploited in the wild in January 2015.
Query: patch priority for CVE-2015-1732
Matching passage: CVE-2015-1732. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1742, CVE-2015-1747, CVE-2015-1750, and CVE-2015-1753.
Near-miss passage: CVE-2015-1069. CWE: CWE-399. CVSS: 6.800000190734863. WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Query: exploit The REST interface in Cisco Unified Communications Manager IM and Presence Service 11.5(1) allows remote attackers to cause a denial of service (SIP proxy service restart) via a cr
Matching passage: CVE-2015-6310. CWE: CWE-399. CVSS: 5.0. The REST interface in Cisco Unified Communications Manager IM and Presence Service 11.5(1) allows remote attackers to cause a denial of service (SIP proxy service restart) via a crafted HTTP request, aka Bug ID CSCuw31632.
Near-miss passage: CVE-2015-4240. CWE: CWE-399. CVSS: 5.0. Cisco IP Communicator 8.6(4) allows remote attackers to cause a denial of service (service outage) via an unspecified URL in a GET request, aka Bug ID CSCuu37656.
Query: describe CVE-2015-3144
Matching passage: CVE-2015-3144. CWE: CWE-119. CVSS: 9.0. The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name, as demonstrated by "http://:80" and ":80."
Near-miss passage: CVE-2015-8764. CWE: CWE-119. CVSS: 8.100000381469727. Off-by-one error in the EAP-PWD module in FreeRADIUS 3.0 through 3.0.8, which triggers a buffer overflow.
Query: detect Detects suspicious PowerShell download command in logs
Matching passage: Sigma rule: Detects suspicious PowerShell download command. Logsource: windows / ps_module. Rule: title: Suspicious PowerShell Download - PoshModule id: de41232e-12e8-49fa-86bc-c05c7e722df9 related: - id: 65531a81-a694-4e31-ae04-f8ba5bc33759 type: derived status: test description: Detects suspicious PowerShell download command references: - https://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-8.0 - https://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-8.0 author: Florian Roth (Nextron Systems) date: 2017-03-05 modified: 2023-01-20 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_webclient_: ContextInfo|contains: System.Net.WebClient selection_function: ContextInfo|contains: - .DownloadFile( - .DownloadString( condition: all of selection_* falsepositives: - PowerShell scripts that download content from the Internet level: medium
Near-miss passage: Sigma rule: Detects when an application Sign-on Policy is modified or deleted.. Logsource: okta / okta. Rule: title: Okta Application Sign-On Policy Modified or Deleted id: 8f668cc4-c18e-45fe-ad00-624a981cf88a status: test description: Detects when an application Sign-on Policy is modified or deleted. references: - https://developer.okta.com/docs/reference/api/system-log/ - https://developer.okta.com/docs/reference/api/event-types/ author: Austin Songer @austinsonger date: 2021-09-12 modified: 2026-04-27 tags: - attack.impact logsource: product: okta service: okta detection: selection: eventType: - application.policy.sign_on.update - application.policy.sign_on.rule.delete condition: selection falsepositives: - Unknown level: medium