alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-2766
Matching passage: CVE-2015-2766. CWE: CWE-255. CVSS: 5.0. The Personal Email Manager (PEM) in Websense TRITON AP-EMAIL before 8.0.0 allows attackers to have unspecified impact via a brute force attack.
Near-miss passage: CVE-2015-6524. CWE: CWE-255. CVSS: 5.0. The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack. NOTE: this identifier was SPLIT from CVE-2014-3612 per ADT2 due to different vulnerability types.
Query: detection rule: Detects image load events with revoked certificates by code integrity.
Matching passage: Sigma rule: Detects image load events with revoked certificates by code integrity.. Logsource: windows / codeintegrity-operational. Rule: title: CodeIntegrity - Revoked Image Loaded id: 881b7725-47cc-4055-8000-425823344c59 status: test description: Detects image load events with revoked certificates by code integrity. references: - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-06 tags: - attack.privilege-escalation logsource: product: windows service: codeintegrity-operational detection: selection: EventID: - 3032 - 3035 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects execution of JavaScript or JSC files using NodeJs binary node.exe, that could be potentially suspicious. Node.js. Logsource: windows / process_creation. Rule: title: NodeJS Execution of JavaScript File id: ba3874b9-0fae-465f-836c-eb5d071a1789 status: experimental description: 'Detects execution of JavaScript or JSC files using NodeJs binary node.exe, that could be potentially suspicious. Node.js is a popular open-source JavaScript runtime that runs code outside browsers and is widely used for both frontend and backend development. Adversaries have been observed abusing Node.js to disguise malware as legitimate processes, evade security defenses, and maintain persistence within target systems. Because Node.js is commonly used, this rule may generate false positives in some environments. However, if such activity is unusual in your environment, it is highly suspicious and warrants immediate investigation. ' references: - https://www.microsoft.com/en-us/security/blog/2025/04/15/threat-actors-misuse-node-js-to-deliver-malware-and-other-malicious-payloads/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-04-21 tags: - attack.execution - attack.t1059.007 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \node.exe - OriginalFileName: node.exe - Product: Node.js selection_cmd: CommandLine|contains: .js condition: all of selection_* falsepositives: - Legitimate use of node.exe to execute JavaScript or JSC files on your environment level: low
Query: detect Detects modifications to the Windows Defender configuration settings using PowerShell to add exclusions in logs
Matching passage: Sigma rule: Detects modifications to the Windows Defender configuration settings using PowerShell to add exclusions. Logsource: windows / ps_script. Rule: title: Windows Defender Exclusions Added - PowerShell id: c1344fa2-323b-4d2e-9176-84b4d4821c88 related: - id: 17769c90-230e-488b-a463-e05c08e9d48f type: similar status: test description: Detects modifications to the Windows Defender configuration settings using PowerShell to add exclusions references: - https://www.elastic.co/guide/en/security/current/windows-defender-exclusions-added-via-powershell.html author: Tim Rauch, Elastic (idea) date: 2022-09-16 modified: 2022-11-26 tags: - attack.defense-impairment - attack.t1685 - attack.execution - attack.t1059 logsource: category: ps_script product: windows definition: 'Requirements: Script Block Logging must be enabled' detection: selection_args_exc: ScriptBlockText|contains: - ' -ExclusionPath ' - ' -ExclusionExtension ' - ' -ExclusionProcess ' - ' -ExclusionIpAddress ' selection_args_pref: ScriptBlockText|contains: - 'Add-MpPreference ' - 'Set-MpPreference ' condition: all of selection* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects suspicious sysprep process start with AppData folder as target (as used by Trojan Syndicasec in Thrip report by. Logsource: windows / process_creation. Rule: title: Sysprep on AppData Folder id: d5b9ae7a-e6fc-405e-80ff-2ff9dcc64e7e status: test description: Detects suspicious sysprep process start with AppData folder as target (as used by Trojan Syndicasec in Thrip report by Symantec) references: - https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets - https://app.any.run/tasks/61a296bb-81ad-4fee-955f-3b399f4aaf4b author: Florian Roth (Nextron Systems) date: 2018-06-22 modified: 2021-11-27 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection: Image|endswith: \sysprep.exe CommandLine|contains: \AppData\ condition: selection falsepositives: - False positives depend on scripts and administrative tools used in the monitored environment level: medium
Query: exploit The do_setup_env function in session.c in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM is configured to read .pam_environment files in user home dire
Matching passage: CVE-2015-8325. CWE: CWE-264. CVSS: 7.800000190734863. The do_setup_env function in session.c in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM is configured to read .pam_environment files in user home directories, allows local users to gain privileges by triggering a crafted environment for the /bin/login program, as demonstrated by an LD_PRELOAD environment variable.
Near-miss passage: CVE-2015-6133. CWE: CWE-264. CVSS: 7.199999809265137. Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandle library loading, which allows local users to gain privileges via a crafted application, aka "Windows Library Loading Remote Code Execution Vulnerability."
Query: campaign using Shell History
Matching passage: T1552.003 Shell History. Tactics: credential access. Description: Adversaries may search the command history on compromised systems for insecurely stored credentials. On Linux and macOS systems, shells such as Bash and Zsh keep track of the commands users type on the command-line with the "history" utility. Once a user logs out, the history is flushed to the user's history file. For each user, this file resides at the same location: for example, `~/.bash_history` or `~/.zsh_history`. Typically, these files keeps track of the user's last 1000 commands. On Windows, PowerShell has both a command history that is wiped after the session ends, and one that contains commands used in all sessions and is persistent. The default location for persistent history can be found in `%userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt`, but command history can also be accessed with `Get-History`. Command Prompt (CMD) on Windows does not have persistent history.(Citation: Microsoft about_History)(Citation: Medium) Users often type usernames and passwords on the command-line as parameters to programs, which then get saved to this file when they log out. Adversaries can abuse this by looking through the file for potential credentials.(Citation: External to DA, the OS X Way)
Near-miss passage: T1552.001 Credentials In Files. Tactics: credential access. Description: Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords. It is possible to extract passwords from backups or saved virtual machines through [OS Credential Dumping](https://attack.mitre.org/techniques/T1003).(Citation: CG 2014) Passwords may also be obtained from Group Policy Preferences stored on the Windows Domain Controller.(Citation: SRD GPP) In cloud and/or containerized environments, authenticated user and service account credentials are often stored in local configuration and credential files.(Citation: Unit 42 Hildegard Malware) They may also be found as parameters to deployment commands in container logs.(Citation: Unit 42 Unsecured Docker Daemons) In some cases, these files can be copied and reused on another machine or the contents can be read and then used to authenticate without needing to copy any files.(Citation: Specter Ops - Cloud Credential Storage)
Query: alert when Detects when someone is adding or removing applications or folders from exploit guard "ProtectedFolders" or "AllowedAppl
Matching passage: Sigma rule: Detects when someone is adding or removing applications or folders from exploit guard "ProtectedFolders" or "AllowedAppl. Logsource: windows / windefend. Rule: title: Windows Defender Exploit Guard Tamper id: a3ab73f1-bd46-4319-8f06-4b20d0617886 status: test description: 'Detects when someone is adding or removing applications or folders from exploit guard "ProtectedFolders" or "AllowedApplications" ' references: - https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/windows-10-controlled-folder-access-event-search/ba-p/2326088 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-05 modified: 2022-12-06 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: windefend detection: allowed_apps_key: EventID: 5007 NewValue|contains: \Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\AllowedApplications\ allowed_apps_path: NewValue|contains: - \Users\Public\ - \AppData\Local\Temp\ - \Desktop\ - \PerfLogs\ - \Windows\Temp\ protected_folders: EventID: 5007 OldValue|contains: \Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\ProtectedFolders\ condition: all of allowed_apps* or protected_folders falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Remove the Zone.Identifier alternate data stream which identifies the file as downloaded from the internet.. Logsource: windows / ps_script. Rule: title: Suspicious Unblock-File id: 5947497f-1aa4-41dd-9693-c9848d58727d status: test description: Remove the Zone.Identifier alternate data stream which identifies the file as downloaded from the internet. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.005/T1553.005.md#atomic-test-3---remove-the-zoneidentifier-alternate-data-stream - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/unblock-file?view=powershell-7.2 author: frack113 date: 2022-02-01 tags: - attack.defense-impairment - attack.t1553.005 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - 'Unblock-File ' - '-Path ' condition: selection falsepositives: - Legitimate PowerShell scripts level: medium
Query: vulnerability: The default configuration in Apache Cassandra 1.2.0 through 1.2.19, 2.0.0 through 2.0.13, and 2.1.0 through 2.1.3 binds an unauthenticated JMX/RMI interface to all network interfac
Matching passage: CVE-2015-0225. CWE: CWE-77. CVSS: 7.5. The default configuration in Apache Cassandra 1.2.0 through 1.2.19, 2.0.0 through 2.0.13, and 2.1.0 through 2.1.3 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request.
Near-miss passage: CVE-2015-1949. CWE: CWE-77. CVSS: 10.0. The server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to execute arbitrary commands with SYSTEM privileges via unspecified vectors.
Query: risk of Cross-site scripting (XSS) vulnerability in the Node basket module for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Matching passage: CVE-2015-3381. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Node basket module for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-2934. CWE: CWE-79. CVSS: 4.300000190734863. MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 does not properly handle when the Zend interpreter xml_parse function does not expand entities, which allows remote attackers to inject arbitrary web script or HTML via a crafted SVG file.
Query: patch priority for CVE-2015-8084
Matching passage: CVE-2015-8084. CWE: CWE-20. CVSS: 7.099999904632568. Huawei USG5500, USG2100, USG2200, and USG5100 unified security gateways with software before V300R001C10SPC600, when "DHCP Snooping" is enabled and either "option82 insert" or "option82 rebuild" is enabled on an interface, allow remote attackers to cause a denial of service (reboot) via crafted DHCP packets.
Near-miss passage: CVE-2015-2514. CWE: CWE-20. CVSS: 9.300000190734863. Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to execute arbitrary code via a crafted .jnt file, aka "Windows Journal RCE Vulnerability," a different vulnerability than CVE-2015-2513 and CVE-2015-2530.
Query: vulnerability: Cross-site request forgery (CSRF) vulnerability in D-Link DIR-815 devices with firmware before 2.07.B01 allows remote attackers to hijack the authentication of arbitrary users for 
Matching passage: CVE-2015-0151. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in D-Link DIR-815 devices with firmware before 2.07.B01 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Near-miss passage: CVE-2015-1581. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the Mobile Domain plugin 1.5.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or conduct cross-site scripting (XSS) attacks via the (2) domain, (3) text, (4) font, (5) fontcolor, (6) color, or (7) padding parameter in an add-domain action in the mobile-domain page to wp-admin/options-general.php.
Query: patch priority for CVE-2015-7829
Matching passage: CVE-2015-7829. CWE: CWE-119. CVSS: 1.899999976158142. Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows mishandle junctions in the Synchronizer directory, which allows attackers to delete arbitrary files via Adobe Collaboration Sync, a related issue to CVE-2015-2428.
Near-miss passage: CVE-2015-0307. CWE: CWE-119. CVSS: 8.5. Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allow remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via unspecified vectors.
Query: detection rule: Identifies when a Firewall Policy is Modified or Deleted.
Matching passage: Sigma rule: Identifies when a Firewall Policy is Modified or Deleted.. Logsource: azure / activitylogs. Rule: title: Azure Network Firewall Policy Modified or Deleted id: 83c17918-746e-4bd9-920b-8e098bf88c23 status: test description: Identifies when a Firewall Policy is Modified or Deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer @austinsonger date: 2021-09-02 modified: 2022-08-23 tags: - attack.impact - attack.defense-impairment - attack.t1686.001 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.NETWORK/FIREWALLPOLICIES/WRITE - MICROSOFT.NETWORK/FIREWALLPOLICIES/JOIN/ACTION - MICROSOFT.NETWORK/FIREWALLPOLICIES/CERTIFICATES/ACTION - MICROSOFT.NETWORK/FIREWALLPOLICIES/DELETE condition: selection falsepositives: - Firewall Policy being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Firewall Policy modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects creation of the PSEXEC key file. Which is created anytime a PsExec command is executed. It gets written to the f. Logsource: windows / file_event. Rule: title: PSEXEC Remote Execution File Artefact id: 304afd73-55a5-4bb9-8c21-0b1fc84ea9e4 status: test description: Detects creation of the PSEXEC key file. Which is created anytime a PsExec command is executed. It gets written to the file system and will be recorded in the USN Journal on the target system references: - https://aboutdfir.com/the-key-to-identify-psexec/ - https://twitter.com/davisrichardg/status/1616518800584704028 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-21 modified: 2023-02-23 tags: - attack.lateral-movement - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1136.002 - attack.t1543.003 - attack.t1570 - attack.s0029 logsource: category: file_event product: windows detection: selection: TargetFilename|startswith: C:\Windows\PSEXEC- TargetFilename|endswith: .key condition: selection falsepositives: - Unlikely level: high
Query: exploit IBM WebSphere Portal 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF17, and 8.5.0 before CF06 allows remote attackers to obtain sensitive Java Content Repository (JCR) informat
Matching passage: CVE-2015-1887. CWE: CWE-200. CVSS: 5.0. IBM WebSphere Portal 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF17, and 8.5.0 before CF06 allows remote attackers to obtain sensitive Java Content Repository (JCR) information via a crafted request.
Near-miss passage: CVE-2015-5859. CWE: CWE-200. CVSS: 4.300000190734863. The CFNetwork HTTPProtocol component in Apple iOS before 9 and OS X before 10.11 does not properly recognize the HSTS preload list during a Safari private-browsing session, which makes it easier for remote attackers to obtain sensitive information by sniffing the network.
Query: weakness Struts: Unvalidated Action Form
Matching passage: CWE-108 Struts: Unvalidated Action Form. Every Action Form must have a corresponding validation form.
Near-miss passage: CWE-472 External Control of Assumed-Immutable Web Parameter. The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.
Query: describe CVE-2015-2637
Matching passage: CVE-2015-2637. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JavaFX 2.2.80; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via unknown vectors related to 2D.
Near-miss passage: CVE-2015-0388. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Portal Framework, a different vulnerability than CVE-2015-0417.
Query: risk of end_pattern (called from internal_fnmatch) in the GNU C Library (aka glibc or libc6) before 2.22 might allow context-dependent attackers to cause a denial of service (application c
Matching passage: CVE-2015-20109. CWE: CWE-120. CVSS: 5.5. end_pattern (called from internal_fnmatch) in the GNU C Library (aka glibc or libc6) before 2.22 might allow context-dependent attackers to cause a denial of service (application crash), as demonstrated by use of the fnmatch library function with the **(!() pattern. NOTE: this is not the same as CVE-2015-8984; also, some Linux distributions have fixed CVE-2015-8984 but have not fixed this additional fnmatch issue.
Near-miss passage: CVE-2015-5093. CWE: CWE-120. CVSS: 10.0. Buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.
Query: intelligence brief on T1140
Matching passage: T1140 Deobfuscate/Decode Files or Information. Tactics: stealth. Description: Adversaries may use [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system. One such example is the use of [certutil](https://attack.mitre.org/software/S0160) to decode a remote access tool portable executable file that has been hidden inside a certificate file.(Citation: Malwarebytes Targeted Attack against Saudi Arabia) Another example is using the Windows <code>copy /b</code> or <code>type</code> command to reassemble binary fragments into a malicious payload.(Citation: Carbon Black Obfuscation Sept 2016)(Citation: Sentinel One Tainted Love 2023) Sometimes a user's action may be required to open it for deobfuscation or decryption as part of [User Execution](https://attack.mitre.org/techniques/T1204). The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.(Citation: Volexity PowerDuke November 2016)
Near-miss passage: T1535 Unused/Unsupported Cloud Regions. Tactics: stealth. Description: Adversaries may create cloud instances in unused geographic service regions in order to evade detection. Access is usually obtained through compromising accounts used to manage cloud infrastructure. Cloud service providers often provide infrastructure throughout the world in order to improve performance, provide redundancy, and allow customers to meet compliance requirements. Oftentimes, a customer will only use a subset of the available regions and may not actively monitor other regions. If an adversary creates resources in an unused region, they may be able to operate undetected. A variation on this behavior takes advantage of differences in functionality across cloud regions. An adversary could utilize regions which do not support advanced detection services in order to avoid detection of their activity. An example of adversary use of unused AWS regions is to mine cryptocurrency through [Resource Hijacking](https://attack.mitre.org/techniques/T1496), which can cost organizations substantial amounts of money over time depending on the processing power used.(Citation: CloudSploit - Unused AWS Regions)
Query: describe CVE-2015-6908
Matching passage: CVE-2015-6908. CWE: CWE-20. CVSS: 5.0. The ber_get_next function in libraries/liblber/io.c in OpenLDAP 2.4.42 and earlier allows remote attackers to cause a denial of service (reachable assertion and application crash) via crafted BER data, as demonstrated by an attack against slapd.
Near-miss passage: CVE-2015-9046. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in LTE where an assertion can be reached due to an improper bound on the size of a frequency list.