cron utility to perform task scheduling for initial or recurr",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may acquire information about vulnerabilities that can be used during targeting. A vulne",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to vict",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may exploit software vulnerabilities that can cause an application or system to crash an",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may leverage Microsoft Office-based applications for persistence between startups. Micro",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. Instal",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may send spearphishing messages with a malicious link to elicit sensitive information th",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may use Valid Accounts to log into remote machines using Secure Shell (SSH). The adversa",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "An adversary may add additional roles or permissions to an adversary-controlled cloud account to mai",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access t",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may attempt to make a payload difficult to analyze by removing symbols, strings, and oth",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may use the Windows Component Object Model (COM) for local code execution. COM is an int",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate pr",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Once established within a system or network, an adversary may use automated techniques for collectin",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may collect data stored in the clipboard from users copying information within or betwee",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may gather credentials from the proc filesystem or `/proc`. The proc filesystem is a pse",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may buy, lease, or rent a network of compromised systems\u00a0that can be used during targeti",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may acquire user credentials from third-party password managers. Password managers are a",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may modify file attributes and subvert Gatekeeper functionality to evade user prompts an",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse ESXi administration services to execute commands on guest machines hosted with",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may prepare an operational environment to infect systems that visit a website over the n",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may try to gather information about registered local system services. Adversaries may ob",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may passively sniff network traffic to capture information about an environment, includi",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Cod",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may access data from cloud storage.\n\nMany IaaS providers offer solutions for online data",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may modify systems in order to manipulate the data as it is accessed and displayed to an",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Wi",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may look for folders and drives shared on remote systems as a means of identifying sourc",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may attempt to gather information about attached peripheral devices and components conne",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "An adversary may attempt to evade process tree-based analysis by modifying executed malware's parent",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may gather information about the victim's network topology that can be used during targe",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may create self-signed code signing certificates that can be used during targeting. Code",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs)",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse Microsoft transport agents to establish persistent access to systems. Microsof",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "An adversary may attempt to get detailed information about the operating system and hardware, includ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may communicate using OSI application layer protocols to avoid detection/network filteri",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may execute their own malicious payloads by hijacking how the .NET `AppDomainManager` lo",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may stage data collected from multiple systems in a central location or directory on one",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "An adversary may add additional roles or permissions to an adversary-controlled user or service acco",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the comma",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may gather information about the victim's network trust dependencies that can be used du",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may attempt to cause a denial of service (DoS) by reflecting a high-volume of network tr",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may register malicious password filter dynamic link libraries (DLLs) into the authentica",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse components of Terminal Services to enable persistent access to systems. Micros",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse AppleScript for execution. AppleScript is a macOS scripting language designed ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse software extensions to establish persistent access to victim systems. Software",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may target the different network services provided by systems to conduct a denial of ser",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may manipulate hardware components in products prior to receipt by a final consumer for ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may interact with the native OS application programming interface (API) to execute behav",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may attempt to steal Kerberos tickets stored in credential cache files (or ccache). Thes",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may clear or remove evidence of malicious network connections in order to clean up trace",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may reveal credentials of accounts that have disabled Kerberos preauthentication by Pass",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may compromise third-party Virtual Private Servers (VPSs) that can be used during target",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may execute commands and perform malicious tasks using AutoIT and AutoHotKey automation ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may reduce the level of effort required to decrypt data transmitted over the network by ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "In addition to clearing system logs, an adversary may clear the command history of a compromised acc",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse utilities that allow for command execution to bypass security restrictions tha",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may search local system sources, such as file systems, configuration files, local databa",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis.",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse Microsoft Outlook rules to obtain persistence on a compromised system. Outlook",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may maliciously modify components of a victim environment in order to hinder or disable ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may compromise cloud accounts that can be used during targeting. Adversaries can use com",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may compromise email accounts that can be used during targeting. Adversaries can use com",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "An adversary may add additional local or domain groups to an adversary-controlled account to maintai",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may upload malware to third-party or adversary controlled infrastructure to make it acce",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consu",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially acce",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets t",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may search for common password storage locations to obtain user credentials. Passwords a",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than thei",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "An adversary may use legitimate remote access tools to establish an interactive command and control ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may acquire domains that can be used during targeting. Domain names are the human readab",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party li",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may inject malicious code into hijacked processes in order to evade process-based defens",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may establish persistence and/or elevate privileges by executing malicious content trigg",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may search compromised systems to find and obtain insecurely stored credentials. These c",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistenc",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may modify mail and mail application data to remove evidence of their activity. Email ap",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may use a Login Hook to establish persistence executed upon user logon. A login hook is ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may gain access and continuously communicate with victims by injecting malicious content",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may inject code into processes in order to evade process-based defenses as well as possi",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may exfiltrate data to a webhook endpoint rather than over their primary command and con",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may use traffic signaling to hide open ports or other malicious functionality used for p",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may leverage Valid Accounts to log directly into accessible cloud hosted compute infrast",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious co",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may modify file time attributes to hide new files or changes to existing files. Timestom",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may host seemingly genuine Wi-Fi access points to deceive users into connecting to malic",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may reflectively load code into a process in order to conceal the execution of malicious",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may constrain execution or actions based on the presence of a mutex associated with malw",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may evade defensive mechanisms by executing commands that hide from process interrupt si",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may break out of a container or virtualized environment to gain access to the underlying",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may attempt to get a listing of backup software or configurations that are installed on ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may create or modify shortcuts that can execute a program during system boot or user log",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may attempt to get a listing of open application windows. Window listings could convey i",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse systemctl to execute commands or programs. Systemctl is the primary interface ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may explicitly employ a known encryption algorithm to conceal command and control traffi",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dum",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may employ various time-based methods to detect virtualization and analysis environments",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse CMSTP to proxy execution of malicious code. The Microsoft Connection Manager P",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may hijack a legitimate user's SSH session to move laterally within an environment. Secu",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may disable Windows event logging to limit data that can be leveraged for detections and",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may schedule data exfiltration to be performed only at certain times of day or at certai",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may use Valid Accounts to interact with a remote network share using Server Message Bloc",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may implant cloud or container images with malicious code to establish persistence after",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may tunnel network communications to and from a victim system within a separate protocol",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Pane",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may bridge network boundaries by modifying a network device\u2019s Network Address Translatio",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may upload tools to third-party or adversary controlled infrastructure to make it access",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse security support providers (SSPs) to execute DLLs when the system boots. Windo",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may modify a process's in-memory arguments to change its name in order to appear as a le",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, an",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may search private data from threat intelligence vendors for information that can be use",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may attempt to exfiltrate data over a different network medium than the command and cont",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may access network configuration files to collect sensitive data about the device and th",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may gather information about the victim's identity that can be used during targeting. In",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may disable or modify system firewalls in order to bypass controls limiting network usag",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing t",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may tamper with SIP and trust provider components to mislead the operating system and ap",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may take advantage of security vulnerabilities and inherent functionality in browser sof",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may use Valid Accounts to log into a service that accepts remote connections, such as te",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may communicate using application layer protocols associated with electronic mail delive",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may patch, modify, or otherwise backdoor cloud authentication processes that are tied to",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may scan victims for vulnerabilities that can be used during targeting. Vulnerability sc",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse cloud APIs to execute malicious commands. APIs available in cloud environments",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may search freely available technical databases for information about victims that can b",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse components of the Electron framework to execute malicious code. The Electron f",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may disable or modify the Linux audit system to hide malicious activity and avoid detect",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may register a rogue Domain Controller to enable manipulation of Active Directory data. ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may modify code signing policies to enable execution of unsigned or self-signed code. Co",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may deploy a container into an environment to facilitate execution or evade defenses. In",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid i",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "An adversary may attempt to discover infrastructure and resources that are available within an infra",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may acquire credentials from web browsers by reading files specific to the target browse",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may execute their own malicious payloads by hijacking the search order used to load othe",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may modify visual content available internally or externally to an enterprise network, t",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may create cloud instances in unused geographic service regions in order to evade detect",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may redirect network traffic to adversary-owned systems by spoofing Dynamic Host Configu",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may take control of preexisting sessions with remote services to move laterally in an en",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse bind mounts on file structures to hide their activity and artifacts from nativ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may use binary padding to add junk data and change the on-disk representation of malware",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may backdoor web servers with web shells to establish persistent access to systems. A We",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access cont",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may enumerate information about browsers to learn more about compromised environments. D",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may search for private key certificate files on compromised systems for insecurely store",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may buy, lease, rent, or obtain physical servers\u00a0that can be used during targeting. Use ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channe",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Acce",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may establish persistence by executing malicious content triggered by an interrupt signa",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may create a local account to maintain access to victim systems. Local accounts are thos",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Threat actors may seek information/indicators from closed or open threat intelligence sources gather",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may simulate keystrokes on a victim\u2019s computer by various means to perform any type of a",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries can perform command and control between compromised hosts on potentially disconnected ne",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs ar",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may create email accounts that can be used during targeting. Adversaries can use account",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "By responding to LLMNR/NBT-NS network traffic, adversaries may spoof an authoritative source for nam",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs)",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may attempt to access credential material stored in the process memory of the Local Secu",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse an integrated development environment (IDE) extension to establish persistent ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may execute active reconnaissance scans to gather information that can be used during ta",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may use junk code / dead code to obfuscate a malware\u2019s functionality. Junk code is code ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level pe",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may create a new process with an existing token to escalate privileges and bypass access",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "An adversary may abuse configurations where an application has the setuid or setgid bits set in orde",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in. W",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may use Valid Accounts to interact with remote machines by taking advantage of Distribut",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may use a single or small list of commonly used passwords against many different account",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may use an external proxy to act as an intermediary for network communications to a comm",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may install code on externally facing portals, such as a VPN login page, to capture and ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may gather email addresses that can be used during targeting. Even if internal instances",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may use voice communications to elicit sensitive information that can be used during tar",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may attempt to access cached domain credentials used to allow authentication to occur in",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may modify the SSH authorized_keys file to maintain persistence on a victim",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "An adversary may attempt to enumerate running virtual machines (VMs) after gaining access to a host ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may gather information about the victim's network security appliances that can be used d",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may establish persistence and/or elevate privileges by executing malicious content trigg",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads. Odbcconf.exe is a Windo",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may use search engines to collect information about victims that can be used during targ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may gather information about the victim's business relationships that can be used during",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse permission configurations that allow them to gain temporarily elevated access ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or a",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may inject malicious code into process via process doppelg\u00e4nging in order to evade proce",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may look for details about the network configuration and settings, such as IP and/or MAC",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "An adversary may delete a cloud instance after they have performed malicious activities in an attemp",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may search public code repositories for information about victims that can be used durin",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may execute their own malicious payloads by hijacking the binaries used by an installer.",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may establish persistence and/or elevate privileges by executing malicious content trigg",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may leverage the network bandwidth resources of co-opted systems to complete resource-in",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a syste",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may use a connection proxy to direct network traffic between systems or act as an interm",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. The",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may rely on a user installing a malicious library to facilitate execution. Threat actors",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "An adversary may attempt to block indicators or events typically captured by sensors from being gath",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may create a domain account to maintain access to victim systems. Domain accounts are th",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse extended attributes (xattrs) on macOS and Linux to hide their malicious data i",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may gather employee names that can be used during targeting. Employee names be used to d",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may manipulate continuous integration / continuous development (CI/CD) processes by inje",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may attempt to gather information on domain trust relationships that may be used to iden",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries who have the KRBTGT account password hash may forge Kerberos ticket-granting tickets (TG",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processin",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may gather information about the victim's client configurations that can be used during ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limi",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse Integrated Development Environment (IDE) software with remote development feat",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a stri",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may buy, steal, or download malware that can be used during targeting. Malicious softwar",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of s",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may modify component firmware to persist on systems. Some adversaries may employ sophist",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may delete or modify artifacts generated within systems to remove evidence of their pres",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may steal data by exfiltrating it over a symmetrically encrypted network protocol other ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse Microsoft Office templates to obtain persistence on a compromised system. Micr",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may rent Virtual Private Servers (VPSs)\u00a0that can be used during targeting. There exist a",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may leverage Confluence repositories to mine valuable information. Often found in develo",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may \u201cpass the ticket\u201d using stolen Kerberos tickets to move laterally within an environm",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse a container administration service to execute commands within a container. A c",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may enumerate files and directories or may search in specific locations of a host or net",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may dynamically establish connections to command and control infrastructure to evade com",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may inject malicious code into processes via the asynchronous procedure call (APC) queue",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised i",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may modify property list files (plist files) to enable other malicious activity, while a",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may use `JamPlus` to proxy the execution of a malicious script. `JamPlus` is a build uti",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may establish persistence and/or elevate privileges by executing malicious content trigg",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may setup email forwarding rules to collect sensitive information. Adversaries may abuse",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may stage collected data in a central location or directory prior to Exfiltration. Data ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may steal or forge certificates used for authentication to access remote systems or reso",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may register a device to an adversary-controlled account. Devices may be registered in a",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may attempt to get a listing of network connections to or from the compromised system th",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may compromise third-party infrastructure that can be used during targeting. Infrastruct",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse specific file formats to subvert Mark-of-the-Web (MOTW) controls. In Windows, ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries disable a network device\u2019s dedicated hardware encryption, which may enable them to lever",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system. During t",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may build a container image directly on a host to bypass defenses that monitor for the r",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may inject portable executables (PE) into processes in order to evade process-based defe",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse verclsid.exe to proxy execution of malicious code. Verclsid.exe is known as th",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may compromise accounts with services that can be used during targeting. For operations ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse launchctl to execute commands or programs. Launchctl interfaces with launchd, ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may compromise numerous third-party systems to form a botnet\u00a0that can be used during tar",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to ex",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may search the command history on compromised systems for insecurely stored credentials.",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries can provide malicious content to an XPC service daemon for local code execution. macOS u",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may employ various means to detect and avoid virtualization and analysis environments. T",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may use an existing, legitimate external Web service as a means for relaying data to/fro",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may search local file systems and remote file shares for files containing insecurely sto",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may perform calculations on addresses returned in DNS results to determine which port an",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScrip",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may add login items to execute upon user login to gain persistence or escalate privilege",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting.",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may put in place resources that are referenced by a link that can be used during targeti",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may create multiple stages for command and control that are employed under different con",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may steal monetary resources from targets through extortion, social engineering, technic",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may use execution guardrails to constrain execution or actions based on adversary suppli",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may enumerate objects in cloud storage infrastructure. Adversaries may use this informat",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may forge web cookies that can be used to gain access to web applications or Internet se",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may enumerate system and service logs to find useful data. These logs may highlight vari",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may duplicate then impersonate another user's existing token to escalate privileges and ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may exfiltrate data to a code repository rather than over their primary command and cont",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may log into accessible cloud services within a compromised environment using Valid Acco",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may use port knocking to hide open ports used for persistence or command and control. To",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may smuggle commands to download malicious payloads past content filters by hiding them ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may register for web services\u00a0that can be used during targeting. A variety of popular we",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries can steal application access tokens as a means of acquiring credentials to access remote",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may send spearphishing messages with a malicious attachment to elicit sensitive informat",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent acces",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "An adversary may rely upon specific actions by a user in order to gain execution. Users may be subje",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "An adversary may deface systems internal to an organization in an attempt to intimidate or mislead u",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may use hidden users to hide the presence of user accounts they create or modify. Admini",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may make new tokens and impersonate users to escalate privileges and bypass access contr",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may attempt to find unsecured credentials in Group Policy Preferences (GPP). GPP are too",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may steal data by exfiltrating it over an asymmetrically encrypted network protocol othe",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and con",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may attempt to get information about running processes on a system. Information obtained",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may impair command history logging to hide commands they run on a compromised system. Va",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may register malicious network provider dynamic link libraries (DLLs) to capture clearte",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may establish persistence and elevate privileges by executing malicious content triggere",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may search content delivery network (CDN) data about victims that can be used during tar",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may employ various user activity checks to detect and avoid virtualization and analysis ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may leverage compromised software-as-a-service (SaaS) applications to complete resource-",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may create accounts with cloud providers that can be used during targeting. Adversaries ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may gain access to and use centralized software suites installed within an enterprise to",
"cross_file": true
},
{
"count": 3,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen d",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitor",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may gather information about the victim's organization that can be used during targeting",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may forge credential materials that can be used to gain access to web applications or In",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may attempt to bypass multi-factor authentication (MFA) mechanisms and gain access to ac",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may modify host software binaries to establish persistent access to systems. Software bi",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may directly collect unsecured credentials stored or passed through user communication s",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful intera",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may establish persistence by executing malicious content triggered by a file type associ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may inject malicious code into processes via VDSO hijacking in order to evade process-ba",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may communicate using application layer protocols associated with transferring files to ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may intentionally exclude certain files, folders, directories, file types, or system com",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may exploit software vulnerabilities in an attempt to collect credentials. Exploitation ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may gain persistence and elevate privileges by executing malicious content triggered by ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may use an existing, legitimate external Web service as a means for sending commands to ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may gather information about the victim's networks that can be used during targeting. In",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may exploit remote services to gain unauthorized access to internal systems once inside ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "After they already have access to accounts or systems within the environment, adversaries may use in",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adv",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may breach or otherwise leverage organizations who have access to intended victims. Acce",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may attempt to find local system groups and permission settings. The knowledge of local ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may search freely available websites and/or domains for information about victims that c",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may disable network device-based firewall mechanisms entirely or add, delete, or modify ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account man",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may steal data by exfiltrating it over a different protocol than that of the existing co",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may modify the kernel to automatically execute programs on system boot. Loadable Kernel ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may employ various time-based methods to evade detection and analysis. These techniques ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may mimic common operating system GUI components to prompt users for credentials with a ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumst",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse the KernelCallbackTable of a process to hijack its execution flow",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may search and gather information about victims from closed (e.g., paid, private, or oth",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse systemd timers to perform task scheduling for initial or recurring execution o",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are e",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse the ROM Monitor (ROMMON) by loading an unauthorized firmware with adversary co",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly d",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may leverage the compute resources of co-opted systems to complete resource-intensive ta",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may remove share connections that are no longer useful in order to clean up traces of th",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may chain together multiple proxies to disguise the source of malicious traffic. Typical",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary com",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse Microsoft Outlook forms to obtain persistence on a compromised system. Outlook",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "An adversary may use legitimate remote access hardware to establish an interactive command and contr",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may modify and/or disable security tools to avoid possible detection of their malware/to",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide a",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command executi",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command a",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may search network shares on computers they have compromised to find files of interest. ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may compromise access to third-party web services\u00a0that can be used during targeting. A v",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may make changes to the operating system of embedded network devices to weaken defenses ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may execute their own malicious payloads by hijacking the way operating systems run prog",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may attempt to blend in with legitimate traffic by spoofing browser and system attribute",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse Lua commands and scripts for execution. Lua is a cross-platform scripting and ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may remove indicators from tools if they believe their malicious tool was detected, quar",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may rely on a user running a malicious image to facilitate execution. Amazon Web Service",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may create or modify container or container cluster management tools that run as daemons",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Acce",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may communicate using a protocol and port pairing that are typically not associated. For",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may create and cultivate social media accounts that can be used during targeting. Advers",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may inject malicious code into suspended and hollowed processes in order to evade proces",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation o",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse resource forks to hide malicious code or executables to evade detection and by",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may interrupt availability of system and network resources by inhibiting access to accou",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may use credentials obtained from breach dumps of unrelated accounts to gain access to t",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive info",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may install malicious components that run on Internet Information Services (IIS) web ser",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceivi",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may carry out malicious operations using a virtual instance to avoid detection. A wide v",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may utilize polymorphic code (also known as metamorphic or mutating code) to evade detec",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may attempt to access detailed information about the password policy used within an ente",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may establish persistence through executing malicious commands triggered by a user\u2019s she",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may gather credential material by invoking or forcing a user to automatically provide au",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may use SID-History Injection to escalate privileges and bypass access controls. The Win",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may bridge network boundaries by compromising perimeter network devices or internal devi",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may encrypt data on target systems or on large numbers of systems in a network to interr",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may undermine security controls that will either warn users of untrusted activity or pre",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may leverage the AuthorizationExecuteWithPrivileges API to escalate privile",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may gather information about the victim's host firmware that can be used during targetin",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may employ an encryption algorithm to conceal command and control traffic rather than re",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse authentication packages to execute DLLs when the system boots. Windows authent",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-l",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may exfiltrate data to text storage sites instead of their primary command and control c",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may gather information about the victim's host software that can be used during targetin",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may use methods of capturing user input to obtain credentials or collect information. Du",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may use voice communications to ultimately gain access to victim systems. Spearphishing ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may develop exploits that can be used during targeting. An exploit takes advantage of a ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may search social media for information about victims that can be used during targeting.",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may leverage Customer Relationship Management (CRM) software to mine valuable informatio",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may establish persistence by executing malicious content triggered by hijacked reference",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may gather credentials that can be used during targeting. Account credentials gathered b",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may manipulate application software prior to receipt by a final consumer for the purpose",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may use an existing, legitimate external Web service as a means for sending commands to ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabili",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may iteratively probe infrastructure using brute-forcing and crawling techniques. While ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may flood targeted email addresses with an overwhelming volume of messages. This may bur",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may spoof security alerting from tools, presenting false evidence to impair defenders\u2019 a",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse Microsoft Outlook's Home Page feature to obtain persistence on a compromised s",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffi",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may exfiltrate data to a cloud storage service rather than over their primary command an",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may transfer tools or other files between systems in a compromised environment. Once bro",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. A",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may install SSL/TLS certificates that can be used during targeting. SSL/TLS certificates",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may use startup items automatically executed at boot initialization to establish persist",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may attempt to gather information about the system language of a victim in order to infe",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may use an OSI non-application layer protocol for communication between host and C2 serv",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse built-in CLI tools or API calls to execute malicious commands in containerized",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may use steganography techniques in order to prevent the detection of hidden information",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may compromise third-party DNS servers that can be used during targeting. During post-co",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may achieve persistence by leveraging OAuth application integrations in a software-as-a-",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may impersonate legitimate protocols or web service traffic to disguise command and cont",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may interact with the Windows Registry to gather information about the system, configura",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes b",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries can use stolen session cookies to authenticate to web applications and services. This te",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Acces",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utilit",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may achieve persistence by leveraging Python\u2019s startup mechanisms, including path config",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may install a root certificate on a compromised system to avoid warnings when connecting",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may use network logon scripts automatically executed at logon initialization to establis",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availabilit",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to vi",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may gather information in an attempt to calculate the geographical location of a victim ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may hide malicious Visual Basic for Applications (VBA) payloads embedded within MS Offic",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks. W",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.ex",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may impersonate a trusted person or organization in order to persuade and trick a target",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may modify settings that directly affect the size, locations, and resources available to",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may take advantage of routing schemes in Content Delivery Networks (CDNs) and other serv",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may poison Address Resolution Protocol (ARP) caches to position themselves between the c",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "An adversary may disable or modify cloud logging capabilities and integrations to limit what data is",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may attempt to get a listing of security software, configurations, defensive tools, and ",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In s",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may use ClickOnce applications (.appref-ms and .application files) to proxy execution of",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Once a payload is delivered, adversaries may reproduce copies of the same malware on the victim syst",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may gather information about identities and roles within the victim organization that ca",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may encode data to make the content of command and control traffic more difficult to det",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may establish persistence and/or elevate privileges by executing malicious content trigg",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may send phishing messages to elicit sensitive information that can be used during targe",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, whi",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may create and cultivate accounts with services that can be used during targeting. Adver",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may buy and/or steal capabilities that can be used during targeting. Rather than develop",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may establish persistence by executing malicious content triggered by user inactivity. S",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may disable or modify conditional access policies to enable persistent access to comprom",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "An adversary may create a new instance or virtual machine (VM) within the compute service of a cloud",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may acquire credentials from cloud-native secret management solutions such as AWS Secret",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may leverage code repositories to collect valuable information. Code repositories are to",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may alter data en route to storage or other systems in order to manipulate external outc",
"cross_file": true
},
{
"count": 2,
"files": [
"llm_annotated_apt.jsonl",
"llm_annotated_mitre_v2.jsonl"
],
"text_preview": "Adversaries may attempt to dump the contents of /etc/passwd and /etc/shadowA cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not prope",
"cross_file": false
},
{
"count": 2,
"files": [
"llm_annotated_nvd_v2.jsonl"
],
"text_preview": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (co",
"cross_file": false
}
],
"short_texts": [
{
"file": "llm_annotated_apt.jsonl",
"line": 114,
"text": "WebShell.",
"length": 9
},
{
"file": "llm_annotated_apt.jsonl",
"line": 115,
"text": "WebShell.",
"length": 9
},
{
"file": "llm_annotated_apt.jsonl",
"line": 124,
"text": "Ransomware",
"length": 10
},
{
"file": "llm_annotated_apt.jsonl",
"line": 159,
"text": "Ransomware",
"length": 10
},
{
"file": "llm_annotated_apt.jsonl",
"line": 189,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 370,
"text": "webshell",
"length": 8
},
{
"file": "llm_annotated_apt.jsonl",
"line": 418,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 470,
"text": "PyVil RAT",
"length": 9
},
{
"file": "llm_annotated_apt.jsonl",
"line": 559,
"text": "Ransomware",
"length": 10
},
{
"file": "llm_annotated_apt.jsonl",
"line": 567,
"text": "Keylogger.",
"length": 10
},
{
"file": "llm_annotated_apt.jsonl",
"line": 618,
"text": "Ransomware",
"length": 10
},
{
"file": "llm_annotated_apt.jsonl",
"line": 622,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 634,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 685,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 693,
"text": "A keylogger.",
"length": 12
},
{
"file": "llm_annotated_apt.jsonl",
"line": 702,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 725,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 736,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 737,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 740,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 794,
"text": "Downloader.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 795,
"text": "Downloader.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 841,
"text": "Infostealer",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 854,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 877,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 921,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 960,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1014,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1031,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1043,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1046,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1061,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1081,
"text": "Clipboard stealer.",
"length": 18
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1086,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1160,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1199,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1200,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1223,
"text": "C2 framework.",
"length": 13
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1241,
"text": "Ransomware",
"length": 10
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1259,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1270,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1278,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1282,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1286,
"text": "Wrapper for Kazuar.",
"length": 19
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1306,
"text": "Infostealer",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1337,
"text": "ransomware",
"length": 10
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1367,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1385,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1391,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1400,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1403,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1420,
"text": "Ransomware",
"length": 10
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1431,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1442,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1459,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1463,
"text": "Ransomware",
"length": 10
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1484,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1495,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1582,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1637,
"text": "Keylogger.",
"length": 10
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1677,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1687,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1713,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1716,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1727,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1737,
"text": "Ransomware.",
"length": 11
},
{
"file": "llm_annotated_exploitdb.jsonl",
"line": 704,
"text": "ZSH 5.9 - RCE",
"length": 13
},
{
"file": "llm_annotated_exploitdb.jsonl",
"line": 738,
"text": "Redis 8.0.2 - RCE",
"length": 17
},
{
"file": "llm_annotated_exploitdb.jsonl",
"line": 1181,
"text": "Horilla v1.3 - RCE",
"length": 18
},
{
"file": "llm_annotated_exploitdb.jsonl",
"line": 1471,
"text": "xibocms 3.3.4 - RCE",
"length": 19
},
{
"file": "llm_annotated_exploitdb.jsonl",
"line": 1598,
"text": "AtomCMS v2.0 - SQLi",
"length": 19
}
],
"mislabels": [
{
"file": "llm_annotated_apt.jsonl",
"line": 1,
"entity": "ESET",
"label": "SYSTEM",
"reason": "Security vendor/org 'ESET' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 22,
"entity": "Avast",
"label": "SYSTEM",
"reason": "Security vendor/org 'Avast' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 40,
"entity": "Kaspersky",
"label": "SYSTEM",
"reason": "Security vendor/org 'Kaspersky' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 47,
"entity": "ESET",
"label": "SYSTEM",
"reason": "Security vendor/org 'ESET' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 49,
"entity": "Kaspersky",
"label": "SYSTEM",
"reason": "Security vendor/org 'Kaspersky' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 94,
"entity": "Trend Micro",
"label": "SYSTEM",
"reason": "Security vendor/org 'Trend Micro' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 95,
"entity": "Trend Micro",
"label": "SYSTEM",
"reason": "Security vendor/org 'Trend Micro' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 99,
"entity": "Bitdefender",
"label": "SYSTEM",
"reason": "Security vendor/org 'Bitdefender' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 131,
"entity": "Avast",
"label": "SYSTEM",
"reason": "Security vendor/org 'Avast' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 133,
"entity": "CVE-2023-1389",
"label": "CVE_ID",
"reason": "CVE ID labeled as CVE_ID, expected VULNERABILITY"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 137,
"entity": "CVE-2020-8515",
"label": "CVE_ID",
"reason": "CVE ID labeled as CVE_ID, expected VULNERABILITY"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 140,
"entity": "Trend Micro",
"label": "SYSTEM",
"reason": "Security vendor/org 'Trend Micro' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 141,
"entity": "CVE-2022-42475",
"label": "CVE_ID",
"reason": "CVE ID labeled as CVE_ID, expected VULNERABILITY"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 141,
"entity": "Fortinet",
"label": "SYSTEM",
"reason": "Security vendor/org 'Fortinet' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 143,
"entity": "https://github.com/Egida/kek/blob/19991ef983f838287aa9362b78b4ed8da0929184/loader_multi.go",
"label": "URL",
"reason": "URL/hash labeled as URL, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 143,
"entity": "19991ef983f838287aa9362b78b4ed8da0929184",
"label": "HASH",
"reason": "URL/hash labeled as HASH, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 149,
"entity": "Avast",
"label": "SYSTEM",
"reason": "Security vendor/org 'Avast' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 153,
"entity": "Sophos",
"label": "SYSTEM",
"reason": "Security vendor/org 'Sophos' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 155,
"entity": "https://github.com/jpillora/chisel",
"label": "URL",
"reason": "URL/hash labeled as URL, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 155,
"entity": "SentinelOne",
"label": "SYSTEM",
"reason": "Security vendor/org 'SentinelOne' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 164,
"entity": "CVE-2021-20090",
"label": "CVE_ID",
"reason": "CVE ID labeled as CVE_ID, expected VULNERABILITY"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 171,
"entity": "ESET",
"label": "SYSTEM",
"reason": "Security vendor/org 'ESET' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 172,
"entity": "https://www.zdnet.com/article/new-echobot-malware-is-a-smorgasbord-of-vulnerabilities",
"label": "URL",
"reason": "URL/hash labeled as URL, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 172,
"entity": "Palo Alto",
"label": "SYSTEM",
"reason": "Security vendor/org 'Palo Alto' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 173,
"entity": "ESET",
"label": "SYSTEM",
"reason": "Security vendor/org 'ESET' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 193,
"entity": "CVE-2014-8361",
"label": "CVE_ID",
"reason": "CVE ID labeled as CVE_ID, expected VULNERABILITY"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 193,
"entity": "CVE-2017-17215",
"label": "CVE_ID",
"reason": "CVE ID labeled as CVE_ID, expected VULNERABILITY"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 198,
"entity": "Fortinet",
"label": "SYSTEM",
"reason": "Security vendor/org 'Fortinet' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 204,
"entity": "CVE-2024-21887",
"label": "CVE_ID",
"reason": "CVE ID labeled as CVE_ID, expected VULNERABILITY"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 204,
"entity": "CVE-2023-46805",
"label": "CVE_ID",
"reason": "CVE ID labeled as CVE_ID, expected VULNERABILITY"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 205,
"entity": "Trend Micro",
"label": "SYSTEM",
"reason": "Security vendor/org 'Trend Micro' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 209,
"entity": "ESET",
"label": "SYSTEM",
"reason": "Security vendor/org 'ESET' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 212,
"entity": "CVE-2024-6047",
"label": "CVE_ID",
"reason": "CVE ID labeled as CVE_ID, expected VULNERABILITY"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 212,
"entity": "CVE-2024-11120",
"label": "CVE_ID",
"reason": "CVE ID labeled as CVE_ID, expected VULNERABILITY"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 226,
"entity": "CVE-2019-19781",
"label": "CVE_ID",
"reason": "CVE ID labeled as CVE_ID, expected VULNERABILITY"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 228,
"entity": "CVE-2017-17215",
"label": "CVE_ID",
"reason": "CVE ID labeled as CVE_ID, expected VULNERABILITY"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 251,
"entity": "CVE-2024-3400",
"label": "CVE_ID",
"reason": "CVE ID labeled as CVE_ID, expected VULNERABILITY"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 251,
"entity": "CVE-2023-46805",
"label": "CVE_ID",
"reason": "CVE ID labeled as CVE_ID, expected VULNERABILITY"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 251,
"entity": "CVE-2024-21887",
"label": "CVE_ID",
"reason": "CVE ID labeled as CVE_ID, expected VULNERABILITY"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 251,
"entity": "CVE-2023-1389",
"label": "CVE_ID",
"reason": "CVE ID labeled as CVE_ID, expected VULNERABILITY"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 251,
"entity": "CVE-2022-22954",
"label": "CVE_ID",
"reason": "CVE ID labeled as CVE_ID, expected VULNERABILITY"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 251,
"entity": "CVE-2018-20062",
"label": "CVE_ID",
"reason": "CVE ID labeled as CVE_ID, expected VULNERABILITY"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 256,
"entity": "CVE-2019-15107",
"label": "CVE_ID",
"reason": "CVE ID labeled as CVE_ID, expected VULNERABILITY"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 261,
"entity": "CVE-2014-8361",
"label": "CVE_ID",
"reason": "CVE ID labeled as CVE_ID, expected VULNERABILITY"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 264,
"entity": "Fortinet",
"label": "SYSTEM",
"reason": "Security vendor/org 'Fortinet' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 280,
"entity": "CVE-2019-10149",
"label": "CVE_ID",
"reason": "CVE ID labeled as CVE_ID, expected VULNERABILITY"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 286,
"entity": "Kaspersky",
"label": "SYSTEM",
"reason": "Security vendor/org 'Kaspersky' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 313,
"entity": "Symantec",
"label": "SYSTEM",
"reason": "Security vendor/org 'Symantec' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 321,
"entity": "SentinelOne",
"label": "SYSTEM",
"reason": "Security vendor/org 'SentinelOne' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 324,
"entity": "https://github.com/doener2323/doenerium",
"label": "URL",
"reason": "URL/hash labeled as URL, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 348,
"entity": "Avast",
"label": "SYSTEM",
"reason": "Security vendor/org 'Avast' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 350,
"entity": "Trend Micro",
"label": "SYSTEM",
"reason": "Security vendor/org 'Trend Micro' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 351,
"entity": "Trend Micro",
"label": "SYSTEM",
"reason": "Security vendor/org 'Trend Micro' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 357,
"entity": "ESET",
"label": "SYSTEM",
"reason": "Security vendor/org 'ESET' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 387,
"entity": "SentinelOne",
"label": "SYSTEM",
"reason": "Security vendor/org 'SentinelOne' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 390,
"entity": "SentinelOne",
"label": "SYSTEM",
"reason": "Security vendor/org 'SentinelOne' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 396,
"entity": "SentinelOne",
"label": "SYSTEM",
"reason": "Security vendor/org 'SentinelOne' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 414,
"entity": "Avast",
"label": "SYSTEM",
"reason": "Security vendor/org 'Avast' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 420,
"entity": "Trend Micro",
"label": "SYSTEM",
"reason": "Security vendor/org 'Trend Micro' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 428,
"entity": "ESET",
"label": "SYSTEM",
"reason": "Security vendor/org 'ESET' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 429,
"entity": "Kaspersky",
"label": "SYSTEM",
"reason": "Security vendor/org 'Kaspersky' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 442,
"entity": "Trend Micro",
"label": "SYSTEM",
"reason": "Security vendor/org 'Trend Micro' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 448,
"entity": "Fortinet",
"label": "SYSTEM",
"reason": "Security vendor/org 'Fortinet' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 455,
"entity": "https://stealer.to",
"label": "URL",
"reason": "URL/hash labeled as URL, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 458,
"entity": "Kaspersky",
"label": "SYSTEM",
"reason": "Security vendor/org 'Kaspersky' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 461,
"entity": "https://github.com/TheGeekHT/Loki.Rat/",
"label": "URL",
"reason": "URL/hash labeled as URL, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 479,
"entity": "CVE-2025-80880",
"label": "CVE_ID",
"reason": "CVE ID labeled as CVE_ID, expected VULNERABILITY"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 498,
"entity": "CVE-2018-0798",
"label": "CVE_ID",
"reason": "CVE ID labeled as CVE_ID, expected VULNERABILITY"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 518,
"entity": "Trend Micro",
"label": "SYSTEM",
"reason": "Security vendor/org 'Trend Micro' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 542,
"entity": "ESET",
"label": "SYSTEM",
"reason": "Security vendor/org 'ESET' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 557,
"entity": "Sophos",
"label": "SYSTEM",
"reason": "Security vendor/org 'Sophos' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 579,
"entity": "ESET",
"label": "SYSTEM",
"reason": "Security vendor/org 'ESET' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 580,
"entity": "CVE-2018-20250",
"label": "CVE_ID",
"reason": "CVE ID labeled as CVE_ID, expected VULNERABILITY"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 589,
"entity": "Symantec",
"label": "SYSTEM",
"reason": "Security vendor/org 'Symantec' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 609,
"entity": "Bitdefender",
"label": "SYSTEM",
"reason": "Security vendor/org 'Bitdefender' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 610,
"entity": "Kaspersky",
"label": "SYSTEM",
"reason": "Security vendor/org 'Kaspersky' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 616,
"entity": "CVE-2014-4114",
"label": "CVE_ID",
"reason": "CVE ID labeled as CVE_ID, expected VULNERABILITY"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 623,
"entity": "Trend Micro",
"label": "SYSTEM",
"reason": "Security vendor/org 'Trend Micro' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 635,
"entity": "Avast",
"label": "SYSTEM",
"reason": "Security vendor/org 'Avast' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 638,
"entity": "Trend Micro",
"label": "SYSTEM",
"reason": "Security vendor/org 'Trend Micro' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 640,
"entity": "CVE-2022-42475",
"label": "CVE_ID",
"reason": "CVE ID labeled as CVE_ID, expected VULNERABILITY"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 640,
"entity": "Fortinet",
"label": "SYSTEM",
"reason": "Security vendor/org 'Fortinet' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 642,
"entity": "ESET",
"label": "SYSTEM",
"reason": "Security vendor/org 'ESET' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 664,
"entity": "37ca2e37e1dc26d6b66ba041ed653dc8ee43e1db71a705df4546449dd7591479",
"label": "HASH",
"reason": "URL/hash labeled as HASH, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 664,
"entity": "0af612461174eedec813ce670ba35e74a9433361eacb3ceab6d79232a6fe13c1",
"label": "HASH",
"reason": "URL/hash labeled as HASH, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 664,
"entity": "3E3CD9E8D94FC45F811720F5E911B892A17EE00F971E498EAA8B5CAE44A6A8D8",
"label": "HASH",
"reason": "URL/hash labeled as HASH, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 664,
"entity": "AD90D4ADFED0BDCB2E56871B13CC7E857F64C906E2CF3283D30D6CFD24CD2190",
"label": "HASH",
"reason": "URL/hash labeled as HASH, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 664,
"entity": "9255E8B64FB278BC5FFE5B8F70D68AF8",
"label": "HASH",
"reason": "URL/hash labeled as HASH, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 668,
"entity": "https://github.com/skerkour/black-hat-rust",
"label": "URL",
"reason": "URL/hash labeled as URL, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 670,
"entity": "ESET",
"label": "SYSTEM",
"reason": "Security vendor/org 'ESET' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 677,
"entity": "Kaspersky",
"label": "SYSTEM",
"reason": "Security vendor/org 'Kaspersky' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 686,
"entity": "https://github.com/jpillora/chisel",
"label": "URL",
"reason": "URL/hash labeled as URL, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 686,
"entity": "SentinelOne",
"label": "SYSTEM",
"reason": "Security vendor/org 'SentinelOne' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 690,
"entity": "Trend Micro",
"label": "SYSTEM",
"reason": "Security vendor/org 'Trend Micro' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 698,
"entity": "ESET",
"label": "SYSTEM",
"reason": "Security vendor/org 'ESET' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 699,
"entity": "https://github.com/fatedier/frp",
"label": "URL",
"reason": "URL/hash labeled as URL, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 712,
"entity": "Trend Micro",
"label": "SYSTEM",
"reason": "Security vendor/org 'Trend Micro' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 727,
"entity": "Trend Micro",
"label": "SYSTEM",
"reason": "Security vendor/org 'Trend Micro' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 746,
"entity": "Kaspersky",
"label": "SYSTEM",
"reason": "Security vendor/org 'Kaspersky' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 749,
"entity": "Kaspersky",
"label": "SYSTEM",
"reason": "Security vendor/org 'Kaspersky' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 762,
"entity": "Symantec",
"label": "SYSTEM",
"reason": "Security vendor/org 'Symantec' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 776,
"entity": "Trend Micro",
"label": "SYSTEM",
"reason": "Security vendor/org 'Trend Micro' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 780,
"entity": "ESET",
"label": "SYSTEM",
"reason": "Security vendor/org 'ESET' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 802,
"entity": "https://github.com/TheWover/donut",
"label": "URL",
"reason": "URL/hash labeled as URL, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 802,
"entity": "Symantec",
"label": "SYSTEM",
"reason": "Security vendor/org 'Symantec' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 805,
"entity": "https://witha.name/",
"label": "URL",
"reason": "URL/hash labeled as URL, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 805,
"entity": "http://withanamemwesdvodfhthjq25a5a3uas24cpgoa7qm6gchcerzpis6qd.onion/",
"label": "URL",
"reason": "URL/hash labeled as URL, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 809,
"entity": "Bitdefender",
"label": "SYSTEM",
"reason": "Security vendor/org 'Bitdefender' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 827,
"entity": "https://github.com/arsium/EagleMonitorRAT",
"label": "URL",
"reason": "URL/hash labeled as URL, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 835,
"entity": "Trend Micro",
"label": "SYSTEM",
"reason": "Security vendor/org 'Trend Micro' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 845,
"entity": "Trend Micro",
"label": "SYSTEM",
"reason": "Security vendor/org 'Trend Micro' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 867,
"entity": "McAfee",
"label": "SYSTEM",
"reason": "Security vendor/org 'McAfee' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 876,
"entity": "ESET",
"label": "SYSTEM",
"reason": "Security vendor/org 'ESET' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 896,
"entity": "SentinelOne",
"label": "SYSTEM",
"reason": "Security vendor/org 'SentinelOne' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 908,
"entity": "Symantec",
"label": "SYSTEM",
"reason": "Security vendor/org 'Symantec' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 930,
"entity": "Symantec",
"label": "SYSTEM",
"reason": "Security vendor/org 'Symantec' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 939,
"entity": "ESET",
"label": "SYSTEM",
"reason": "Security vendor/org 'ESET' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 942,
"entity": "ESET",
"label": "SYSTEM",
"reason": "Security vendor/org 'ESET' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 946,
"entity": "Symantec",
"label": "SYSTEM",
"reason": "Security vendor/org 'Symantec' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1017,
"entity": "ESET",
"label": "SYSTEM",
"reason": "Security vendor/org 'ESET' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1027,
"entity": "Kaspersky",
"label": "SYSTEM",
"reason": "Security vendor/org 'Kaspersky' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1044,
"entity": "Trend Micro",
"label": "SYSTEM",
"reason": "Security vendor/org 'Trend Micro' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1054,
"entity": "ESET",
"label": "SYSTEM",
"reason": "Security vendor/org 'ESET' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1060,
"entity": "Symantec",
"label": "SYSTEM",
"reason": "Security vendor/org 'Symantec' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1068,
"entity": "ESET",
"label": "SYSTEM",
"reason": "Security vendor/org 'ESET' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1072,
"entity": "Trend Micro",
"label": "SYSTEM",
"reason": "Security vendor/org 'Trend Micro' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1075,
"entity": "Trend Micro",
"label": "SYSTEM",
"reason": "Security vendor/org 'Trend Micro' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1087,
"entity": "CVE-2017-0144",
"label": "CVE_ID",
"reason": "CVE ID labeled as CVE_ID, expected VULNERABILITY"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1097,
"entity": "ESET",
"label": "SYSTEM",
"reason": "Security vendor/org 'ESET' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1098,
"entity": "https://github.com/zettabithf/LiteHTTP",
"label": "URL",
"reason": "URL/hash labeled as URL, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1100,
"entity": "Trend Micro",
"label": "SYSTEM",
"reason": "Security vendor/org 'Trend Micro' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1107,
"entity": "ESET",
"label": "SYSTEM",
"reason": "Security vendor/org 'ESET' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1121,
"entity": "ESET",
"label": "SYSTEM",
"reason": "Security vendor/org 'ESET' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1129,
"entity": "ESET",
"label": "SYSTEM",
"reason": "Security vendor/org 'ESET' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1165,
"entity": "https://github.com/Cr4sh/MicroBackdoor",
"label": "URL",
"reason": "URL/hash labeled as URL, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1168,
"entity": "Kaspersky",
"label": "SYSTEM",
"reason": "Security vendor/org 'Kaspersky' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1178,
"entity": "Trend Micro",
"label": "SYSTEM",
"reason": "Security vendor/org 'Trend Micro' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1180,
"entity": "ESET",
"label": "SYSTEM",
"reason": "Security vendor/org 'ESET' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1189,
"entity": "ESET",
"label": "SYSTEM",
"reason": "Security vendor/org 'ESET' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1193,
"entity": "https://groups.google.com/g/ph4nt0m/c/2J3_1XPeKD8/m/AYPoWudRcTAJ?pli=1",
"label": "URL",
"reason": "URL/hash labeled as URL, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1196,
"entity": "Fortinet",
"label": "SYSTEM",
"reason": "Security vendor/org 'Fortinet' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1212,
"entity": "Fortinet",
"label": "SYSTEM",
"reason": "Security vendor/org 'Fortinet' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1252,
"entity": "ESET",
"label": "SYSTEM",
"reason": "Security vendor/org 'ESET' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1258,
"entity": "Symantec",
"label": "SYSTEM",
"reason": "Security vendor/org 'Symantec' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1272,
"entity": "Kaspersky",
"label": "SYSTEM",
"reason": "Security vendor/org 'Kaspersky' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1285,
"entity": "ESET",
"label": "SYSTEM",
"reason": "Security vendor/org 'ESET' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1312,
"entity": "ESET",
"label": "SYSTEM",
"reason": "Security vendor/org 'ESET' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1319,
"entity": "Trend Micro",
"label": "SYSTEM",
"reason": "Security vendor/org 'Trend Micro' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1329,
"entity": "ESET",
"label": "SYSTEM",
"reason": "Security vendor/org 'ESET' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1351,
"entity": "ESET",
"label": "SYSTEM",
"reason": "Security vendor/org 'ESET' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1357,
"entity": "CVE-2022-47966",
"label": "CVE_ID",
"reason": "CVE ID labeled as CVE_ID, expected VULNERABILITY"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1363,
"entity": "Trend Micro",
"label": "SYSTEM",
"reason": "Security vendor/org 'Trend Micro' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1377,
"entity": "ESET",
"label": "SYSTEM",
"reason": "Security vendor/org 'ESET' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1379,
"entity": "Palo Alto",
"label": "SYSTEM",
"reason": "Security vendor/org 'Palo Alto' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1381,
"entity": "Trend Micro",
"label": "SYSTEM",
"reason": "Security vendor/org 'Trend Micro' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1388,
"entity": "Kaspersky",
"label": "SYSTEM",
"reason": "Security vendor/org 'Kaspersky' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1388,
"entity": "Symantec",
"label": "SYSTEM",
"reason": "Security vendor/org 'Symantec' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1401,
"entity": "CVE-2018-8453",
"label": "CVE_ID",
"reason": "CVE ID labeled as CVE_ID, expected VULNERABILITY"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1401,
"entity": "3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45",
"label": "HASH",
"reason": "URL/hash labeled as HASH, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1401,
"entity": "f0c60f62ef9ffc044d0b4aeb8cc26b971236f24a2611cb1be09ff4845c3841bc",
"label": "HASH",
"reason": "URL/hash labeled as HASH, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1401,
"entity": "a88e2857a2f3922b44247316642f08ba8665185297e3cd958bbd22a83f380feb",
"label": "HASH",
"reason": "URL/hash labeled as HASH, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1401,
"entity": "89d80016ff4c6600e8dd8cfad1fa6912af4d21c5457b4e9866d1796939b48dc4",
"label": "HASH",
"reason": "URL/hash labeled as HASH, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1401,
"entity": "78fa32f179224c46ae81252c841e75ee4e80b57e6b026d0a05bb07d34ec37bbf",
"label": "HASH",
"reason": "URL/hash labeled as HASH, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1401,
"entity": "2ca64feaaf5ab6cf96677fbc2bc0e1995b3bc93472d7af884139aa757240e3f6",
"label": "HASH",
"reason": "URL/hash labeled as HASH, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1401,
"entity": "e430479d1ca03a1bc5414e28f6cdbb301939c4c95547492cdbe27b0a123344ea",
"label": "HASH",
"reason": "URL/hash labeled as HASH, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1401,
"entity": "0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e",
"label": "HASH",
"reason": "URL/hash labeled as HASH, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1401,
"entity": "6a2bd52a5d68a7250d1de481dcce91a32f54824c1c540f0a040d05f757220cd3",
"label": "HASH",
"reason": "URL/hash labeled as HASH, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1401,
"entity": "3d0649b5f76dbbff9f86b926afbd18ae028946bf",
"label": "HASH",
"reason": "URL/hash labeled as HASH, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1401,
"entity": "95a21e764ad0c98ea3d034d293aee5511e7c8457",
"label": "HASH",
"reason": "URL/hash labeled as HASH, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1401,
"entity": "9d1b61b1cba411ee6d4664ba2561fa59cdb0732c",
"label": "HASH",
"reason": "URL/hash labeled as HASH, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1401,
"entity": "b859de5ffcb90e4ca8e304d81a4f81e8785bb299",
"label": "HASH",
"reason": "URL/hash labeled as HASH, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1401,
"entity": "0ce2cae5287a64138d273007b34933362901783d",
"label": "HASH",
"reason": "URL/hash labeled as HASH, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1401,
"entity": "0bd22f204c5373f1a22d9a02c59f69f354a2cc0d",
"label": "HASH",
"reason": "URL/hash labeled as HASH, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1401,
"entity": "7423c57db390def08154b77e2b5e043d92d320c7",
"label": "HASH",
"reason": "URL/hash labeled as HASH, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1401,
"entity": "b53bc09cfbd292af7b3609734a99d101bd24d77e",
"label": "HASH",
"reason": "URL/hash labeled as HASH, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1401,
"entity": "8dcbcbefaedf5675b170af3fd44db93ad864894e",
"label": "HASH",
"reason": "URL/hash labeled as HASH, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1401,
"entity": "bed6fc04aeb785815744706239a1f243",
"label": "HASH",
"reason": "URL/hash labeled as HASH, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1401,
"entity": "65aa793c000762174b2f86077bdafaea",
"label": "HASH",
"reason": "URL/hash labeled as HASH, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1401,
"entity": "2abff29b4d87f30f011874b6e98959e9",
"label": "HASH",
"reason": "URL/hash labeled as HASH, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1401,
"entity": "4af953b20f3a1f165e7cf31d6156c035",
"label": "HASH",
"reason": "URL/hash labeled as HASH, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1401,
"entity": "3cae02306a95564b1fff4ea45a7dfc00",
"label": "HASH",
"reason": "URL/hash labeled as HASH, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1401,
"entity": "6e3efb83299d800edf1624ecbc0665e7",
"label": "HASH",
"reason": "URL/hash labeled as HASH, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1401,
"entity": "cfefcc2edc5c54c74b76e7d1d29e69b2",
"label": "HASH",
"reason": "URL/hash labeled as HASH, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1401,
"entity": "65ff37973426c09b9ff95f354e62959e",
"label": "HASH",
"reason": "URL/hash labeled as HASH, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1401,
"entity": "ea4cae3d6d8150215a4d90593a4c30f2",
"label": "HASH",
"reason": "URL/hash labeled as HASH, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1415,
"entity": "Avast",
"label": "SYSTEM",
"reason": "Security vendor/org 'Avast' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1417,
"entity": "https://github.com/nyx0/Rovnix",
"label": "URL",
"reason": "URL/hash labeled as URL, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1421,
"entity": "ESET",
"label": "SYSTEM",
"reason": "Security vendor/org 'ESET' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1432,
"entity": "Symantec",
"label": "SYSTEM",
"reason": "Security vendor/org 'Symantec' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1450,
"entity": "ESET",
"label": "SYSTEM",
"reason": "Security vendor/org 'ESET' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1452,
"entity": "SentinelOne",
"label": "SYSTEM",
"reason": "Security vendor/org 'SentinelOne' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1470,
"entity": "Kaspersky",
"label": "SYSTEM",
"reason": "Security vendor/org 'Kaspersky' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1477,
"entity": "ESET",
"label": "SYSTEM",
"reason": "Security vendor/org 'ESET' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1486,
"entity": "Kaspersky",
"label": "SYSTEM",
"reason": "Security vendor/org 'Kaspersky' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1491,
"entity": "ESET",
"label": "SYSTEM",
"reason": "Security vendor/org 'ESET' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1500,
"entity": "Kaspersky",
"label": "SYSTEM",
"reason": "Security vendor/org 'Kaspersky' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1504,
"entity": "ESET",
"label": "SYSTEM",
"reason": "Security vendor/org 'ESET' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1506,
"entity": "https://github.com/sysdream/ligolo",
"label": "URL",
"reason": "URL/hash labeled as URL, expected INDICATOR"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1513,
"entity": "ESET",
"label": "SYSTEM",
"reason": "Security vendor/org 'ESET' labeled as SYSTEM, expected ORGANIZATION"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1518,
"entity": "CVE-2018-5713",
"label": "CVE_ID",
"reason": "CVE ID labeled as CVE_ID, expected VULNERABILITY"
}
],
"overlapping_spans": [
{
"file": "llm_annotated_apt.jsonl",
"line": 2,
"span1": "SYSTEM: Android [103:110]",
"span2": "SYSTEM: Android operating system [103:127]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 8,
"span1": "ORGANIZATION: Google [26:32]",
"span2": "SYSTEM: Google Play [26:37]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 8,
"span1": "SYSTEM: Google Play [26:37]",
"span2": "MALWARE: Play [33:37]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 19,
"span1": "ORGANIZATION: Google [60:66]",
"span2": "SYSTEM: Google Play [60:71]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 19,
"span1": "SYSTEM: Google Play [60:71]",
"span2": "MALWARE: Play [67:71]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 22,
"span1": "ORGANIZATION: Google [330:336]",
"span2": "SYSTEM: Google Play [330:341]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 22,
"span1": "SYSTEM: Google Play [330:341]",
"span2": "MALWARE: Play [337:341]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 22,
"span1": "ORGANIZATION: Google [429:435]",
"span2": "SYSTEM: Google Play [429:440]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 22,
"span1": "SYSTEM: Google Play [429:440]",
"span2": "MALWARE: Play [436:440]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 28,
"span1": "ORGANIZATION: Google [222:228]",
"span2": "SYSTEM: Google Play [222:233]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 28,
"span1": "SYSTEM: Google Play [222:233]",
"span2": "MALWARE: Play [229:233]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 47,
"span1": "ORGANIZATION: Google [223:229]",
"span2": "SYSTEM: Google Play [223:234]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 47,
"span1": "SYSTEM: Google Play [223:234]",
"span2": "MALWARE: Play [230:234]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 51,
"span1": "SYSTEM: Cisco [0:5]",
"span2": "ORGANIZATION: Cisco Talos [0:11]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 51,
"span1": "ORGANIZATION: Cisco Talos [0:11]",
"span2": "ORGANIZATION: Talos [6:11]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 62,
"span1": "ORGANIZATION: Google [446:452]",
"span2": "SYSTEM: Google Play [446:457]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 62,
"span1": "SYSTEM: Google Play [446:457]",
"span2": "MALWARE: Play [453:457]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 66,
"span1": "MALWARE: Mirax [131:136]",
"span2": "MALWARE: Mirax Bot [131:140]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 67,
"span1": "ORGANIZATION: Google [106:112]",
"span2": "SYSTEM: Google Play [106:117]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 67,
"span1": "SYSTEM: Google Play [106:117]",
"span2": "MALWARE: Play [113:117]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 85,
"span1": "ORGANIZATION: Google [68:74]",
"span2": "SYSTEM: Google Play [68:79]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 85,
"span1": "SYSTEM: Google Play [68:79]",
"span2": "MALWARE: Play [75:79]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 100,
"span1": "ORGANIZATION: Google [289:295]",
"span2": "SYSTEM: Google Play [289:300]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 100,
"span1": "SYSTEM: Google Play [289:300]",
"span2": "MALWARE: Play [296:300]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 133,
"span1": "VULNERABILITY: remote code execution [170:191]",
"span2": "VULNERABILITY: code execution [177:191]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 143,
"span1": "URL: https://github.com/Egida/kek/blob/19991ef983f838287aa9362b78b4ed8da0929184/loader_multi.go [122:212]",
"span2": "HASH: 19991ef983f838287aa9362b78b4ed8da0929184 [156:196]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 162,
"span1": "MALWARE: Cyclops [19:26]",
"span2": "MALWARE: Cyclops Blink [19:32]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 162,
"span1": "MALWARE: Cyclops [245:252]",
"span2": "MALWARE: Cyclops Blink [245:258]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 162,
"span1": "MALWARE: Cyclops [376:383]",
"span2": "MALWARE: Cyclops Blink [376:389]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 162,
"span1": "MALWARE: Cyclops [485:492]",
"span2": "MALWARE: Cyclops Blink [485:498]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 170,
"span1": "SYSTEM: Cisco [13:18]",
"span2": "ORGANIZATION: Cisco Talos [13:24]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 170,
"span1": "ORGANIZATION: Cisco Talos [13:24]",
"span2": "ORGANIZATION: Talos [19:24]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 172,
"span1": "SYSTEM: Palo Alto [141:150]",
"span2": "ORGANIZATION: Palo Alto Networks [141:159]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 172,
"span1": "SYSTEM: Palo Alto [313:322]",
"span2": "ORGANIZATION: Palo Alto Networks [313:331]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 201,
"span1": "ORGANIZATION: Black Lotus Labs [13:29]",
"span2": "MALWARE: Lotus [19:24]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 213,
"span1": "SYSTEM: Cisco [0:5]",
"span2": "ORGANIZATION: Cisco Talos [0:11]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 213,
"span1": "ORGANIZATION: Cisco Talos [0:11]",
"span2": "ORGANIZATION: Talos [6:11]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 213,
"span1": "THREAT_ACTOR: Cobalt [33:39]",
"span2": "TOOL: Cobalt Strike [33:46]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 225,
"span1": "ORGANIZATION: Black Lotus Labs [13:29]",
"span2": "MALWARE: Lotus [19:24]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 240,
"span1": "ORGANIZATION: Black Lotus Labs [0:16]",
"span2": "MALWARE: Lotus [6:11]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 259,
"span1": "SYSTEM: Cisco [13:18]",
"span2": "ORGANIZATION: Cisco Talos [13:24]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 259,
"span1": "ORGANIZATION: Cisco Talos [13:24]",
"span2": "ORGANIZATION: Talos [19:24]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 266,
"span1": "SYSTEM: Cisco [13:18]",
"span2": "ORGANIZATION: Cisco Talos [13:24]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 266,
"span1": "ORGANIZATION: Cisco Talos [13:24]",
"span2": "ORGANIZATION: Talos [19:24]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 267,
"span1": "FILEPATH: /home/%user%/.config/apdl.cf [485:513]",
"span2": "DOMAIN: apdl.cf [506:513]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 290,
"span1": "ORGANIZATION: Black Lotus Labs [13:29]",
"span2": "MALWARE: Lotus [19:24]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 324,
"span1": "URL: https://github.com/doener2323/doenerium [133:172]",
"span2": "MALWARE: doenerium [163:172]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 344,
"span1": "VULNERABILITY: remote code execution [422:443]",
"span2": "VULNERABILITY: code execution [429:443]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 346,
"span1": "ORGANIZATION: Microsoft [148:157]",
"span2": "SYSTEM: Microsoft Office [148:164]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 348,
"span1": "SYSTEM: Avast [158:163]",
"span2": "DOMAIN: Avast.io [158:166]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 352,
"span1": "MALWARE: QUICKRIDE [52:61]",
"span2": "MALWARE: QUICKRIDE.POWER [52:67]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 358,
"span1": "FILEPATH: %appdata%\\Roaming\\Microsoft\\Templates\\, [232:271]",
"span2": "ORGANIZATION: Microsoft [250:259]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 360,
"span1": "ORGANIZATION: IBM [13:16]",
"span2": "ORGANIZATION: IBM X-Force [13:24]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 360,
"span1": "ORGANIZATION: IBM X-Force [13:24]",
"span2": "ORGANIZATION: X-Force [17:24]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 360,
"span1": "TOOL: cmd [245:248]",
"span2": "TOOL: cmd.exe [245:252]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 391,
"span1": "ORGANIZATION: Microsoft [210:219]",
"span2": "SYSTEM: Microsoft Office [210:226]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 395,
"span1": "MALWARE: Proton [0:6]",
"span2": "MALWARE: Proton RAT [0:10]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 395,
"span1": "MALWARE: Proton [510:516]",
"span2": "MALWARE: Proton RAT [510:520]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 414,
"span1": "SYSTEM: Avast [90:95]",
"span2": "DOMAIN: Avast.io [90:98]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 416,
"span1": "SYSTEM: Cisco [13:18]",
"span2": "ORGANIZATION: Cisco Talos [13:24]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 416,
"span1": "ORGANIZATION: Cisco Talos [13:24]",
"span2": "ORGANIZATION: Talos [19:24]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 434,
"span1": "ORGANIZATION: Microsoft [79:88]",
"span2": "SYSTEM: Microsoft Office [79:95]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 461,
"span1": "THREAT_ACTOR: El Machete [203:213]",
"span2": "MALWARE: Machete [206:213]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 461,
"span1": "URL: https://github.com/TheGeekHT/Loki.Rat/ [289:327]",
"span2": "MALWARE: Loki [318:322]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 465,
"span1": "SYSTEM: Cisco [0:5]",
"span2": "ORGANIZATION: Cisco Talos [0:11]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 465,
"span1": "ORGANIZATION: Cisco Talos [0:11]",
"span2": "ORGANIZATION: Talos [6:11]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 466,
"span1": "MALWARE: PXA [0:3]",
"span2": "MALWARE: PXA Stealer [0:11]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 466,
"span1": "SYSTEM: Cisco [80:85]",
"span2": "ORGANIZATION: Cisco Talos [80:91]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 466,
"span1": "ORGANIZATION: Cisco Talos [80:91]",
"span2": "ORGANIZATION: Talos [86:91]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 466,
"span1": "MALWARE: PXA [342:345]",
"span2": "MALWARE: PXA Stealer [342:353]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 484,
"span1": "ORGANIZATION: Microsoft [17:26]",
"span2": "SYSTEM: Microsoft Word [17:31]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 494,
"span1": "MALWARE: Snake [0:5]",
"span2": "MALWARE: Snake Keylogger [0:15]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 506,
"span1": "SYSTEM: Windows [401:408]",
"span2": "SYSTEM: Windows 7 [401:410]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 513,
"span1": "MALWARE: Agent Racoon [0:12]",
"span2": "MALWARE: Racoon [6:12]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 536,
"span1": "SYSTEM: .NET [110:114]",
"span2": "SYSTEM: .NET Framework [110:124]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 541,
"span1": "MALWARE: Aurora [1153:1159]",
"span2": "MALWARE: Aurora Stealer [1153:1167]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 552,
"span1": "VULNERABILITY: spear-phishing [442:456]",
"span2": "VULNERABILITY: phishing [448:456]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 560,
"span1": "MALWARE: Aurora [104:110]",
"span2": "MALWARE: Aurora Stealer [104:118]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 576,
"span1": "SYSTEM: Windows [88:95]",
"span2": "SYSTEM: Windows Defender [88:104]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 577,
"span1": "THREAT_ACTOR: Cobalt [395:401]",
"span2": "TOOL: Cobalt Strike [395:408]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 577,
"span1": "TOOL: Cobalt Strike [395:408]",
"span2": "TOOL: Cobalt Strike Beacon [395:415]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 616,
"span1": "VULNERABILITY: spear-phishing [1771:1785]",
"span2": "VULNERABILITY: phishing [1777:1785]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 616,
"span1": "ORGANIZATION: Microsoft [1804:1813]",
"span2": "SYSTEM: Microsoft Word [1804:1818]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 651,
"span1": "TOOL: cmd [563:566]",
"span2": "TOOL: cmd.exe [563:570]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 652,
"span1": "TOOL: Brute Ratel [0:11]",
"span2": "MALWARE: Brute Ratel C4 [0:14]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 652,
"span1": "TOOL: Brute Ratel [987:998]",
"span2": "MALWARE: Brute Ratel C4 [987:1001]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 657,
"span1": "THREAT_ACTOR: Cobalt [259:265]",
"span2": "TOOL: Cobalt Strike [259:272]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 664,
"span1": "FILEPATH: C:\\Windows\\system32\\drivers\\ftusbload2.sys [690:732]",
"span2": "SYSTEM: Windows [693:700]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 666,
"span1": "VULNERABILITY: spear phishing [150:164]",
"span2": "VULNERABILITY: phishing [156:164]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 667,
"span1": "ORGANIZATION: Microsoft [257:266]",
"span2": "SYSTEM: Microsoft Excel [257:272]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 669,
"span1": "VULNERABILITY: spear phishing [190:204]",
"span2": "VULNERABILITY: phishing [196:204]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 694,
"span1": "SYSTEM: Windows [294:301]",
"span2": "SYSTEM: Windows Defender [294:310]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 700,
"span1": "THREAT_ACTOR: Cobalt [0:6]",
"span2": "TOOL: Cobalt Strike [0:13]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 700,
"span1": "THREAT_ACTOR: Cobalt [740:746]",
"span2": "TOOL: Cobalt Strike [740:753]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 721,
"span1": "SYSTEM: Cisco [13:18]",
"span2": "ORGANIZATION: Cisco Talos [13:24]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 721,
"span1": "ORGANIZATION: Cisco Talos [13:24]",
"span2": "ORGANIZATION: Talos [19:24]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 723,
"span1": "MALWARE: Crimson [224:231]",
"span2": "MALWARE: Crimson RAT [224:235]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 723,
"span1": "MALWARE: Crimson [384:391]",
"span2": "MALWARE: Crimson RAT [384:395]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 746,
"span1": "SYSTEM: Windows [300:307]",
"span2": "SYSTEM: Windows Defender [300:316]"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 758,
"span1": "THREAT_ACTOR: Cobalt [442:448]",
"span2": "TOOL: Cobalt Strike [442:455]"
}
],
"garbage_text": [
{
"file": "llm_annotated_apt.jsonl",
"line": 481,
"issues": [
"HTML tags"
],
"text_preview": "According to Sekoia, the aim of this backdoor is to receive VBS modules for execution from a remote C2 server. Once rece"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 649,
"issues": [
"HTML tags"
],
"text_preview": "There is no reference available for this family and all known samples have version 1.0.0.\r\n\r\nPdb-strings in the samples "
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1226,
"issues": [
"HTML tags"
],
"text_preview": "NikiTeaR is a sophisticated, custom-developed RAT, which is a rewritten variant of the NikiHTTP (aka NikiTea) RAT. \r\n\r\nI"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1258,
"issues": [
"HTML tags"
],
"text_preview": "According to Symantec, this malware has been deployed against IT services companies in the U.S. and Europe. A multi-stag"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1563,
"issues": [
"HTML tags"
],
"text_preview": "This ransomware uses a combination of different crypto algorithms (ChaCha20, AES-128, Curve25519). The activity of this "
},
{
"file": "llm_annotated_apt.jsonl",
"line": 1985,
"issues": [
"HTML tags"
],
"text_preview": "COATHANGER is a remote access tool (RAT) targeting FortiGate networking appliances. First used in 2023 in targeted intru"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2149,
"issues": [
"HTML tags"
],
"text_preview": "Raspberry Robin is initial access malware first identified in September 2021, and active through early 2024. The malware"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2634,
"issues": [
"HTML tags"
],
"text_preview": "The Net utility is a component of the Windows operating system. It is used in command-line operations for control of use"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2702,
"issues": [
"HTML tags"
],
"text_preview": "cmd is the Windows command-line interpreter that can be used to interact with systems and execute other processes and ut"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2725,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defense"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2729,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include fu"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2732,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may establish persistence through executing malicious commands triggered by a user\u2019s shell. User shells exec"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2733,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Sc"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2738,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2740,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i."
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2743,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may implement hidden windows to conceal malicious activity from the plain sight of users. In some cases, win"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2747,
"issues": [
"HTML tags"
],
"text_preview": "Property list (plist) files contain all of the information that macOS and OS X uses to configure applications and servic"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2748,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2750,
"issues": [
"HTML tags"
],
"text_preview": "The HISTCONTROL environment variable keeps track of what should be saved by the history comman"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2755,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protecte"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2757,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may use PubPrn to proxy execution of malicious remote files. PubPrn.vbs is a Visual Basic script that publis"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2768,
"issues": [
"HTML tags"
],
"text_preview": "Processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2771,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may use email rules to hide inbound emails in a compromised user's mailbox. Many email clients allow users t"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2778,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may gain persistence and elevate privileges by executing malicious content triggered by PowerShell profiles."
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2779,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scr"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2781,
"issues": [
"HTML tags"
],
"text_preview": "Systemd services can be used to establish persistence on a Linux system. The systemd service manager is commonly used fo"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2792,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse a double extension in the filename as a means of masquerading the true file type. A file name may "
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2793,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2796,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may check for Internet connectivity on compromised systems. This may be performed during automated discovery"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2797,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may perform sudo caching and/or use the sudoers file to elevate privileges. Adversaries may do this to execu"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2804,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through i"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2808,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to find cloud groups and permission settings. The knowledge of cloud permission groups can help "
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2809,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Flaws in the pe"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2812,
"issues": [
"HTML tags"
],
"text_preview": "During the boot process, macOS executes source /etc/rc.common, which is a shell script containing various u"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2818,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data.\n\nMost"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2820,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measure"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2824,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse mavinject.exe to proxy execution of malicious code. Mavinject.exe is the Microsoft Application Vir"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2825,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data.\n\nMost"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2834,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may target user email on local systems to collect sensitive information. Files containing email data can be "
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2835,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management sy"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2837,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2838,
"issues": [
"HTML tags"
],
"text_preview": "A port monitor can be set through the API call to set a DLL to be loaded at startup. This DLL can be located in sudo command \"allows a system administrator to delegate authority to give certain users (or groups of u"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2848,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domai"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2849,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine. Active Setup is a"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2854,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are ins"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2855,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may communicate using publish/subscribe (pub/sub) application layer protocols to avoid detection/network fil"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2861,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2864,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse internet browser extensions to establish persistent access to victim systems. Browser extensions o"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2867,
"issues": [
"HTML tags"
],
"text_preview": "Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable ("
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2872,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse the cron utility to perform task scheduling for initial or recurring execution of mal"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2873,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission gr"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2876,
"issues": [
"HTML tags"
],
"text_preview": "Per Apple\u2019s documentation, startup items execute during the final phase of the boot process and contain shell scripts or"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2877,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-in"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2880,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-l"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2883,
"issues": [
"HTML tags"
],
"text_preview": "An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent acc"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2884,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalat"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2888,
"issues": [
"HTML tags"
],
"text_preview": "The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may "
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2893,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may collect data stored in the clipboard from users copying information within or between applications. \n\nFo"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2894,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may gather credentials from the proc filesystem or `/proc`. The proc filesystem is a pseudo-filesystem used "
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2897,
"issues": [
"HTML tags"
],
"text_preview": "Dynamic-link libraries (DLLs) that are specified in the AppInit_DLLs value in the Registry keys HKEY_LOCAL_MACHINE"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2901,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may try to gather information about registered local system services. Adversaries may obtain information abo"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2907,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry store"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2908,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2916,
"issues": [
"HTML tags"
],
"text_preview": "An adversary may attempt to get detailed information about the operating system and hardware, including version, patches"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2922,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for "
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2923,
"issues": [
"HTML tags"
],
"text_preview": "MacOS provides the option to list specific applications to run when a user logs in. These applications run under the log"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2927,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse components of Terminal Services to enable persistent access to systems. Microsoft Terminal Service"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2928,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse AppleScript for execution. AppleScript is a macOS scripting language designed to control applicati"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2932,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs pr"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2933,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to steal Kerberos tickets stored in credential cache files (or ccache). These files are used for"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2934,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may clear or remove evidence of malicious network connections in order to clean up traces of their operation"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2936,
"issues": [
"HTML tags"
],
"text_preview": "Windows stores local service configuration information in the Registry under HKLM\\SYSTEM\\CurrentControlSet\\Service"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2940,
"issues": [
"HTML tags"
],
"text_preview": "In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the "
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2946,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require se"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2955,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable Pass the Ti"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2961,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may inject malicious code into hijacked processes in order to evade process-based defenses as well as possib"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2964,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application "
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2966,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escal"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2967,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may modify mail and mail application data to remove evidence of their activity. Email applications allow use"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2968,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may use a Login Hook to establish persistence executed upon user logon. A login hook is a plist file that po"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2972,
"issues": [
"HTML tags"
],
"text_preview": "Bash keeps track of the commands users type on the command-line with the \"history\" utility. Once a user logs out, the hi"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2975,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may acquire credentials from web browsers by reading files specific to the target browser. \n\nWeb browsers "
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2976,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, o"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2977,
"issues": [
"HTML tags"
],
"text_preview": "**This technique has been deprecated and should no longer be used.**\n\nThe source command loads functions in"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2980,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may modify file time attributes to hide new files or changes to existing files. Timestomping is a technique "
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2992,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address l"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2995,
"issues": [
"HTML tags"
],
"text_preview": "Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs Registry key under HKEY_LOCAL_MACHINE\\System\\C"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 2998,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits. Windows eve"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3003,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (co"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3006,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse security support providers (SSPs) to execute DLLs when the system boots. Windows SSP DLLs are load"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3007,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may modify a process's in-memory arguments to change its name in order to appear as a legitimate or benign p"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3008,
"issues": [
"HTML tags"
],
"text_preview": "Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SA"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3011,
"issues": [
"HTML tags"
],
"text_preview": "Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a syst"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3016,
"issues": [
"HTML tags"
],
"text_preview": "Windows Authentication Package DLLs are loaded by the Local Security Authority (LSA) process at system start. They provi"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3020,
"issues": [
"HTML tags"
],
"text_preview": "Launchctl controls the macOS launchd process which handles things like launch agents and launch daemons, but can execute"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3021,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may tamper with SIP and trust provider components to mislead the operating system and application control to"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3023,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change cont"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3033,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may modify code signing policies to enable execution of unsigned or self-signed code. Code signing provides "
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3034,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may deploy a container into an environment to facilitate execution or evade defenses. In some cases, adversa"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3036,
"issues": [
"HTML tags"
],
"text_preview": "Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures. "
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3038,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3039,
"issues": [
"HTML tags"
],
"text_preview": "An adversary may attempt to discover infrastructure and resources that are available within an infrastructure-as-a-servi"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3040,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers comm"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3041,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may execute their own malicious payloads by hijacking the search order used to load other programs. Because "
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3044,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may redirect network traffic to adversary-owned systems by spoofing Dynamic Host Configuration Protocol (DHC"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3045,
"issues": [
"HTML tags"
],
"text_preview": "macOS and OS X applications send AppleEvent messages to each other for interprocess communications (IPC). These messages"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3050,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, u"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3052,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials. Priva"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3058,
"issues": [
"HTML tags"
],
"text_preview": "Image File Execution Options (IFEO) enable a developer to attach a debugger to an application. When a process is created"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3059,
"issues": [
"HTML tags"
],
"text_preview": "The rundll32.exe program can be called to execute an arbitrary binary. Adversaries may take advantage of this functional"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3061,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may establish persistence by executing malicious content triggered by an interrupt signal. The trapauthorized_keys file to maintain persistence on a victim host. Linux distrib"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3098,
"issues": [
"HTML tags"
],
"text_preview": "Loadable Kernel Modules (or LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They e"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3099,
"issues": [
"HTML tags"
],
"text_preview": "Windows Security Support Provider (SSP) DLLs are loaded into the Local Security Authority (LSA) process at system start."
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3101,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by Image File E"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3102,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads. Odbcconf.exe is a Windows utility that allo"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3108,
"issues": [
"HTML tags"
],
"text_preview": "In macOS and OS X, when applications or programs are downloaded from the internet, there is a special attribute set on t"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3110,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may inject malicious code into process via process doppelg\u00e4nging in order to evade process-based defenses as"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3111,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of syste"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3114,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may execute their own malicious payloads by hijacking the binaries used by an installer. These processes may"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3115,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibilit"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3117,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may gain persistence and elevate privileges in certain situations by abusing PowerShell profiles. A PowerShe"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3118,
"issues": [
"HTML tags"
],
"text_preview": "In user mode, Windows Authenticode digital signatures are used to verify a file's origin and integrity, variables that "
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3123,
"issues": [
"HTML tags"
],
"text_preview": "An adversary may attempt to block indicators or events typically captured by sensors from being gathered and analyzed. T"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3124,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Activ"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3127,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may manipulate continuous integration / continuous development (CI/CD) processes by injecting malicious code"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3135,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file name "
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3137,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign SVG "
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3141,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse Microsoft Office templates to obtain persistence on a compromised system. Microsoft Office contain"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3145,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse a container administration service to execute commands within a container. A container administrat"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3146,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certa"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3149,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may inject malicious code into processes via the asynchronous procedure call (APC) queue in order to evade p"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3151,
"issues": [
"HTML tags"
],
"text_preview": "The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for bac"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3152,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may modify property list files (plist files) to enable other malicious activity, while also potentially evad"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3154,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3161,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently acc"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3163,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse specific file formats to subvert Mark-of-the-Web (MOTW) controls. In Windows, when files are downl"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3167,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of maliciou"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3169,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as poss"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3170,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse verclsid.exe to proxy execution of malicious code. Verclsid.exe is known as the Extension CLSID Ve"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3172,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse launchctl to execute commands or programs. Launchctl interfaces with launchd, the service manageme"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3177,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries can provide malicious content to an XPC service daemon for local code execution. macOS uses XPC services for"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3182,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted "
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3183,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may add login items to execute upon user login to gain persistence or escalate privileges. Login items are a"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3194,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may log into accessible cloud services within a compromised environment using Valid Accounts that are synchr"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3200,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3203,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may use hidden users to hide the presence of user accounts they create or modify. Administrators may want to"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3205,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to find unsecured credentials in Group Policy Preferences (GPP). GPP are tools that allow admini"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3208,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organi"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3209,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to get information about running processes on a system. Information obtained could be used to ga"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3210,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may impair command history logging to hide commands they run on a compromised system. Various command interp"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3211,
"issues": [
"HTML tags"
],
"text_preview": "This technique is deprecated due to the inaccurate usage. The report cited did not provide technical detail as to how th"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3221,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to e"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3223,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. A"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3228,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line i"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3230,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may establish persistence by executing malicious content triggered by a file type association. When a file i"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3236,
"issues": [
"HTML tags"
],
"text_preview": "Windows contains accessibility features that may be launched with a key combination before a user has logged in (for exa"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3238,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may gain persistence and elevate privileges by executing malicious content triggered by the Event Monitor Da"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3242,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to e"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3243,
"issues": [
"HTML tags"
],
"text_preview": "Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and feature"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3245,
"issues": [
"HTML tags"
],
"text_preview": "The sudoers file, /etc/sudoers, describes which users can run which commands and from which terminals. This"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3247,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. A"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3250,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission gr"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3255,
"issues": [
"HTML tags"
],
"text_preview": "Mshta.exe is a utility that executes Microsoft HTML Applications (HTA). HTA files have the file extension .htaKernelCallbackTable of a process to hijack its execution flow in order to run the"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3265,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse systemd timers to perform task scheduling for initial or recurring execution of malicious code. Sy"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3271,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windo"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3278,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. "
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3287,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse Lua commands and scripts for execution. Lua is a cross-platform scripting and programming language"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3295,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Pr"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3297,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applic"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3298,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legi"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3304,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may install malicious components that run on Internet Information Services (IIS) web servers to establish pe"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3306,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may carry out malicious operations using a virtual instance to avoid detection. A wide variety of virtualiza"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3307,
"issues": [
"HTML tags"
],
"text_preview": "The trap command allows programs and shells to specify commands that will be executed upon receiving interr"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3309,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cl"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3311,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may establish persistence through executing malicious commands triggered by a user\u2019s shell. User Unix Shells"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3312,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication informa"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3318,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may leverage the AuthorizationExecuteWithPrivileges API to escalate privileges by prompting the"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3322,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse authentication packages to execute DLLs when the system boots. Windows authentication package DLLs"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3325,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may exfiltrate data to text storage sites instead of their primary command and control channel. Text storage"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3328,
"issues": [
"HTML tags"
],
"text_preview": "Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configura"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3337,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning the usage of those u"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3347,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. Adversaries can take "
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3349,
"issues": [
"HTML tags"
],
"text_preview": "On Linux and macOS systems, multiple methods are supported for creating pre-scheduled and periodic background jobs: cron"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3350,
"issues": [
"HTML tags"
],
"text_preview": "When the setuid or setgid bits are set on Linux or macOS for an application, this means that the application will run wi"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3351,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items "
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3355,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical l"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3359,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic tec"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3365,
"issues": [
"HTML tags"
],
"text_preview": "Windows Remote Management (WinRM) is the name of both a Windows service and a protocol that allows a user to interact wi"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3368,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regas"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3369,
"issues": [
"HTML tags"
],
"text_preview": "**This technique has been deprecated. Please use Path Interception by PATH Environment Variable, Path Interception by Se"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3372,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary contro"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3377,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries ma"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3378,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may hide malicious Visual Basic for Applications (VBA) payloads embedded within MS Office documents by repla"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3383,
"issues": [
"HTML tags"
],
"text_preview": "Windows User Account Control (UAC) allows a program to elevate its privileges to perform a task under administrator-leve"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3388,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are ins"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3389,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows t"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3392,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3396,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3401,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are prog"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3402,
"issues": [
"HTML tags"
],
"text_preview": "Every user account in macOS has a userID associated with it. When creating a user, you can specify the userID for that a"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3409,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to dump the contents of /etc/passwd and /etc/shadow to enable offline "
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3410,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a u"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3413,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may inject malicious code into processes via the /proc filesystem in order to evade process-based defenses a"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3421,
"issues": [
"HTML tags"
],
"text_preview": "In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the "
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3422,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may acquire credentials from the Windows Credential Manager. The Credential Manager stores credentials for s"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3424,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may use Event Monitor Daemon (emond) to establish persistence by scheduling malicious commands to run on pre"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3429,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3433,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign HTML"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3434,
"issues": [
"HTML tags"
],
"text_preview": "An adversary may abuse Active Directory authentication encryption properties to gain access to credentials on Windows sy"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3435,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of "
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3436,
"issues": [
"HTML tags"
],
"text_preview": "Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certifi"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3438,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3444,
"issues": [
"HTML tags"
],
"text_preview": "To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3445,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may create or modify references in user document templates to conceal malicious code or force authentication"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3446,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may establish persistence by modifying RC scripts, which are executed during a Unix-like system\u2019s startup. T"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3447,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may modify access tokens to operate under a different user or system security context to perform actions and"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3448,
"issues": [
"HTML tags"
],
"text_preview": "The Windows Time service (W32Time) enables time synchronization across and within domains. W32Time time providers are r"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3450,
"issues": [
"HTML tags"
],
"text_preview": "Per Apple\u2019s developer documentation, when a user logs in, a per-user launchd process is started which loads the paramete"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3466,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a netw"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3467,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, i"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3472,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace a"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3473,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries can hide a program's true filetype by changing the extension of a file. With certain file types (specificall"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3474,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may modify plist files to automatically run an application when a user logs in. When a user logs out or rest"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3479,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3481,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may grant additional permission levels to maintain persistent access to an adversary-controlled email accoun"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3483,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windo"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3487,
"issues": [
"HTML tags"
],
"text_preview": "Per Apple\u2019s developer documentation, when macOS and OS X boot up, launchd is run to finish system initialization. This p"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3488,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-b"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3492,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. Windo"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3493,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse list-view controls to inject malicious code into hijacked processes in order to evade process-base"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3496,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may bypass application control and obscure execution of code by embedding scripts inside XSL files. Extensib"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3498,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accid"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3501,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse the Microsoft Office \"Office Test\" Registry key to obtain persistence on a compromised system. An "
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3504,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential "
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3510,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3519,
"issues": [
"HTML tags"
],
"text_preview": "An adversary may gather the system time and/or time zone settings from a local or remote system. The system time is set "
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3520,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse the at utility to perform task scheduling for initial or recurring execution of malicious code. Th"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3522,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as "
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3529,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted syst"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3530,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may establish persistence by executing malicious content triggered by Netsh Helper DLLs. Netsh.exe (also ref"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3536,
"issues": [
"HTML tags"
],
"text_preview": "InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3540,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse vSphere Installation Bundles (VIBs) to establish persistent access to ESXi hypervisors. VIBs are c"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3549,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may execute their own payloads by placing a malicious dynamic library (dylib) with an expected name in a pat"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3555,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating s"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3556,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse mmc.exe to proxy execution of malicious .msc files. Microsoft Management Console (MMC) is a binary"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3557,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to hide process command-line arguments by overwriting process memory. Process command-line argum"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3558,
"issues": [
"HTML tags"
],
"text_preview": "Windows systems have hidden network shares that are accessible only to administrators and provide the ability for remote"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3593,
"issues": [
"HTML tags"
],
"text_preview": "Quad7 Activity, also known as CovertNetwork-1658 or the 7777 Botnet, is a network of compromised small office/home offic"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3613,
"issues": [
"HTML tags"
],
"text_preview": ":small_blue_diamond: kbandla
\n:small_blue_diamond: APTnotes
\n:small_blue_diamond: Florian Roth - APT Groups
"
},
{
"file": "llm_annotated_apt.jsonl",
"line": 3632,
"issues": [
"HTML tags"
],
"text_preview": "### SentinelOne \n:small_orange_diamond: 2024 - [[SentinelOne] WatchTower 2023 Intelligence-Driven Threat Hunting](https:"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 46,
"issues": [
"HTML tags"
],
"text_preview": "COATHANGER is a remote access tool (RAT) targeting FortiGate networking appliances. First used in 2023 in targeted intru"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 210,
"issues": [
"HTML tags"
],
"text_preview": "Raspberry Robin is initial access malware first identified in September 2021, and active through early 2024. The malware"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 694,
"issues": [
"HTML tags"
],
"text_preview": "The Net utility is a component of the Windows operating system. It is used in command-line operations for control of use"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 762,
"issues": [
"HTML tags"
],
"text_preview": "cmd is the Windows command-line interpreter that can be used to interact with systems and execute other processes and ut"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 785,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defense"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 788,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include fu"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 791,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Sc"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 795,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 797,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i."
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 802,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 808,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protecte"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 810,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may use PubPrn to proxy execution of malicious remote files. PubPrn.vbs is a Visual Basic script that publis"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 822,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may use email rules to hide inbound emails in a compromised user's mailbox. Many email clients allow users t"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 828,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may gain persistence and elevate privileges by executing malicious content triggered by PowerShell profiles."
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 829,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scr"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 839,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse a double extension in the filename as a means of masquerading the true file type. A file name may "
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 840,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 842,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may check for Internet connectivity on compromised systems. This may be performed during automated discovery"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 843,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may perform sudo caching and/or use the sudoers file to elevate privileges. Adversaries may do this to execu"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 850,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through i"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 854,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to find cloud groups and permission settings. The knowledge of cloud permission groups can help "
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 855,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Flaws in the pe"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 863,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data.\n\nMost"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 865,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measure"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 868,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse mavinject.exe to proxy execution of malicious code. Mavinject.exe is the Microsoft Application Vir"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 874,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may target user email on local systems to collect sensitive information. Files containing email data can be "
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 875,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management sy"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 877,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 879,
"issues": [
"HTML tags"
],
"text_preview": "An adversary may forge SAML tokens with any permissions claims and lifetimes if they possess a valid SAML token-signing "
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 880,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 881,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping "
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 884,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domai"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 885,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine. Active Setup is a"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 890,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may communicate using publish/subscribe (pub/sub) application layer protocols to avoid detection/network fil"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 896,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 898,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse internet browser extensions to establish persistent access to victim systems. Browser extensions o"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 904,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse the cron utility to perform task scheduling for initial or recurring execution of mal"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 905,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission gr"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 908,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-in"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 911,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-l"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 914,
"issues": [
"HTML tags"
],
"text_preview": "An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent acc"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 915,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalat"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 921,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may collect data stored in the clipboard from users copying information within or between applications. \n\nFo"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 922,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may gather credentials from the proc filesystem or `/proc`. The proc filesystem is a pseudo-filesystem used "
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 928,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may try to gather information about registered local system services. Adversaries may obtain information abo"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 933,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry store"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 934,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 942,
"issues": [
"HTML tags"
],
"text_preview": "An adversary may attempt to get detailed information about the operating system and hardware, including version, patches"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 948,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for "
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 952,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse components of Terminal Services to enable persistent access to systems. Microsoft Terminal Service"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 953,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse AppleScript for execution. AppleScript is a macOS scripting language designed to control applicati"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 957,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs pr"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 958,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to steal Kerberos tickets stored in credential cache files (or ccache). These files are used for"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 959,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may clear or remove evidence of malicious network connections in order to clean up traces of their operation"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 964,
"issues": [
"HTML tags"
],
"text_preview": "In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the "
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 968,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require se"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 977,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable Pass the Ti"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 983,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may inject malicious code into hijacked processes in order to evade process-based defenses as well as possib"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 985,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application "
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 987,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escal"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 988,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may modify mail and mail application data to remove evidence of their activity. Email applications allow use"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 989,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may use a Login Hook to establish persistence executed upon user logon. A login hook is a plist file that po"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 995,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, o"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 996,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may modify file time attributes to hide new files or changes to existing files. Timestomping is a technique "
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1007,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address l"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1011,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits. Windows eve"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1016,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (co"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1019,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse security support providers (SSPs) to execute DLLs when the system boots. Windows SSP DLLs are load"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1020,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may modify a process's in-memory arguments to change its name in order to appear as a legitimate or benign p"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1028,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may tamper with SIP and trust provider components to mislead the operating system and application control to"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1029,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change cont"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1039,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may modify code signing policies to enable execution of unsigned or self-signed code. Code signing provides "
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1040,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may deploy a container into an environment to facilitate execution or evade defenses. In some cases, adversa"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1042,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1043,
"issues": [
"HTML tags"
],
"text_preview": "An adversary may attempt to discover infrastructure and resources that are available within an infrastructure-as-a-servi"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1044,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers comm"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1045,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may execute their own malicious payloads by hijacking the search order used to load other programs. Because "
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1048,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may redirect network traffic to adversary-owned systems by spoofing Dynamic Host Configuration Protocol (DHC"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1053,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, u"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1055,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials. Priva"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1061,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may establish persistence by executing malicious content triggered by an interrupt signal. The trapauthorized_keys file to maintain persistence on a victim host. Linux distrib"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1089,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by Image File E"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1090,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads. Odbcconf.exe is a Windows utility that allo"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1095,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may inject malicious code into process via process doppelg\u00e4nging in order to evade process-based defenses as"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1096,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of syste"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1099,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may execute their own malicious payloads by hijacking the binaries used by an installer. These processes may"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1100,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibilit"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1106,
"issues": [
"HTML tags"
],
"text_preview": "An adversary may attempt to block indicators or events typically captured by sensors from being gathered and analyzed. T"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1107,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Activ"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1110,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may manipulate continuous integration / continuous development (CI/CD) processes by injecting malicious code"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1117,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file name "
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1119,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign SVG "
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1123,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse Microsoft Office templates to obtain persistence on a compromised system. Microsoft Office contain"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1127,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse a container administration service to execute commands within a container. A container administrat"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1128,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certa"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1131,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may inject malicious code into processes via the asynchronous procedure call (APC) queue in order to evade p"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1133,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may modify property list files (plist files) to enable other malicious activity, while also potentially evad"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1135,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1140,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently acc"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1142,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse specific file formats to subvert Mark-of-the-Web (MOTW) controls. In Windows, when files are downl"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1145,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of maliciou"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1146,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as poss"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1147,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse verclsid.exe to proxy execution of malicious code. Verclsid.exe is known as the Extension CLSID Ve"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1149,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse launchctl to execute commands or programs. Launchctl interfaces with launchd, the service manageme"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1154,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries can provide malicious content to an XPC service daemon for local code execution. macOS uses XPC services for"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1159,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted "
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1160,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may add login items to execute upon user login to gain persistence or escalate privileges. Login items are a"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1171,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may log into accessible cloud services within a compromised environment using Valid Accounts that are synchr"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1177,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1180,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may use hidden users to hide the presence of user accounts they create or modify. Administrators may want to"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1182,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to find unsecured credentials in Group Policy Preferences (GPP). GPP are tools that allow admini"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1184,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organi"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1185,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to get information about running processes on a system. Information obtained could be used to ga"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1186,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may impair command history logging to hide commands they run on a compromised system. Various command interp"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1195,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to e"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1201,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line i"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1202,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may establish persistence by executing malicious content triggered by a file type association. When a file i"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1207,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may gain persistence and elevate privileges by executing malicious content triggered by the Event Monitor Da"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1213,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. A"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1216,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission gr"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1220,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control ch"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1221,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may modify the kernel to automatically execute programs on system boot. Loadable Kernel Modules (LKMs) are p"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1226,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse the KernelCallbackTable of a process to hijack its execution flow in order to run the"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1228,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse systemd timers to perform task scheduling for initial or recurring execution of malicious code. Sy"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1233,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windo"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1239,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. "
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1248,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse Lua commands and scripts for execution. Lua is a cross-platform scripting and programming language"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1255,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Pr"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1257,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applic"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1258,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legi"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1263,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may install malicious components that run on Internet Information Services (IIS) web servers to establish pe"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1265,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may carry out malicious operations using a virtual instance to avoid detection. A wide variety of virtualiza"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1267,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cl"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1269,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may establish persistence through executing malicious commands triggered by a user\u2019s shell. User Unix Shells"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1270,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication informa"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1275,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may leverage the AuthorizationExecuteWithPrivileges API to escalate privileges by prompting the"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1278,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse authentication packages to execute DLLs when the system boots. Windows authentication package DLLs"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1280,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may exfiltrate data to text storage sites instead of their primary command and control channel. Text storage"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1290,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning the usage of those u"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1300,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. Adversaries can take "
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1302,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items "
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1303,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical l"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1306,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic tec"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1314,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regas"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1316,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary contro"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1320,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries ma"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1321,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may hide malicious Visual Basic for Applications (VBA) payloads embedded within MS Office documents by repla"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1329,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are ins"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1330,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows t"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1332,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1336,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1341,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are prog"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1347,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to dump the contents of /etc/passwd and /etc/shadow to enable offline "
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1348,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a u"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1351,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may inject malicious code into processes via the /proc filesystem in order to evade process-based defenses a"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1358,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may acquire credentials from the Windows Credential Manager. The Credential Manager stores credentials for s"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1363,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1367,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign HTML"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1368,
"issues": [
"HTML tags"
],
"text_preview": "An adversary may abuse Active Directory authentication encryption properties to gain access to credentials on Windows sy"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1369,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of "
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1370,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1376,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may create or modify references in user document templates to conceal malicious code or force authentication"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1377,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may establish persistence by modifying RC scripts, which are executed during a Unix-like system\u2019s startup. T"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1378,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may modify access tokens to operate under a different user or system security context to perform actions and"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1394,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a netw"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1395,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, i"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1400,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace a"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1401,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries can hide a program's true filetype by changing the extension of a file. With certain file types (specificall"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1402,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may modify plist files to automatically run an application when a user logs in. When a user logs out or rest"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1406,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1408,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may grant additional permission levels to maintain persistent access to an adversary-controlled email accoun"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1412,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-b"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1416,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. Windo"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1417,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse list-view controls to inject malicious code into hijacked processes in order to evade process-base"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1420,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may bypass application control and obscure execution of code by embedding scripts inside XSL files. Extensib"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1422,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accid"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1425,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse the Microsoft Office \"Office Test\" Registry key to obtain persistence on a compromised system. An "
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1427,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential "
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1433,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1441,
"issues": [
"HTML tags"
],
"text_preview": "An adversary may gather the system time and/or time zone settings from a local or remote system. The system time is set "
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1442,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse the at utility to perform task scheduling for initial or recurring execution of malicious code. Th"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1443,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as "
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1449,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted syst"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1450,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may establish persistence by executing malicious content triggered by Netsh Helper DLLs. Netsh.exe (also ref"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1457,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse vSphere Installation Bundles (VIBs) to establish persistent access to ESXi hypervisors. VIBs are c"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1466,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may execute their own payloads by placing a malicious dynamic library (dylib) with an expected name in a pat"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1472,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating s"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1473,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may abuse mmc.exe to proxy execution of malicious .msc files. Microsoft Management Console (MMC) is a binary"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1474,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may attempt to hide process command-line arguments by overwriting process memory. Process command-line argum"
},
{
"file": "llm_annotated_mitre_v2.jsonl",
"line": 1838,
"issues": [
"HTML tags"
],
"text_preview": "Adversaries may destroy data and files on specific devices or in large numbers to interrupt availability to systems, ser"
},
{
"file": "llm_annotated_nvd.jsonl",
"line": 47,
"issues": [
"HTML tags"
],
"text_preview": "CVE-2026-34840: OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, OneUptime's"
},
{
"file": "llm_annotated_nvd.jsonl",
"line": 304,
"issues": [
"HTML tags"
],
"text_preview": "CVE-2020-36945: WebDamn User Registration Login System contains a SQL injection vulnerability that allows unauthenticate"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 8,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix double free race when mount fails in cifs"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 9,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nrcutorture: Fix rcutorture_one_extend_check() splat"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 10,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/packet: fix slab-out-of-bounds access in packet"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 12,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix 'scheduling while atomic' on aux critical "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 15,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/mremap: fix address wraparound in move_page_tabl"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 22,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Validate buffer length while parsing inde"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 29,
"issues": [
"HTML tags"
],
"text_preview": "An attacker can upload files with the privilege of the Web Server process for Kaseya VSA Unified Remote Monitoring & Man"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 30,
"issues": [
"HTML tags"
],
"text_preview": "All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 32,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: release svc_expkey/svc_export with rcu_work\n\n"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 39,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nmips: bmips: BCM6358: disable RAC flush for TP1\n\nRA"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 42,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: Fix system crash due to lack of free space in"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 54,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\necryptfs: Fix buffer size for tag 66 packet\n\nThe 'T"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 57,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ninterconnect: Don't access req_list while it's bein"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 68,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nfscrypt: fix left shift underflow when inode->i_blk"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 71,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to do sanity check on direct node in trun"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 75,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemstick: rtsx_usb_ms: Fix slab-use-after-free in r"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 77,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: teql: Fix double-free in teql_master_xmi"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 79,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: tables: FPDT: Don't call acpi_os_map_memory()"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 80,
"issues": [
"HTML tags"
],
"text_preview": "An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine (pfe) of Juniper N"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 84,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nsrcu: Delegate work to the boot cpu if using SRCU_S"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 85,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: Fix kernel crash during reboot when adapter i"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 86,
"issues": [
"HTML tags"
],
"text_preview": "An Uncontrolled Resource Consumption vulnerability in the PFE management daemon (evo-pfemand) of Juniper Networks Junos "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 88,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Fix fortify source warning while accessi"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 89,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Get user_ns from in_skb in unix_diag_get_e"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 95,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: ftrace: fix module PLTs with mcount\n\nLi Huaf"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 109,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nstmmac: Clear variable when destroying workqueue\n\nC"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 111,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ntunnels: do not assume mac header is set in skb_tun"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 121,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: don't drop extent_map for free space inode o"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 125,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/osnoise: Use a cpumask to know what threads"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 126,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: gadget: Fix use-after-free Read in usb_udc_uev"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 132,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ncgroup/cpuset: Prevent UAF in proc_cpuset_show()\n\nA"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 141,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Fix NULL deref in ntfs_update_mftmirr\n\nIf"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 143,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\npfcp: Destroy device along with udp socket's netns "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 155,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: Fix unregistering of framebuffers without de"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 161,
"issues": [
"HTML tags"
],
"text_preview": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 168,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Add length check in indx_get_root\n\nThis a"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 170,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: prevent nf_skb_duplicated cor"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 171,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nmac802154: fix llsec key resources release in mac80"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 172,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\niavf: Fix NULL pointer dereference in iavf_get_link"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 178,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: prevent copying too big compressed lzo segme"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 179,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 180,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nwatch_queue: Fix NULL dereference in error cleanup\n"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 184,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: fix double free issue during amdgp"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 187,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp - Always pass in an error pointer to __"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 191,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_fs: Clear ffs_eventfd in ffs_data_cl"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 194,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Disable migration in nf_hook_run_bpf().\n\nsyzbo"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 204,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Check rcu_read_lock_trace_held() before callin"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 210,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: publish jinode after initialization\n\next4_ino"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 215,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bgmac: Fix a BUG triggered by wrong bytes_comp"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 216,
"issues": [
"HTML tags"
],
"text_preview": "SiYuan is a personal knowledge management system. From version 3.6.0 to before version 3.6.2, the SanitizeSVG function i"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 229,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/mem: Fix shutdown order\n\nIra reports that remov"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 232,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nubifs: Fix memory leak in ubifs_sysfs_init()\n\nWhen "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 235,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Unmap the surface before resetting it o"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 239,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: core: Fix use-after-free in snd_soc_exit()\n\nK"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 242,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: pm: only set fullmesh for subflow endp\n\nWith"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 251,
"issues": [
"HTML tags"
],
"text_preview": "Vulnerability in the Oracle Cloud Infrastructure Storage Gateway product of Oracle Storage Gateway (component: Managemen"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 252,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: lapbether: fix issue of invalid opcode in lapb"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 253,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm thin: fix use-after-free crash in dm_sm_register"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 258,
"issues": [
"HTML tags"
],
"text_preview": "XWiki Commons are technical libraries common to several other top level XWiki projects. The \"restricted\" mode of the HTM"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 263,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix NULL deref in debugfs odm_comb"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 264,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6mr: Fix skb_under_panic in ip6mr_cache_report()\n"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 266,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix use-after-free caused by l2ca"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 278,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: page_alloc: move mlocked flag clearance into fr"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 280,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nvduse: fix NULL pointer dereference\n\nvduse_vdpa_set"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 283,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nmac802154: check local interfaces before deleting s"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 288,
"issues": [
"HTML tags"
],
"text_preview": "A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 290,
"issues": [
"HTML tags"
],
"text_preview": "An Improper Preservation of Consistency Between Independent Representations of Shared State vulnerability in the Packet "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 291,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix oops in write-retry from mis-resetting t"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 293,
"issues": [
"HTML tags"
],
"text_preview": "A Missing Release of Resource after Effective Lifetime vulnerability the xinetd process, responsible for spawning SSH da"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 302,
"issues": [
"HTML tags"
],
"text_preview": "Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 304,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: atlantic: remove aq_nic_deinit() when resume\n\n"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 306,
"issues": [
"HTML tags"
],
"text_preview": "Vulnerability in the Oracle Cloud Infrastructure Storage Gateway product of Oracle Storage Gateway (component: Managemen"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 316,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix race between DIM disable and net_dim"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 317,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\neth: bnxt: fix truesize for mb-xdp-pass case\n\nWhen "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 318,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nhv_netvsc: Fix race condition between netvsc_probe "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 328,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qedi: Fix crash while reading debugfs attribu"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 332,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: fix slab-out-of-bounds in hfsplus_bnode_re"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 337,
"issues": [
"HTML tags"
],
"text_preview": "When an Apache CloudStack user-account creates a CKS-based Kubernetes cluster in a project, the API key and the secret k"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 339,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma-mapping: benchmark: fix node id validation\n\nWhi"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 342,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix nfs4_openowner leak when concurrent nfsd4"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 343,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: HIDP: Fix possible UAF\n\nThis fixes the f"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 347,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix failure to rebuild free space tree using"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 354,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to do sanity check on node footer for non"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 358,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: mcq: Fix &hwq->cq_lock deadlock is"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 378,
"issues": [
"HTML tags"
],
"text_preview": "Gradle Build Action allows users to execute a Gradle Build in their GitHub Actions workflow. A vulnerability impacts Git"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 379,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/chrome: cros_ec_uart: properly fix race co"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 383,
"issues": [
"HTML tags"
],
"text_preview": "MimeKit is a C# library which may be used for the creation and parsing of messages using the Multipurpose Internet Mail "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 386,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix WARN() in get_bpf_raw_tp_regs\n\nsyzkaller r"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 393,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracefs: Use generic inode RCU for synchronizing fr"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 397,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nidpf: fix error handling in the init_task on load\n\n"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 398,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Fix task hung while purging oob_skb in GC."
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 411,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: check for non-NULL file pointer in io_fil"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 415,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: unmap and remove csa_va properly\n\nRoot "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 419,
"issues": [
"HTML tags"
],
"text_preview": "A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a play"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 422,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: fgraph: Fix stack layout to match __arch_ftr"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 423,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nFS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 427,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: piix4: Fix adapter not be removed in piix4_rem"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 437,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to cover read extent cache access with lo"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 442,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Prevent null pointer access in xe_migrate_c"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 445,
"issues": [
"HTML tags"
],
"text_preview": "Miniflux is a feed reader. Since v2.0.25, Miniflux will automatically proxy images served over HTTP to prevent mixed con"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 457,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Limit num_syncs to prevent oversized alloca"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 463,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: move netif_queue_set_napi to rtnl-protected se"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 465,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: iris: fix module removal if firmware downloa"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 471,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: Fix double increment of client_count in "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 473,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/histograms: Add histograms to hist_vars if "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 476,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: fix a UAF when vma->mm is freed after vma->vm_r"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 487,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Defer sub-object cleanup in export put callba"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 490,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: fix possible null-ptr-defer in spk_ttyio_relea"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 491,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: Fix UAF in hci_conn_tx_dequeu"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 498,
"issues": [
"HTML tags"
],
"text_preview": "Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 501,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix call trace warning and hang when re"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 505,
"issues": [
"HTML tags"
],
"text_preview": "Flarum is a forum software for building communities. Using the mentions feature provided by the flarum/mentions extensio"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 520,
"issues": [
"HTML tags"
],
"text_preview": "PyBB is an open source bulletin board. A manual code review of the PyBB bulletin board server has revealed that a vulner"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 521,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tun: Fix use-after-free in tun_detach()\n\nsyzbo"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 530,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nwatch_queue: Actually free the watch\n\nfree_watch() "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 532,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nwatch_queue: Fix filter limit check\n\nIn watch_queue"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 539,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnbd: fix uaf in nbd_genl_connect() error path\n\nTher"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 543,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/fadump: Move fadump_cma_init to setup_arch("
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 554,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix crash on profile change rollback fai"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 555,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: dlm: fix invalid derefence of sb_lvbptr\n\nI expe"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 559,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nudmabuf: Set the DMA mask for the udmabuf device (v"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 561,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/osnoise: Fix slab-out-of-bounds in _parse_i"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 565,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/mempool: fix poisoning order>0 pages with HIGHME"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 576,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: If sock is dead don't access sock's sk_wq in s"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 581,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nudp: Set SOCK_RCU_FREE earlier in udp_lib_get_port("
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 590,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: vivid: Change the siize of the composing\n\nsy"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 592,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_acl_tcam: Fix memory leak during re"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 596,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: ti: k3-udma: Add missing locking\n\nRecent"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 598,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Fix the sk->sk_forward_alloc warning "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 599,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nsfc: fix TX channel offset when using legacy interr"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 600,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndriver core: fix resource leak in device_add()\n\nWhe"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 602,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nkthread: unpark only parked kthread\n\nCalling into k"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 611,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nigb: revert rtnl_lock() that causes deadlock\n\nThe c"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 617,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to truncate first page in error path of f"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 633,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nARM: 9170/1: fix panic when kasan and kprobe are en"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 636,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: wake up all waiters after z_erofs_lzma_head "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 637,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: Fix out-of-bounds read in bond_option_arp_"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 646,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: udlfb: Fix endpoint check\n\nThe syzbot fuzzer"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 650,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-bufio: fix sched in atomic context\n\nIf \"try_veri"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 652,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Fix null-ptr-deref when xps sysfs alloc fai"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 653,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: fs, lock FTE when checking if active\n\nThe"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 654,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: avoid to init mgnt_entry list twice wh"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 656,
"issues": [
"HTML tags"
],
"text_preview": "
Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows."
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 668,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndriver core: fix potential null-ptr-deref in device"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 672,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/port: Hold port reference until decoder release"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 673,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: kprobe: Fix potential null-ptr-deref on tr"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 674,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: Fix use-after-free in rdata->read_into_pages("
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 685,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysf"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 699,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_h323: Add protection for bm"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 700,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nigb: Do not bring the device up after non-fatal err"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 705,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7921e: fix crash in chip reset fail\n\n"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 717,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rt2x00: Fix memory leak when handling surveys"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 718,
"issues": [
"HTML tags"
],
"text_preview": "Flarum is a forum software for building communities. Flarum's translation system allowed for string inputs to be convert"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 727,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: ensure context reset on disconnect()\n\nAfter "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 739,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: Fix a null-ptr-deref in io_tctx_exit_cb()"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 747,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/fpu: KVM: Set the base guest FPU uABI size to s"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 751,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/hfi1: Fix panic with larger ipoib send_queue_siz"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 755,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qualcomm: rmnet: fix global oob in rmnet_polic"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 758,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix slab-use-after-free Read in l"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 760,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: Fix kernel crash during module removal\n\nThe d"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 761,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp - Fix null pointer dereference in __sev"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 765,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"IB/isert: Fix incorrect release of isert co"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 766,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: x86-android-tablets: Unregister devic"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 769,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: clear acl_access/acl_default after releasing "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 771,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix net_dev_start_xmit trace event vs skb_tran"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 778,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nsock_map: avoid race between sock_map_close and sk_"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 779,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Check the remaining info_cnt before repeating "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 790,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: ip_tunnel: Fix suspicious RCU usage warning i"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 791,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, cpumap: Make sure kthread is running before ma"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 806,
"issues": [
"HTML tags"
],
"text_preview": "xml-crypto is an xml digital signature and encryption library for Node.js. In affected versions the default configuratio"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 808,
"issues": [
"HTML tags"
],
"text_preview": "debug is a JavaScript debugging utility. On 8 September 2025, the npm publishing account for debug was taken over after "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 810,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix wild-memory-access in register_synth_e"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 812,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Lag, fix failure to cancel delayed bond w"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 813,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: equilibrium: fix warning trace on load\n\nTh"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 818,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: gup: stop abusing try_grab_folio\n\nA kernel warn"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 827,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc: Don't try to copy PPR for task with NULL p"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 829,
"issues": [
"HTML tags"
],
"text_preview": "Trivy Action runs Trivy as GitHub action to scan a Docker container image for vulnerabilities. A command injection vulne"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 831,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: add missing cpu_to_node to kvzalloc_node"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 833,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nath11k: free peer for station when disconnect from "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 843,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/debug_vm_pgtable: clear page table entries at de"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 852,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_s"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 854,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/cma: Fix kmemleak in rdma_core observed during"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 856,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/core: Fix use-after-free when rename device na"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 861,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: Fix dropping valid root bus resources with .en"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 869,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gvt: fix vgpu debugfs clean in remove\n\nChe"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 876,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid use f2fs_bug_on() in f2fs_new_no"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 877,
"issues": [
"HTML tags"
],
"text_preview": "The .so library, which is used by , is\nvulnerable to a buffer overflow in the code that handles the "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 888,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: amd_sfh: free driver_data after destroying hid"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 892,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"libfs: fix infinite directory reads for off"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 898,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nath11k: fix the warning of dev_wake in mhi_pm_disab"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 902,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Fix vm_bind_ioctl double free bug\n\nIf the a"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 906,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm: Fix potential null-ptr-deref in drm_vblank_des"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 917,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/pci: Skip to handle RAS errors if CXL.mem devic"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 922,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: xilinx: don't make a sleepable memory all"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 925,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: Do not use WQ_MEM_RECLAIM flag for workqueue\n"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 942,
"issues": [
"HTML tags"
],
"text_preview": "color-convert provides plain color conversion functions in JavaScript. On 8 September 2025, the npm publishing account f"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 947,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nusbnet: gl620a: fix endpoint checking in genelink_b"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 952,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Forcibly leave SMM mode on SHUTDOWN inter"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 963,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: sr: fix out-of-bounds read when setting HMAC "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 965,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"ALSA: firewire-lib: operate for period elap"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 967,
"issues": [
"HTML tags"
],
"text_preview": "Vulnerability in the Oracle Cloud Infrastructure Storage Gateway product of Oracle Storage Gateway (component: Managemen"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 974,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nlib/alloc_tag: do not acquire non-existent lock in "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 979,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm: Fix potential null-ptr-deref due to drmm_mode_"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 993,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix panic due to wrong pageattr of im->image\n\n"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 996,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: release correct delalloc amount in direct IO"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1008,
"issues": [
"HTML tags"
],
"text_preview": "Thinkific Thinkific Online Course Creation Platform 1.0 is affected by: Cross Site Scripting (XSS). The impact is: execu"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1013,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix the qp flush warnings in req\n\nWhen th"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1016,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ncachefiles: Fix KASAN slab-out-of-bounds in cachefi"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1030,
"issues": [
"HTML tags"
],
"text_preview": "Command injection in the parameter of a .exe request leads to remote code execution as the root use"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1039,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfs: fix UAF in direct writes\n\nIn production we hav"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1040,
"issues": [
"HTML tags"
],
"text_preview": "APTRS (Automated Penetration Testing Reporting System) is a Python and Django-based automated reporting tool designed fo"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1046,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: avoid possible NULL deref in rt6_uncached_lis"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1047,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix mlx5e_priv_init() cleanup flow\n\nWhen"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1049,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nigc: don't fail igc_probe() on LED setup error\n\nWhe"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1053,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix NULL pointer dereference in tipc_mon_rein"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1056,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: fix possible race in __fib6_drop_pcpu_from()\n"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1060,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd: Replace snprintf with scnprintf\n\nCurrent code p"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1061,
"issues": [
"HTML tags"
],
"text_preview": "A vulnerability in the processing of traffic matching a firewall filter containing a syslog action in Juniper Networks J"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1062,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: br_netfilter: skip conntrack input hook "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1067,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: udf: fix OOB read in lengthAllocDescs handling\n"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1068,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/fence: Fix oops due to non-matching drm_"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1071,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\natm: Fix NULL pointer dereference\n\nWhen MPOA_cache_"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1072,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix memory leak in ocfs2_mount_volume()\n\nThe"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1078,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: apple: validate feature-report field count to "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1083,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: avoid data corruption on cq descriptor number\n"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1089,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: fix folio is still mapped when deleted\n"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1092,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix NULL deref in mesh_matches_loca"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1102,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix recursive locking in RPC handle list acc"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1113,
"issues": [
"HTML tags"
],
"text_preview": "An authenticated administrator is able to prepare an alert that is able to execute an SSRF attack. This is exclusively w"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1116,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnexthop: Forbid FDB status change while nexthop is "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1117,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/niu: Niu requires MSIX ENTRY_DATA fields touch "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1133,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: Fix the smbd_response slab to allow usercopy\n"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1137,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nidpf: fix adapter NULL pointer dereference on reboo"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1140,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_pci: Fix admin vq cleanup by using correct i"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1146,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: fix memory allocation in nvme_pr_read_keys()\n"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1148,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nidpf: Fix RSS LUT NULL pointer crash on early ethto"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1153,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Track xmit submission to PTP WQ after po"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1162,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm: Check output polling initialized before disabl"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1169,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/pseries/iommu: IOMMU incorrectly marks MMIO"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1170,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid out-of-boundary access in dnode "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1177,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: cros-ec-tunnel: defer probe if parent EC is no"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1179,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Fix debug checking for np-guests using "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1182,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc/uss720: fix memory leak in uss720_probe\n\nuss72"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1192,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Fix use-after-free in acpi_ut_copy_ipackage"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1200,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix warning when putting transaction with qg"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1201,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nusbnet: Fix using smp_processor_id() in preemptible"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1202,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Avoid memory allocation in iommu_suspen"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1219,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ngve: fix incorrect buffer cleanup in gve_tx_clean_p"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1220,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Fix a WARN during dereg_mr for DM type\n\n"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1222,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnbd: fix io hung while disconnecting device\n\nIn our"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1228,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Fix repeated calls to sock_put() when"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1230,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix usage slab after free\n\n[ +0.000021"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1233,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: do not ignore genmask when lo"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1235,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: HCI: Fix global-out-of-bounds\n\nTo loop a"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1236,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: set ATTR_CTIME flags when setting mtime\n\nDav"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1239,
"issues": [
"HTML tags"
],
"text_preview": "The CGI script .sh can be used to download any file on the filesystem.\n\nThis issue affects Iocharger firmware "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1247,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\njffs2: prevent xattr node from overflowing the eras"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1257,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/amd: Improve page fault error reporting\n\nIf I"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1262,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: use spin_lock to avoid hang\n\n[14696.634553] t"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1264,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/imc-pmu: Fix use of mutex in IRQs disabled "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1271,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: hyperv: streamline driver probe to avoid devre"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1272,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibie: don't unroll if fwlog isn't supported\n\nThe l"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1278,
"issues": [
"HTML tags"
],
"text_preview": "soroban-sdk is a Rust SDK for Soroban contracts. Prior to versions 22.0.10, 23.5.2, and 25.1.1, the `#[contractimpl]` ma"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1283,
"issues": [
"HTML tags"
],
"text_preview": "OAuthenticator is an OAuth token library for the JupyerHub login handler. CILogonOAuthenticator is provided by the OAuth"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1301,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ngtp: Fix use-after-free in __gtp_encap_destroy().\n\n"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1302,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: dvm: Fix memcpy: detected field-span"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1305,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: Check the return value of of_proper"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1306,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"f2fs: fix to do sanity check on extent cach"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1307,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ibmvfc: Allocate/free queue resource only dur"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1310,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Free kvm_cpuid_entry2 array on post-KVM_R"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1311,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Fix incorrect autogroup migration detect"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1313,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: test for not too small csum_start in virtio_ne"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1314,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix race in concurrent f2fs_stop_gc_thread\n\nI"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1316,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Fix event leak upon exit\n\nWhen a task is sche"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1319,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: never allow the PM to close a listener subfl"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1330,
"issues": [
"HTML tags"
],
"text_preview": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected ver"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1337,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: fix slab-out-of-bounds read in hfsplus_str"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1340,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\niommufd: Set end correctly when doing batch carry\n\n"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1342,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: class: cdc-wdm: Fix CPU lockup caused by exces"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1348,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nax25: fix incorrect dev_tracker usage\n\nWhile invest"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1354,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: unset the binding mark of a reused connectio"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1355,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Fix possible UAFs\n\nThis attemps to"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1356,
"issues": [
"HTML tags"
],
"text_preview": "After gaining access to the firmware of a charging station, a file at can be accessed to obtain default crede"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1357,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid UAF in f2fs_sync_inode_meta()\n\ns"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1360,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nath11k: mhi: use mhi_sync_power_up()\n\nIf amss.bin w"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1361,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: Fix NULL pointer dereference in ice_vsi_set_na"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1366,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Only create /proc/fs/netfs with CONFIG_PROC_"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1379,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\neth: bnxt: fix kernel panic in the bnxt_get_queue_s"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1390,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_pipapo_avx2: Add irq_fpu_usable("
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1399,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: Fix use-after-free with devm_spi_alloc_*\n\nWe c"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1411,
"issues": [
"HTML tags"
],
"text_preview": "AliasVault is a privacy-first password manager with built-in email aliasing. A server-side request forgery (SSRF) vulner"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1414,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nfscache: Use wait_on_bit() to wait for the freeing "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1418,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_buffers: Fix memory corruptions on "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1419,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Fix aggregation ID mask to prevent oops on"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1425,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix block group refcount race in btrfs_creat"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1438,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: ets: fix divide by zero in the offload p"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1442,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid potential deadlock\n\nAs Jiaming Z"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1447,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: zero-initialize tc skb extension on allocation"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1449,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/pagewalk: fix race between concurrent split and "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1452,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: core: fix possible resource leak in init_mtd()"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1460,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix error propagation of split bios\n\nThe pur"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1462,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid NULL pointer dereference in f2fs"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1469,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/perf: Fix power_pmu_disable to call clear_p"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1472,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mad: Improve handling of timed out WRs of mad "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1478,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Fix double invocation of bnxt_ulp_stop()/b"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1487,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock, bfq: fix bfqq uaf in bfq_limit_depth()\n\nSet "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1488,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: ISST: Fix the KASAN report slab-out-o"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1501,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/huc: Fix fence not released on early probe"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1506,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Fix shift-out-of-bounds in dctcp_update_alpha("
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1507,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: do not accept ACK of bytes we never sent\n\nThis"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1510,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: correct the order of prelim_ref arguments in"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1513,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: vmk80xx: fix incomplete endpoint checking\n\n"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1515,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm cache: free background tracker's queued work in "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1522,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix transaction atomicity bug when enabling "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1526,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, cgroup: Fix kernel BUG in purge_effective_prog"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1534,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/amd: Check event before enable to avoid GP"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1535,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: timer: fix ida_free call while not allocated\n"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1540,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nxdp: produce a warning when calculated tailroom is "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1553,
"issues": [
"HTML tags"
],
"text_preview": "Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, authenticated users"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1559,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix initialization of rx->link and "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1563,
"issues": [
"HTML tags"
],
"text_preview": "Wiki.js is a wiki app built on node.js. Wiki.js 2.5.263 and earlier is vulnerable to stored cross-site scripting through"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1568,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"tty: n_gsm: fix UAF in gsm_cleanup_mux\"\n\nTh"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1570,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: zone: fix to avoid inconsistence in between S"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1571,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\niavf: Fix reset error handling\n\nDo not call iavf_cl"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1574,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nSVM: Check instead of asserting on nested TSC"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1578,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconne"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1579,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Avoid undefined behavior: applying zero off"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1584,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mscc: ocelot: Fix use-after-free caused by cyc"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1585,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_ne"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1587,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/vmalloc: combine all TLB flush operations of KAS"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1592,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fortify the spinlock against deadlo"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1597,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (nct6775) Fix crash in clear_caseopen\n\nPawe\u0142"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1608,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix null deref on srq->rq.queue after res"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1614,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1617,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\natm: clip: Fix NULL pointer dereference in vcc_send"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1623,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: pm8001: Fix abort all task initialization\n\nIn"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1624,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbcon: always restore the old font data in fbcon_do"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1626,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: vidtv: Terminating the subsequent process of"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1642,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: atm: cxacru: fix a flaw in existing endpoint c"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1651,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to do sanity check on i_xattr_nid in sani"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1657,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: add reserved GDT blocks check\n\nWe capture a N"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1660,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix UAF in decryption with multichanne"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1664,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: fix lockdep splat in qdisc_tree_reduce_b"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1670,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: iscsi_tcp: Fix UAF during logout when accessi"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1674,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: avoid crash when parsed profile name is e"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1675,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix use-after-free in btrfs_encoded_read_end"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1679,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix potential null deref in ext4_mb_init()\n\nI"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1682,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Drop oob_skb ref before purging queue in G"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1685,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: fix dma queue left shift overflow issu"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1686,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\npadata: fix UAF in padata_reorder\n\nA bug was found "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1692,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix WARNING in mb_find_extent\n\nSyzbot found t"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1695,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: add NULL check in xfrm_update_ae_params\n\nNorm"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1701,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndst: fix races in rt6_uncached_list_del() and rt_de"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1705,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix mptcp DSS corruption due to large pmtu xmi"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1708,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\neth: bnxt: do not update checksum in bnxt_xdp_build"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1711,
"issues": [
"HTML tags"
],
"text_preview": "Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1720,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/lib: Revert to _ASM_EXTABLE_UA() for {get,put}_"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1725,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/msg_ring: ensure io_kiocb freeing is defer"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1727,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Add overflow check for attribute size\n\nTh"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1730,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/eprobes: Do not allow eprobes to use $stack"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1731,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Don't call cleanup on profile rollback f"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1732,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nblktrace: fix __this_cpu_read/write in preemptible "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1734,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/ttm: fix undefined behavior in bit shift for TT"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1738,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nmpls: Use rcu_dereference_rtnl() in mpls_route_inpu"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1742,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: sar: drop lockdep assertion in rtw89_s"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1746,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix calltrace warning in amddrm_buddy_f"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1749,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv/kprobe: Fix instruction simulation of JALR\n\nS"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1754,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/mremap: fix WARN with uffd that has remap events"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1758,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Silence warning when chunk allocation fail"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1761,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: fix struct pid leaks in OOB support\n\nsyzbo"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1763,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: set the right AMDGPU sg segment limitat"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1764,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm6: check ip6_dst_idev() return value in xfrm6_g"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1765,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nata: libata-core: Fix double free on error\n\nIf e.g."
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1768,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma: xilinx_dpdma: Fix locking\n\nThere are several p"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1784,
"issues": [
"HTML tags"
],
"text_preview": "This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affe"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1785,
"issues": [
"HTML tags"
],
"text_preview": "Cacti is an open source operational monitoring and fault management framework. The fix applied for CVE-2023-39515 in ver"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1787,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: stricter state check in mptcp_worker\n\nAs rep"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1789,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\niommufd: Fix unpinning of pages when an access is p"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1796,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/gup: handle NULL pages in unpin_user_pages()\n\nTh"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1800,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nrpl: Fix use-after-free in rpl_do_srh_inline().\n\nRu"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1808,
"issues": [
"HTML tags"
],
"text_preview": "File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a spec"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1809,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: fix shift-out-of-bounds in hid_report_ra"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1810,
"issues": [
"HTML tags"
],
"text_preview": "Use After Free vulnerability in Apache Arrow C++.\n\nThis issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It ca"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1823,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/47x: Fix 47x syscall return crash\n\nEddie re"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1826,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\njffs2: check that raw node were preallocated before"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1830,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: ivsc: Fix crash at shutdown due to missing m"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1831,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: ts2020: fix null-ptr-deref in ts2020_probe()"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1849,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix race when deleting free space root from "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1851,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/ast: astdp: Fix timeout for enabling video sign"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1852,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: pcl818: fix null-ptr-deref in pcl818_ai_can"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1877,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: rose: fix timer races against user threads\n\nRo"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1878,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: cancel rfkill_block work in wiphy_u"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1879,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: use work to update rate to avoid RCU w"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1884,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/io-wq: Use set_bit() and test_bit() at wor"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1886,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: fix a race in rxrpc_exit_net()\n\nCurrent code"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1890,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nvc_screen: move load of struct vc_data pointer in v"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1892,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfs_common: must not hold RCU while calling nfsd_fi"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1893,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tun: fix tun_napi_alloc_frags()\n\nsyzbot report"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1897,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Fix oops during rmmod on single-CP"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1898,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nrcu: dump vmalloc memory info safely\n\nCurrently, fo"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1910,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/IPoIB: Fix legacy IPoIB due to wrong number of q"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1912,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\njbd2: avoid bug_on in jbd2_journal_get_create_acces"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1915,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/dp: Fix divide-by-zero regression on DP MST unp"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1917,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Don't leave consecutive consumed OOB skbs."
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1920,
"issues": [
"HTML tags"
],
"text_preview": "An Improper Handling of Exceptional Conditions vulnerability in packet processing of Juniper Networks Junos OS on MX Ser"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1927,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Fix event leak upon exec and file release\n\nTh"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1928,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: RISC-V: Remove PERF_HES_STOPPED flag checking"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1934,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hamradio: fix memory leak in mkiss_close\n\nMy l"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1939,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: Intel: sof-nau8825: fix module alias overflow"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1944,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: probes: Fix uprobes for big-endian kernels\n\n"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1946,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtlwifi: Fix global-out-of-bounds bug in _rtl"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1947,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/hfi1: Fix AIP early init panic\n\nAn early failure"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1949,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nDrivers: hv: util: Avoid accessing a ringbuffer not"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1951,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix memory leak in vhci_write\n\nSy"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1963,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nbrd: defer automatic disk creation until module ini"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1966,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Forcibly leave nested virt when SMM state"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1969,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix hang during unmount when stopping a spac"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1988,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vkms: Fix null-ptr-deref in vkms_release()\n\nA n"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1989,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, cpumap: Handle skb as well when clean up ptr_r"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1992,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Validate data run offset\n\nThis adds sanit"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 1999,
"issues": [
"HTML tags"
],
"text_preview": "
A remote code execution vulnerability exists when the Windows Text Service Module improperly handles memory. An attac"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2001,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: fix slab-out-of-bounds read in hfsplus_uni"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2002,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nwriteback: don't block sync for filesystems with no"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2003,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: iptables: Fix null-ptr-deref in iptable_"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2005,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_re: avoid shift undefined behavior in bnxt_qpl"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2006,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: altmode should keep reference to parent"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2007,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Correct the migration DMA map direction"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2011,
"issues": [
"HTML tags"
],
"text_preview": "
Depending on configuration of various package managers it is possible for an attacker to insert a malicious package i"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2013,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: qcom: sdm845: add missing soundwire runtime s"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2015,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: Check the bearer type before calling tipc_udp"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2022,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/pseries/iommu: DLPAR add doesn't completely"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2023,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nvdpa_sim: fix possible memory leak in vdpasim_net_i"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2029,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: flower: fix filter idr initialization\n\nT"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2034,
"issues": [
"HTML tags"
],
"text_preview": "Akeneo PIM is an open source Product Information Management (PIM). Akeneo PIM Community Edition versions before v5.0.119"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2035,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: schedutil: Use kobject release() method to"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2038,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nfou: Fix null-ptr-deref in GRO.\n\nWe observed a null"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2048,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nigc: Fix Kernel Panic during ndo_tx_timeout callbac"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2051,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nRISC-V: KVM: Teardown riscv specific bits after kvm"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2055,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Get source vCPUs from source VM for SEV-E"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2071,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfs: fix missing hfs_bnode_get() in __hfs_bnode_cre"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2072,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nax25: rcu protect dev->ax25_ptr\n\nsyzbot found a loc"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2074,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix crash on probe for DPLL enabled E810 LOM\n\n"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2075,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ntpm: do not start chip while suspended\n\nChecking TP"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2078,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix use-after-free in ext4_orphan_cleanup\n\nI "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2081,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: Add missing bridge lock to pci_bus_lock()\n\nOne"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2082,
"issues": [
"HTML tags"
],
"text_preview": "Decidim is a participatory democracy framework. Starting in version 0.27.0 and prior to versions 0.27.5 and 0.28.0, the "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2085,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\narp: Prevent overflow in arp_req_get().\n\nsyzkaller "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2089,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Unregister notifier on eswitch init failu"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2095,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nerspan: Initialize options_len before referencing o"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2102,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: ip_gre: make ipgre_header() robust\n\nAnalog to"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2103,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp - Fix crash when rebind ccp device for "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2104,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix underflow in second superblock position"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2117,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix double brelse() the buffer of the extents"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2118,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/net_failover: fix txq exceeding warning\n\nThe fa"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2120,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/pseries/iommu: IOMMU table is not initializ"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2132,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nproc: fix UAF in proc_get_inode()\n\nFix race between"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2133,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/pseries: Whitelist dtl slub object for copy"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2134,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ses: Handle enclosure with just a primary com"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2141,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix general protection fault in nilfs_btree"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2146,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ena: fix shift-out-of-bounds in exponential ba"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2151,
"issues": [
"HTML tags"
],
"text_preview": "TensorFlow is an end-to-end open source platform for machine learning. Specifying a negative dense shape in `tf.raw_ops."
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2155,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nquota: fix warning in dqgrab()\n\nThere's issue as fo"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2177,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: ignore xattrs past end\n\nOnce inside 'ext4_xat"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2188,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nthermal/drivers/cpufreq_cooling: Fix slab OOB issue"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2191,
"issues": [
"HTML tags"
],
"text_preview": "
A security feature bypass vulnerability exists in Microsoft Word software when it fails to properly handle .LNK files"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2197,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: fix OOB map writes when deleting elements\n\nJor"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2200,
"issues": [
"HTML tags"
],
"text_preview": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected ver"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2203,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: KVM: Fix stack protector issue in send_i"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2209,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Prevent bpf program recursion for raw tracepoi"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2213,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Avoid using sk_socket after free when"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2217,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nrcutorture: Fix ksoftirqd boosting timing and itera"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2219,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetlink: avoid infinite retry looping in netlink_un"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2223,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-bufio: don't schedule in atomic context\n\nA BUG w"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2227,
"issues": [
"HTML tags"
],
"text_preview": "ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a stored cross-site"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2231,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: Properly hide first-in-list PCIe extended"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2232,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/sseu: fix max_subslices array-index-out-of"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2233,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: send: fix buffer overflow detection when cop"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2237,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix race when deleting quota root from the d"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2245,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_devcd_dump: fix out-of-bounds via de"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2262,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: aggregator: protect driver attr handlers agai"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2264,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bonding: fix use-after-free in bond_xmit_broad"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2265,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix use-after-free in amdgpu_userq_susp"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2268,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Skip Recompute DSC Params if no St"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2274,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: clone set on flush only\n\nSyzb"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2276,
"issues": [
"HTML tags"
],
"text_preview": "Kirby is an open source CMS. An editor with write access to the Kirby Panel can upload an SVG file that contains harmful"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2284,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: check send stream number after wait_for_sndbu"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2287,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/shmem, swap: fix softlockup with mTHP swapin\n\nFo"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2291,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\naio: fix use-after-free due to missing POLLFREE han"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2292,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: Fix NPD in {arp,neigh}_reduce() when using n"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2298,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: vimc: skip .s_stream() for stopped entities\n"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2307,
"issues": [
"HTML tags"
],
"text_preview": "ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a stored cross-site"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2309,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gt: Fix timeline left held on VMA alloc er"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2312,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix WARNING in ext4_update_inline_data\n\nSyzbo"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2313,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nipmr,ip6mr: acquire RTNL before calling ip[6]mr_fre"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2316,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnexthop: Fix memory leaks in nexthop notification c"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2320,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: don't readahead the relocation inode on RST\n"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2325,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix irq-disabled in local_bh_enable()\n\nThe r"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2327,
"issues": [
"HTML tags"
],
"text_preview": "XWiki Platform is a generic wiki platform. The rendered diff in XWiki embeds images to be able to compare the contents a"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2328,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: avoid invalid memory access via node_on"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2342,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nrcu-tasks: Avoid pr_info() with spin lock in cblist"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2346,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned("
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2347,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do not start relocation until in progress dr"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2363,
"issues": [
"HTML tags"
],
"text_preview": "
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a speci"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2365,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix relocation crash due to premature return"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2369,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: remove unnecessary WARN_ON() in implemen"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2380,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/huge_memory: fix dereferencing invalid pmd migra"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2389,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nrcu/nocb: Fix missed RCU barrier on deoffloading\n\nC"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2401,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid accessing uninitialized curseg\n\n"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2409,
"issues": [
"HTML tags"
],
"text_preview": "Plate is a javascript toolkit that makes it easier for you to develop with Slate, a popular framework for building text "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2410,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gma500: Fix BUG: sleeping function called from "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2414,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: rtl8150: enable basic endpoint checking\n\n"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2415,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix BUG_ON condition in btrfs_cancel_balance"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2417,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/mbox: validate payload size before accessing co"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2420,
"issues": [
"HTML tags"
],
"text_preview": "mailcow is a mail server suite based on Dovecot, Postfix and other open source software, that provides a modern web UI f"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2421,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: make fallback action and fallback decision a"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2433,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix slab-use-after-free Read in rxe_queue"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2437,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix lock recursion\n\nafs_wake_up_async_call() c"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2442,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/chrome: cros_usbpd_notify: Fix error handl"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2443,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: fix segfault in nfc_genl_dump_devices_done\n\nWh"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2445,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nmISDN: hfcpci: Fix warning when deleting uninitiali"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2452,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: PAD: fix crash in exit_round_robin()\n\nThe ker"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2455,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd-raid10: fix KASAN warning\n\nThere's a KASAN warni"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2467,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nfsdax: Fix infinite loop in dax_iomap_rw()\n\nI got a"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2469,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ncdrom: rearrange last_media_change check to avoid u"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2480,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: update orig_path in ext4_find_extent()\n\nIn ex"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2482,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: Fix use-after-free bugs caused by sco_so"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2493,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix max_sge overflow in smb_extract_fo"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2496,
"issues": [
"HTML tags"
],
"text_preview": "The .exe or .exe CGI binary can be used to upload arbitrary files to /tmp/upload/ or /tmp/ respectiv"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2510,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Don't store mlx5e_priv in mlx5e_dev devl"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2525,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: mcast: wait for previous gc cycles whe"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2536,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: fix lockdep splat in in6_dump_addrs()\n\nAs rep"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2538,
"issues": [
"HTML tags"
],
"text_preview": "Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2539,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: always keep track of remap prev/next\n\nDurin"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2540,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix NULL pointer dereference in nilfs_pallo"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2552,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: mpt3sas: Fix crash in transport port remove b"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2553,
"issues": [
"HTML tags"
],
"text_preview": "is-arrayish checks if an object can be used like an Array. On 8 September 2025, an npm publishing account for is-arrayis"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2565,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: appleir: Fix potential NULL dereference at raw"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2571,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/hfi1: Fix sdma.h tx->num_descs off-by-one error\n"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2595,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skb_partial_csum_set() fix against transport h"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2598,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/mlx5: Fix UMR pd cleanup on error flow of driver"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2604,
"issues": [
"HTML tags"
],
"text_preview": "When DNS filtering is enabled on Juniper Networks Junos MX Series with one of the following cards MS-PIC, MS-MIC or MS-M"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2608,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: fix ktls panic with sockmap\n\n[ 2172.936997] --"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2611,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ncachefiles: fix memory leak in cachefiles_add_cache"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2613,
"issues": [
"HTML tags"
],
"text_preview": "A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a speci"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2616,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nrcu/kvfree: Fix data-race in __mod_timer / kvfree_c"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2619,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: fix IRQ freeing in i40e_vsi_request_irq_msix "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2623,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Return the firmware result upon destroyi"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2629,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: fq_pie: prevent dismantle issue\n\nFor som"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2633,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Fix WARN_ON in iommu probe path\n\nCommit"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2649,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrash: fix crashkernel resource shrink\n\nWhen crashk"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2663,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: nexthop: allocate skb dynamically in rtm_get_"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2667,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nlib/group_cpus: fix NULL pointer dereference from g"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2671,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: USB: Fix wrong-direction WARNING in plusb.c\n\nT"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2682,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: 8852a: rfk: fix div 0 exception\n\nThe D"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2684,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nrcu: Protect ->defer_qs_iw_pending from data race\n\n"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2687,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/ipoib: Fix mcast list locking\n\nReleasing the `pr"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2689,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: Reset connection when trying to use SMCRv2"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2692,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, lockdown, audit: Fix buggy SELinux lockdown pe"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2699,
"issues": [
"HTML tags"
],
"text_preview": "
An elevation of privilege vulnerability exists in the way that the Wininit.dll handles objects in memory. An attacker"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2701,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nveth: Ensure eth header is in skb's linear part\n\nAf"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2703,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: fix PTE marker handling in hugetlb_chan"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2704,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: macvlan: fix memory leaks of macvlan_common_ne"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2705,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: drop all currently held locks if deadlock "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2708,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid panic in f2fs_evict_inode\n\nAs sy"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2709,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm: fix use-after-free in dm_cleanup_zoned_dev()\n\nd"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2715,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix kernel panic caused by race of smc_soc"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2718,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nsit: do not call ipip6_dev_free() from sit_init_net"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2719,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: core: check uartclk for zero to avoid divid"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2725,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/dp: populate connector of struct dp_panel\n\n"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2739,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nksm: use range-walk function to jump over holes in "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2740,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: avoid to add interface to list twice w"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2744,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nethtool: cmis_cdb: use correct rpl size in ethtool_"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2746,
"issues": [
"HTML tags"
],
"text_preview": "WeGIA is a web manager for charitable institutions. Versions 3.6.6 and below have a Reflected Cross-Site Scripting (XSS)"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2747,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: directly free partially initialized fs_info "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2749,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: i801: Revert \"i2c: i801: replace acpi_lock wit"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2751,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: comedi_8255: Correct error in subdevice ini"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2754,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/fixmap: Fix VM debug warning on unmap\n\nUnma"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2756,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/code-patching: Disable KASAN report during "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2761,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nbfq: Avoid merging queues with different parents\n\nI"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2763,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix a job->pasid access race in gpu rec"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2771,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: Add netif_device_attach/detach into PF reset f"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2775,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix DFS traversal oops without CONFIG_CIFS_DF"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2778,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: wwan: fix global oob in wwan_rtnl_policy\n\nThe "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2780,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix cleanup null-ptr deref on encap lock"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2782,
"issues": [
"HTML tags"
],
"text_preview": "color is a Javascript color conversion and manipulation library. On 8 September 2025, the npm publishing account for col"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2785,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: track AF_XDP ZC enabled queues in bitmap\n\nComm"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2786,
"issues": [
"HTML tags"
],
"text_preview": "TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service by cont"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2795,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: flow_dissector: use DEBUG_NET_WARN_ON_ONCE\n\nTh"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2797,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: prevent use-after-free due to open_cached_dir "
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2799,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nteam: fix check for port enabled in team_queue_over"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2804,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Build event generation tests only as modul"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2811,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nvdpa_sim: avoid putting an uninitialized iova_domai"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2814,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: Fix use-after-free in inet6_addr_del().\n\nsyzb"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2817,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: appletb-kbd: fix memory corruption of input_ha"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2818,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/gup: fix gup_pud_range() for dax\n\nFor dax pud, p"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2821,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\namd/amdkfd: enhance kfd process check in switch par"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2825,
"issues": [
"HTML tags"
],
"text_preview": "Emissary is a P2P based data-driven workflow engine. Affected versions of Emissary are vulnerable to post-authentication"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2826,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: prime: fix ttm_bo_delayed_delete oops\n"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2830,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: check device's attached status in compat io"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2838,
"issues": [
"HTML tags"
],
"text_preview": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix possible UAF in sctp_v6_available()\n\nA lo"
},
{
"file": "llm_annotated_nvd_v2.jsonl",
"line": 2839,
"issues": [
"HTML tags"
],
"text_preview": "The Formidable Form Builder WordPress plugin before 4.09.05 allows to inject certain HTML Tags like