alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Detects attempts to modify the registry using VBScript's CreateObject("Wscript.shell") and RegWrite methods via common L
Matching passage: Sigma rule: Detects attempts to modify the registry using VBScript's CreateObject("Wscript.shell") and RegWrite methods via common L. Logsource: windows / process_creation. Rule: title: Registry Modification Attempt Via VBScript id: 921aa10f-2e74-4cca-9498-98f9ca4d6fdf related: - id: 2a0a169d-cc66-43ce-9ae2-6e678e54e46a type: similar - id: 7f4c43f9-b1a5-4c7d-b24a-b41bf3a3ebf2 type: similar status: experimental description: 'Detects attempts to modify the registry using VBScript''s CreateObject("Wscript.shell") and RegWrite methods via common LOLBINs. It could be an attempt to modify the registry for persistence without using straightforward methods like regedit.exe, reg.exe, or PowerShell. Threat Actors may use this technique to evade detection by security solutions that monitor for direct registry modifications through traditional tools. ' references: - https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity-7344801774182051843-TE00/ - https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/ date: 2025-08-13 author: Swachchhanda Shrawan Poudel (Nextron Systems) tags: - attack.persistence - attack.execution - attack.defense-impairment - attack.t1112 - attack.t1059.005 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - CreateObject - Wscript.shell - .RegWrite condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may. Logsource: windows / process_creation. Rule: title: Changing Existing Service ImagePath Value Via Reg.EXE id: 9b0b7ac3-6223-47aa-a3fd-e8f211e637db status: test description: 'Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start. Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.011/T1574.011.md#atomic-test-2---service-imagepath-change-with-regexe author: frack113 date: 2021-12-30 modified: 2024-03-13 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.011 logsource: category: process_creation product: windows detection: selection: Image|endswith: \reg.exe CommandLine|contains|all: - 'add ' - SYSTEM\CurrentControlSet\Services\ - ' ImagePath ' selection_value: CommandLine|contains|windash: ' -d ' condition: all of selection* falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-2550
Matching passage: CVE-2015-2550. CWE: CWE-264. CVSS: 7.199999809265137. The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka "Windows Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-8236. CWE: CWE-264. CVSS: 10.0. Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.1 allows remote attackers to execute arbitrary code as root by leveraging management-plane access, aka Bug 138716.
Query: detection rule: Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with th
Matching passage: Sigma rule: Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with th. Logsource: windows / process_creation. Rule: title: AgentExecutor PowerShell Execution id: 7efd2c8d-8b18-45b7-947d-adfe9ed04f61 related: - id: c0b40568-b1e9-4b03-8d6c-b096da6da9ab type: similar status: test description: Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with the ExecutionPolicy "Bypass" or any binary named "powershell.exe" located in the path provided by 6th positional argument author: Nasreddine Bencherchali (Nextron Systems), memory-shards references: - https://twitter.com/lefterispan/status/1286259016436514816 - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Agentexecutor/ - https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension - https://twitter.com/jseerden/status/1247985304667066373/photo/1 date: 2022-12-24 modified: 2024-08-07 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image: \AgentExecutor.exe - OriginalFileName: AgentExecutor.exe selection_cli: CommandLine|contains: - ' -powershell' - ' -remediationScript' filter_main_intune: ParentImage|endswith: \Microsoft.Management.Services.IntuneWindowsAgent.exe condition: all of selection_* and not 1 of filter_main_* falsepositives: - Legitimate use via Intune management. You exclude script paths and names to reduce FP rate level: medium
Near-miss passage: Sigma rule: Detects a suspicious curl process start on linux with set useragent options. Logsource: linux / process_creation. Rule: title: Suspicious Curl Change User Agents - Linux id: b86d356d-6093-443d-971c-9b07db583c68 related: - id: 3286d37a-00fd-41c2-a624-a672dcd34e60 type: derived status: test description: Detects a suspicious curl process start on linux with set useragent options references: - https://curl.se/docs/manpage.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-15 tags: - attack.command-and-control - attack.t1071.001 logsource: category: process_creation product: linux detection: selection: Image|endswith: /curl CommandLine|contains: - ' -A ' - ' --user-agent ' condition: selection falsepositives: - Scripts created by developers and admins - Administrative activity level: medium
Query: rule covering Detects listing of the inodes of the "/" directory to determine if the we are running inside of a container.
Matching passage: Sigma rule: Detects listing of the inodes of the "/" directory to determine if the we are running inside of a container.. Logsource: linux / process_creation. Rule: title: Potential Container Discovery Via Inodes Listing id: 43e26eb5-cd58-48d1-8ce9-a273f5d298d8 status: test description: Detects listing of the inodes of the "/" directory to determine if the we are running inside of a container. references: - https://blog.skyplabs.net/posts/container-detection/ - https://stackoverflow.com/questions/20010199/how-to-determine-if-a-process-runs-inside-lxc-docker tags: - attack.discovery - attack.t1082 author: Seth Hanford date: 2023-08-23 modified: 2025-11-24 logsource: category: process_creation product: linux detection: selection_ls_img: Image|endswith: /ls selection_ls_cli: - CommandLine|endswith: ' /' - CommandLine|contains: ' / ' selection_regex_inode: CommandLine|re: (?:\s-[^-\s]{0,20}i|\s--inode\s) selection_regex_dir: CommandLine|re: (?:\s-[^-\s]{0,20}d|\s--directory\s) condition: all of selection_* falsepositives: - Legitimate system administrator usage of these commands - Some container tools or deployments may use these techniques natively to determine how they proceed with execution, and will need to be filtered level: low
Near-miss passage: Sigma rule: Detects the registration of a new ODBC driver where the driver is located in a potentially suspicious location. Logsource: windows / registry_set. Rule: title: Potentially Suspicious ODBC Driver Registered id: e4d22291-f3d5-4b78-9a0c-a1fbaf32a6a4 status: test description: Detects the registration of a new ODBC driver where the driver is located in a potentially suspicious location references: - https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-23 modified: 2023-08-17 tags: - attack.credential-access - attack.persistence - attack.t1003 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \SOFTWARE\ODBC\ODBCINST.INI\ TargetObject|endswith: - \Driver - \Setup Details|contains: - :\PerfLogs\ - :\ProgramData\ - :\Temp\ - :\Users\Public\ - :\Windows\Registration\CRMLog - :\Windows\System32\com\dmp\ - :\Windows\System32\FxsTmp\ - :\Windows\System32\Microsoft\Crypto\RSA\MachineKeys\ - :\Windows\System32\spool\drivers\color\ - :\Windows\System32\spool\PRINTERS\ - :\Windows\System32\spool\SERVERS\ - :\Windows\System32\Tasks_Migrated\ - :\Windows\System32\Tasks\Microsoft\Windows\SyncCenter\ - :\Windows\SysWOW64\com\dmp\ - :\Windows\SysWOW64\FxsTmp\ - :\Windows\SysWOW64\Tasks\Microsoft\Windows\PLA\System\ - :\Windows\SysWOW64\Tasks\Microsoft\Windows\SyncCenter\ - :\Windows\Tasks\ - :\Windows\Temp\ - :\Windows\Tracing\ - \AppData\Local\Temp\ - \AppData\Roaming\ condition: selection falsepositives: - Unlikely level: high
Query: patch priority for CVE-2015-5089
Matching passage: CVE-2015-5089. CWE: CWE-200. CVSS: 5.0. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2014-8450, CVE-2015-4449, CVE-2015-4450, CVE-2015-5088, and CVE-2015-5092.
Near-miss passage: CVE-2015-1165. CWE: CWE-200. CVSS: 5.0. RT (aka Request Tracker) 3.8.8 through 4.x before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to obtain sensitive RSS feed URLs and ticket data via unspecified vectors.
Query: Encoded PowerShell / command-line abuse matching Compile After Delivery
Matching passage: T1027.004 Compile After Delivery. Tactics: stealth. Description: Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as ilasm.exe(Citation: ATTACK IQ), csc.exe, or GCC/MinGW.(Citation: ClearSky MuddyWater Nov 2018) Source code payloads may also be encrypted, encoded, and/or embedded within other files, such as those delivered as a [Phishing](https://attack.mitre.org/techniques/T1566). Payloads may also be delivered in formats unrecognizable and inherently benign to the native OS (ex: EXEs on macOS/Linux) before later being (re)compiled into a proper executable binary with a bundled compiler and execution framework.(Citation: TrendMicro WindowsAppMac)
Near-miss passage: T1027.013 Encrypted/Encoded File. Tactics: stealth. Description: Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection. Encrypting and/or encoding file content aims to conceal malicious artifacts within a file used in an intrusion. Many other techniques, such as [Software Packing](https://attack.mitre.org/techniques/T1027/002), [Steganography](https://attack.mitre.org/techniques/T1027/003), and [Embedded Payloads](https://attack.mitre.org/techniques/T1027/009), share this same broad objective. Encrypting and/or encoding files could lead to a lapse in detection of static signatures, only for this malicious content to be revealed (i.e., [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140)) at the time of execution/use. This type of file obfuscation can be applied to many file artifacts present on victim hosts, such as malware log/configuration and payload files.(Citation: File obfuscation) Files can be encrypted with a hardcoded or user-supplied key, as well as otherwise obfuscated using standard encoding schemes such as Base64. The entire content of a file may be obfuscated, or just specific functions or values (such as C2 addresses). Encryption and encoding may also be applied in redundant layers for additional protection. For example, adversaries may abuse password-protected Word documents or self-extracting (SFX) archives as a method of encrypting/encoding a file such as a [Phishing](https://attack.mitre.org/techniques/T1566) payload. These files typically function by attaching the intended archived content to a decompressor stub that is executed when the file is invoked (e.g., [User Execution](https://attack.mitre.org/techniques/T1204)).(Citation: SFX - Encrypted/Encoded File) Adversaries may also abuse file-specific as well as custom encoding schemes. For example, Byte Order Mark (BOM) headers in text files may be abused to manipulate and obfuscate file content until [Command and Scripting Interpreter](https://attack.mitre.org/techn
Query: vulnerability: QT Media Foundation in Apple QuickTime before 7.7.7, as used in OS X before 10.10.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of servi
Matching passage: CVE-2015-3663. CWE: CWE-119. CVSS: 6.800000190734863. QT Media Foundation in Apple QuickTime before 7.7.7, as used in OS X before 10.10.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, a different vulnerability than CVE-2015-3661, CVE-2015-3662, CVE-2015-3666, CVE-2015-3667, and CVE-2015-3668.
Near-miss passage: CVE-2015-8662. CWE: CWE-119. CVSS: 7.300000190734863. The ff_dwt_decode function in libavcodec/jpeg2000dwt.c in FFmpeg before 2.8.4 does not validate the number of decomposition levels before proceeding with Discrete Wavelet Transform decoding, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG 2000 data.
Query: vulnerability: The communication module on the Hospira LifeCare PCA Infusion System before 7.0 does not require authentication for root TELNET sessions, which allows remote attackers to modify th
Matching passage: CVE-2015-3459. CWE: CWE-264. CVSS: 10.0. The communication module on the Hospira LifeCare PCA Infusion System before 7.0 does not require authentication for root TELNET sessions, which allows remote attackers to modify the pump configuration via unspecified commands.
Near-miss passage: CVE-2015-1293. CWE: CWE-264. CVSS: 7.5. The DOM implementation in Blink, as used in Google Chrome before 45.0.2454.85, allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
Query: CVE similar to CVE-2015-5420
Matching passage: CVE-2015-5420. CWE: UNKNOWN. CVSS: 7.5. Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2880.
Near-miss passage: CVE-2015-0990. CWE: UNKNOWN. CVSS: 4.400000095367432. Untrusted search path vulnerability in Ecava IntegraXor SCADA Server before 4.2.4488 allows local users to gain privileges via a renamed DLL in the default install directory.
Query: Outbound C2 pattern associated with System Location Discovery
Matching passage: T1614 System Location Discovery. Tactics: discovery. Description: Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from [System Location Discovery](https://attack.mitre.org/techniques/T1614) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Adversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings.(Citation: FBI Ragnar Locker 2020)(Citation: Sophos Geolocation 2016)(Citation: Bleepingcomputer RAT malware 2020) Windows API functions such as <code>GetLocaleInfoW</code> can also be used to determine the locale of the host.(Citation: FBI Ragnar Locker 2020) In cloud environments, an instance's availability zone may also be discovered by accessing the instance metadata service from the instance.(Citation: AWS Instance Identity Documents)(Citation: Microsoft Azure Instance Metadata 2021) Adversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.(Citation: Securelist Trasparent Tribe 2020)(Citation: Sophos Geolocation 2016)
Near-miss passage: T1614.001 System Language Discovery. Tactics: discovery. Description: Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host. This information may be used to shape follow-on behaviors, including whether the adversary infects the target and/or attempts specific actions. This decision may be employed by malware developers and operators to reduce their risk of attracting the attention of specific law enforcement agencies or prosecution/scrutiny from other entities.(Citation: Malware System Language Check) There are various sources of data an adversary could use to infer system language, such as system defaults and keyboard layouts. Specific checks will vary based on the target and/or adversary, but may involve behaviors such as [Query Registry](https://attack.mitre.org/techniques/T1012) and calls to [Native API](https://attack.mitre.org/techniques/T1106) functions.(Citation: CrowdStrike Ryuk January 2019) For example, on a Windows system adversaries may attempt to infer the language of a system by querying the registry key <code>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language</code> or parsing the outputs of Windows API functions <code>GetUserDefaultUILanguage</code>, <code>GetSystemDefaultUILanguage</code>, <code>GetKeyboardLayoutList</code> and <code>GetUserDefaultLangID</code>.(Citation: Darkside Ransomware Cybereason)(Citation: Securelist JSWorm)(Citation: SecureList SynAck Doppelgänging May 2018) On a macOS or Linux system, adversaries may query <code>locale</code> to retrieve the value of the <code>$LANG</code> environment variable.
Query: vulnerability: Directory traversal vulnerability in Joomla! 3.2.0 through 3.3.x and 3.4.x before 3.4.6 allows remote attackers to have unspecified impact via unknown vectors.
Matching passage: CVE-2015-8565. CWE: CWE-20. CVSS: 7.5. Directory traversal vulnerability in Joomla! 3.2.0 through 3.3.x and 3.4.x before 3.4.6 allows remote attackers to have unspecified impact via unknown vectors.
Near-miss passage: CVE-2015-7234. CWE: CWE-20. CVSS: 4.0. The OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the OSF Ontology and OSF Import modules are enabled, allows user-assisted remote attackers to delete arbitrary files via unspecified vectors.
Query: vulnerability: Unspecified vulnerability in the PeopleSoft Enterprise HCM Talent Acquisition Management component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect con
Matching passage: CVE-2015-4804. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the PeopleSoft Enterprise HCM Talent Acquisition Management component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Security.
Near-miss passage: CVE-2015-3276. CWE: UNKNOWN. CVSS: 7.5. The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors.
Query: describe CVE-2015-5855
Matching passage: CVE-2015-5855. CWE: CWE-200. CVSS: 4.300000190734863. Apple iOS before 9 allows attackers to discover the e-mail address of a player via a crafted Game Center app.
Near-miss passage: CVE-2015-1828. CWE: CWE-200. CVSS: 5.900000095367432. The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack.
Query: patch priority for CVE-2015-5537
Matching passage: CVE-2015-5537. CWE: CWE-312. CVSS: 4.300000190734863. The SSL layer of the HTTPS service in Siemens RuggedCom ROS before 4.2.0 and ROX II does not properly implement CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a different vulnerability than CVE-2014-3566.
Near-miss passage: CVE-2015-1931. CWE: CWE-312. CVSS: 5.5. IBM Java Security Components in IBM SDK, Java Technology Edition 8 before SR1 FP10, 7 R1 before SR3 FP10, 7 before SR9 FP10, 6 R1 before SR8 FP7, 6 before SR16 FP7, and 5.0 before SR16 FP13 stores plaintext information in memory dumps, which allows local users to obtain sensitive information by reading a file.
Query: Sigma rule for Detects the creation of a new service using the "sc.exe" utility.
Matching passage: Sigma rule: Detects the creation of a new service using the "sc.exe" utility.. Logsource: windows / process_creation. Rule: title: New Service Creation Using Sc.EXE id: 85ff530b-261d-48c6-a441-facaa2e81e48 related: - id: c02e96b7-c63a-4c47-bd83-4a9f74afcfb2 type: similar status: test description: Detects the creation of a new service using the "sc.exe" utility. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1543.003/T1543.003.md author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community date: 2023-02-20 modified: 2025-09-01 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 logsource: category: process_creation product: windows detection: selection: Image|endswith: \sc.exe CommandLine|contains|all: - create - binPath filter_optional_dropbox: ParentImage|startswith: - C:\Program Files (x86)\Dropbox\Client\ - C:\Program Files\Dropbox\Client\ ParentImage|endswith: \Dropbox.exe condition: selection and not 1 of filter_optional_* falsepositives: - Legitimate administrator or user creates a service for legitimate reasons. - Software installation level: low
Near-miss passage: Sigma rule: Detects possible command execution by web application/web shell. Logsource: linux / auditd. Rule: title: Webshell Remote Command Execution id: c0d3734d-330f-4a03-aae2-65dacc6a8222 status: test description: Detects possible command execution by web application/web shell references: - Personal Experience of the Author - https://www.vaadata.com/blog/what-is-command-injection-exploitations-and-security-best-practices/ author: Ilyas Ochkov, Beyu Denis, oscd.community date: 2019-10-12 modified: 2025-12-05 tags: - attack.persistence - attack.t1505.003 logsource: product: linux service: auditd definition: 'Required auditd configuration: -a always,exit -F arch=b32 -S execve -F euid=33 -k detect_execve_www -a always,exit -F arch=b64 -S execve -F euid=33 -k detect_execve_www -a always,exit -F arch=b32 -S execveat -F euid=33 -k detect_execve_www -a always,exit -F arch=b64 -S execveat -F euid=33 -k detect_execve_www Change the number "33" to the ID of your WebServer user. Default: www-data:x:33:33 ' detection: selection: type: SYSCALL SYSCALL: - execve - execveat euid: 33 condition: selection falsepositives: - Admin activity - Crazy web applications level: critical