alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection rule: Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also
Matching passage: Sigma rule: Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also. Logsource: azure / riskdetection. Rule: title: Atypical Travel id: 1a41023f-1e70-4026-921a-4d9341a9038e status: test description: Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior. references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#atypical-travel - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-03 tags: - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation - attack.initial-access logsource: product: azure service: riskdetection detection: selection: riskEventType: unlikelyTravel condition: selection falsepositives: - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user. level: high
Near-miss passage: Sigma rule: Detects process dump via legitimate sqldumper.exe binary. Logsource: windows / process_creation. Rule: title: Dumping Process via Sqldumper.exe id: 23ceaf5c-b6f1-4a32-8559-f2ff734be516 status: test description: Detects process dump via legitimate sqldumper.exe binary references: - https://twitter.com/countuponsec/status/910977826853068800 - https://twitter.com/countuponsec/status/910969424215232518 - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Sqldumper/ author: Kirill Kiryanov, oscd.community date: 2020-10-08 modified: 2021-11-27 tags: - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: \sqldumper.exe CommandLine|contains: - '0x0110' - 0x01100:40 condition: selection falsepositives: - Legitimate MSSQL Server actions level: medium
Query: Suspicious Trusted Developer Utilities Proxy Execution execution detected on endpoint
Matching passage: T1127 Trusted Developer Utilities Proxy Execution. Tactics: stealth, execution. Description: Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads. There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering.(Citation: engima0x3 DNX Bypass)(Citation: engima0x3 RCSI Bypass)(Citation: Exploit Monday WinDbg)(Citation: LOLBAS Tracker) These utilities may often be signed with legitimate certificates that allow them to execute on a system and proxy execution of malicious code through a trusted process that effectively bypasses application control solutions. Smart App Control is a feature of Windows that blocks applications it considers potentially malicious from running by verifying unsigned applications against a known safe list from a Microsoft cloud service before executing them.(Citation: Microsoft Smart App Control) However, adversaries may leverage "reputation hijacking" to abuse an operating system’s trust of safe, signed applications that support the execution of arbitrary code. By leveraging [Trusted Developer Utilities Proxy Execution](https://attack.mitre.org/techniques/T1127) to run their malicious code, adversaries may bypass Smart App Control protections.(Citation: Elastic Security Labs)
Near-miss passage: T1127.001 MSBuild. Tactics: stealth, execution. Description: Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio. It handles XML formatted project files that define requirements for loading and building various platforms and configurations.(Citation: MSDN MSBuild) Adversaries can abuse MSBuild to proxy execution of malicious code. The inline task capability of MSBuild that was introduced in .NET version 4 allows for C# or Visual Basic code to be inserted into an XML project file.(Citation: MSDN MSBuild)(Citation: Microsoft MSBuild Inline Tasks 2017) MSBuild will compile and execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is used this way it can execute arbitrary code and bypass application control defenses that are configured to allow MSBuild.exe execution.(Citation: LOLBAS Msbuild)
Query: CVE similar to CVE-2015-8676
Matching passage: CVE-2015-8676. CWE: CWE-119. CVSS: 7.5. Memory leak in Huawei S5300EI, S5300SI, S5310HI, S6300EI/ S2350EI, and S5300LI Campus series switches with software V200R001C00 before V200R001SPH018, V200R002C00 before V200R003SPH011, and V200R003C00 before V200R003SPH011; S9300, S7700, and S9700 Campus series switches with software V200R001C00 before V200R001SPH023, V200R002C00 before V200R003SPH011, and V200R003C00 before V200R003SPH011; and S2300 and S3300 Campus series switches with software V100R006C05 before V100R006SPH022 allows remote attackers to cause a denial of service (memory consumption and reboot) via a large number of ICMPv6 packets.
Near-miss passage: CVE-2015-3669. CWE: CWE-119. CVSS: 6.800000190734863. QT Media Foundation in Apple QuickTime before 7.7.7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, a different vulnerability than CVE-2015-3664 and CVE-2015-3665.
Query: exploit A vulnerability classified as problematic was found in kelvinmo simplexrd up to 3.1.0. This vulnerability affects unknown code of the file simplexrd/simplexrd.class.php. The manipu
Matching passage: CVE-2015-10029. CWE: CWE-611. CVSS: 9.800000190734863. A vulnerability classified as problematic was found in kelvinmo simplexrd up to 3.1.0. This vulnerability affects unknown code of the file simplexrd/simplexrd.class.php. The manipulation leads to xml external entity reference. Upgrading to version 3.1.1 is able to address this issue. The patch is identified as 4c9f2e028523ed705b555eca2c18c64e71f1a35d. It is recommended to upgrade the affected component. VDB-217630 is the identifier assigned to this vulnerability.
Near-miss passage: CVE-2015-7326. CWE: CWE-611. CVSS: 9.800000190734863. XML External Entity (XXE) vulnerability in Milton Webdav before 2.7.0.3.
Query: exploit Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Mem
Matching passage: CVE-2015-2383. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2384 and CVE-2015-2425.
Near-miss passage: CVE-2015-6149. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6147.
Query: write Sigma for Detects the creation of a local hidden user account which should not happen for event ID 4720.
Matching passage: Sigma rule: Detects the creation of a local hidden user account which should not happen for event ID 4720.. Logsource: windows / security. Rule: title: Hidden Local User Creation id: 7b449a5e-1db5-4dd0-a2dc-4e3a67282538 status: test description: Detects the creation of a local hidden user account which should not happen for event ID 4720. references: - https://twitter.com/SBousseaden/status/1387743867663958021 author: Christian Burkard (Nextron Systems) date: 2021-05-03 modified: 2024-01-16 tags: - attack.persistence - attack.t1136.001 logsource: product: windows service: security detection: selection: EventID: 4720 TargetUserName|endswith: $ filter_main_homegroup: TargetUserName: HomeGroupUser$ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects potential DLL sideloading of Python DLL files.. Logsource: windows / image_load. Rule: title: Potential Python DLL SideLoading id: d36f7c12-14a3-4d48-b6b8-774b9c66f44d status: test description: Detects potential DLL sideloading of Python DLL files. references: - https://www.securonix.com/blog/seolurker-attack-campaign-uses-seo-poisoning-fake-google-ads-to-install-malware/ - https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware/ - https://github.com/wietze/HijackLibs/tree/dc9c9f2f94e6872051dab58fbafb043fdd8b4176/yml/3rd_party/python author: Swachchhanda Shrawan Poudel date: 2024-10-06 modified: 2025-08-18 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: - \python39.dll - \python310.dll - \python311.dll - \python312.dll filter_main_default_install_paths: - ImageLoaded|startswith: - C:\Program Files\Python3 - C:\Program Files (x86)\Python3 - ImageLoaded|contains: \AppData\Local\Programs\Python\Python3 filter_optional_visual_studio: ImageLoaded|startswith: C:\Program Files\Microsoft Visual Studio\ filter_optional_anaconda: ImageLoaded|startswith: C:\ProgramData\Anaconda3\ filter_optional_cpython: ImageLoaded|contains: - \cpython\externals\ - \cpython\PCbuild\ filter_optional_pyinstaller: ImageLoaded|startswith: C:\Users ImageLoaded|contains: \AppData\Local\Temp\_MEI filter_main_legit_signature_details: Product: Python Signed: 'true' Description: Python Company: Python Software Foundation condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate software using Python DLLs level: medium
Query: risk of The Graphics Drivers subsystem in Apple OS X before 10.11.1 allows local users to gain privileges or cause a denial of service (kernel memory corruption) via unspecified vectors.
Matching passage: CVE-2015-7021. CWE: CWE-119. CVSS: 7.199999809265137. The Graphics Drivers subsystem in Apple OS X before 10.11.1 allows local users to gain privileges or cause a denial of service (kernel memory corruption) via unspecified vectors.
Near-miss passage: CVE-2015-7634. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-7625, CVE-2015-7626, CVE-2015-7627, CVE-2015-7630, and CVE-2015-7633.
Query: CVE similar to CVE-2015-2821
Matching passage: CVE-2015-2821. CWE: CWE-264. CVSS: 6.5. TYPO3 Neos 1.1.x before 1.1.3 and 1.2.x before 1.2.3 allows remote editors to access, create, and modify content nodes in the workspace of other editors via unspecified vectors.
Near-miss passage: CVE-2015-3083. CWE: CWE-264. CVSS: 6.400000095367432. Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow remote attackers to bypass intended restrictions on filesystem write operations via unspecified vectors, a different vulnerability than CVE-2015-3082 and CVE-2015-3085.
Query: describe CVE-2015-9096
Matching passage: CVE-2015-9096. CWE: CWE-93. CVSS: 6.099999904632568. Net::SMTP in Ruby before 2.4.0 is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring.
Near-miss passage: CVE-2015-9097. CWE: CWE-93. CVSS: 6.099999904632568. The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring.
Query: describe CVE-2015-6021
Matching passage: CVE-2015-6021. CWE: CWE-79. CVSS: 6.099999904632568. Spiceworks Desktop before 2015-12-01 has XSS via an SNMP response.
Near-miss passage: CVE-2015-2101. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Navigate bar in the Navigate module before 6.x-1.1 and 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: detection rule: Identifies use of various commands to query a systems time. This technique may be used before executing a scheduled task
Matching passage: Sigma rule: Identifies use of various commands to query a systems time. This technique may be used before executing a scheduled task. Logsource: windows / process_creation. Rule: title: Discovery of a System Time id: b243b280-65fe-48df-ba07-6ddea7646427 status: test description: Identifies use of various commands to query a systems time. This technique may be used before executing a scheduled task or to discover the time zone of a target system. references: - https://eqllib.readthedocs.io/en/latest/analytics/fcdb99c2-ac3c-4bde-b664-4b336329bed2.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1124/T1124.md author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community date: 2019-10-24 modified: 2022-06-28 tags: - attack.discovery - attack.t1124 logsource: category: process_creation product: windows detection: selection_time: Image|endswith: - \net.exe - \net1.exe CommandLine|contains: time selection_w32tm: Image|endswith: \w32tm.exe CommandLine|contains: tz condition: 1 of selection_* falsepositives: - Legitimate use of the system utilities to discover system time for legitimate reason level: low
Near-miss passage: Sigma rule: Detects potential malicious modification of run keys by winekey or team9 backdoor. Logsource: windows / registry_event. Rule: title: WINEKEY Registry Modification id: b98968aa-dbc0-4a9c-ac35-108363cbf8d5 status: test description: Detects potential malicious modification of run keys by winekey or team9 backdoor references: - https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html author: omkar72 date: 2020-10-30 modified: 2021-11-27 tags: - attack.privilege-escalation - attack.persistence - attack.t1547 logsource: category: registry_event product: windows detection: selection: TargetObject|endswith: Software\Microsoft\Windows\CurrentVersion\Run\Backup Mgr condition: selection falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-20067
Matching passage: CVE-2015-20067. CWE: CWE-862. CVSS: 7.5. The WP Attachment Export WordPress plugin before 0.2.4 does not have proper access controls, allowing unauthenticated users to download the XML data that holds all the details of attachments/posts on a Wordpress
Near-miss passage: CVE-2015-8840. CWE: CWE-862. CVSS: 8.800000190734863. The XML Data Archiving Service (XML DAS) in SAP NetWeaver AS Java does not check authorization, which allows remote authenticated users to obtain sensitive information, gain privileges, or possibly have unspecified other impact via requests to (1) webcontent/cas/cas_enter.jsp, (2) webcontent/cas/cas_validate.jsp, or (3) webcontent/aas/aas_store.jsp, aka SAP Security Note 1945215.
Query: patch priority for CVE-2015-7894
Matching passage: CVE-2015-7894. CWE: CWE-119. CVSS: 8.800000190734863. The DCMProvider service in Samsung LibQjpeg on a Samsung SM-G925V device running build number LRX22G.G925VVRU1AOE2 allows remote attackers to cause a denial of service (segmentation fault and process crash) and execute arbitrary code via a crafted JPG.
Near-miss passage: CVE-2015-3828. CWE: CWE-119. CVSS: 10.0. The MPEG4Extractor::parse3GPPMetaData function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not enforce a minimum size for UTF-16 strings containing a Byte Order Mark (BOM), which allows remote attackers to execute arbitrary code or cause a denial of service (integer underflow and memory corruption) via crafted 3GPP metadata, aka internal bug 20923261, a related issue to CVE-2015-3826.
Query: Suspicious Data from Network Shared Drive execution detected on endpoint
Matching passage: T1039 Data from Network Shared Drive. Tactics: collection. Description: Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to Exfiltration. Interactive command shells may be in use, and common functionality within [cmd](https://attack.mitre.org/software/S0106) may be used to gather information.
Near-miss passage: T1074.002 Remote Data Staging. Tactics: collection. Description: Adversaries may stage data collected from multiple systems in a central location or directory on one system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location. In cloud environments, adversaries may stage data within a particular instance or virtual machine before exfiltration. An adversary may [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002) and stage data in that instance.(Citation: Mandiant M-Trends 2020) By staging data on one system prior to Exfiltration, adversaries can minimize the number of connections made to their C2 server and better evade detection.
Query: describe CVE-2015-2596
Matching passage: CVE-2015-2596. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in Oracle Java SE 7u80 allows remote attackers to affect integrity via unknown vectors related to Hotspot.
Near-miss passage: CVE-2015-3371. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in the Node Invite module before 6.x-2.5 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the destination parameter.
Query: Sigma rule for Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privile
Matching passage: Sigma rule: Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privile. Logsource: linux / auditd. Rule: title: Potential Abuse of Linux Magic System Request Key id: ea61bb82-a5e0-42e6-8537-91d29500f1b9 status: experimental description: 'Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes, or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf. ' references: - https://www.kernel.org/doc/html/v4.10/_sources/admin-guide/sysrq.txt - https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/4/html/reference_guide/s3-proc-sys-kernel - https://www.splunk.com/en_us/blog/security/threat-update-awfulshred-script-wiper.html author: Milad Cheraghi date: 2025-05-23 tags: - attack.execution - attack.t1059.004 - attack.impact - attack.t1529 - attack.t1489 - attack.t1499 logsource: product: linux service: auditd definition: 'Required auditd configuration: -w /proc/sysrq-trigger -p wa -k sysrq -w /proc/sys/kernel/sysrq -p wa -k sysrq ' detection: selection: type: PATH name|endswith: - /sysrq - /sysctl.conf - /sysrq-trigger condition: selection falsepositives: - Legitimate administrative activity level: medium
Near-miss passage: Sigma rule: Use of hostname to get information. Logsource: windows / process_creation. Rule: title: Suspicious Execution of Hostname id: 7be5fb68-f9ef-476d-8b51-0256ebece19e status: test description: Use of hostname to get information references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1082/T1082.md#atomic-test-6---hostname-discovery-windows - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/hostname author: frack113 date: 2022-01-01 tags: - attack.discovery - attack.t1082 logsource: category: process_creation product: windows detection: selection: Image|endswith: \HOSTNAME.EXE condition: selection falsepositives: - Unknown level: low
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects regsvr32 execution to download and install DLLs located remotely where the address is an IP address.. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Regsvr32 HTTP IP Pattern id: 2dd2c217-bf68-437a-b57c-fe9fd01d5de8 status: test description: Detects regsvr32 execution to download and install DLLs located remotely where the address is an IP address. references: - https://twitter.com/mrd0x/status/1461041276514623491 - https://twitter.com/tccontre18/status/1480950986650832903 - https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/ author: Florian Roth (Nextron Systems) date: 2022-01-11 modified: 2023-05-24 tags: - attack.stealth - attack.t1218.010 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \regsvr32.exe - OriginalFileName: REGSVR32.EXE selection_ip: CommandLine|contains: - ' /i:http://1' - ' /i:http://2' - ' /i:http://3' - ' /i:http://4' - ' /i:http://5' - ' /i:http://6' - ' /i:http://7' - ' /i:http://8' - ' /i:http://9' - ' /i:https://1' - ' /i:https://2' - ' /i:https://3' - ' /i:https://4' - ' /i:https://5' - ' /i:https://6' - ' /i:https://7' - ' /i:https://8' - ' /i:https://9' - ' -i:http://1' - ' -i:http://2' - ' -i:http://3' - ' -i:http://4' - ' -i:http://5' - ' -i:http://6' - ' -i:http://7' - ' -i:http://8' - ' -i:http://9' - ' -i:https://1' - ' -i:https://2' - ' -i:https://3' - ' -i:https://4' - ' -i:https://5' - ' -i:https://6' - ' -i:https://7' - ' -i:https://8' - ' -i:https://9' condition: all of selection_* falsepositives: - FQDNs that start with a number such as "7-Zip" level: high
Near-miss passage: Sigma rule: Detects the creation of a local hidden user account which should not happen for event ID 4720.. Logsource: windows / security. Rule: title: Hidden Local User Creation id: 7b449a5e-1db5-4dd0-a2dc-4e3a67282538 status: test description: Detects the creation of a local hidden user account which should not happen for event ID 4720. references: - https://twitter.com/SBousseaden/status/1387743867663958021 author: Christian Burkard (Nextron Systems) date: 2021-05-03 modified: 2024-01-16 tags: - attack.persistence - attack.t1136.001 logsource: product: windows service: security detection: selection: EventID: 4720 TargetUserName|endswith: $ filter_main_homegroup: TargetUserName: HomeGroupUser$ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high