alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering A General detection for sdclt being spawned as an elevated process. This could be an indicator of sdclt being used for b
Matching passage: Sigma rule: A General detection for sdclt being spawned as an elevated process. This could be an indicator of sdclt being used for b. Logsource: windows / process_creation. Rule: title: Potential UAC Bypass Via Sdclt.EXE id: 40f9af16-589d-4984-b78d-8c2aec023197 status: test description: A General detection for sdclt being spawned as an elevated process. This could be an indicator of sdclt being used for bypass UAC techniques. references: - https://github.com/OTRF/detection-hackathon-apt29/issues/6 - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.B.2_C36B49B5-DF58-4A34-9FE9-56189B9DEFEA.md author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-05-02 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: Image|endswith: sdclt.exe IntegrityLevel: - High - S-1-16-12288 condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects usage of the `mknod` syscall to create special files (e.g., character or block devices). Attackers or malware mi. Logsource: linux / auditd. Rule: title: Special File Creation via Mknod Syscall id: 710bdbce-495d-491d-9a8f-7d0d88d2b41e status: experimental description: 'Detects usage of the `mknod` syscall to create special files (e.g., character or block devices). Attackers or malware might use `mknod` to create fake devices, interact with kernel interfaces, or establish covert channels in Linux systems. Monitoring the use of `mknod` is important because this syscall is rarely used by legitimate applications, and it can be abused to bypass file system restrictions or create backdoors. ' references: - https://man7.org/linux/man-pages/man2/mknod.2.html - https://hopeness.medium.com/master-the-linux-mknod-command-a-comprehensive-guide-1c150a546aa8 author: Milad Cheraghi date: 2025-05-31 modified: 2025-12-05 tags: - attack.privilege-escalation - attack.persistence - attack.t1543.003 logsource: product: linux service: auditd detection: selection: type: SYSCALL SYSCALL: mknod condition: selection falsepositives: - Device creation by legitimate scripts or init systems (udevadm, MAKEDEV) - Container runtimes or security tools during initialization level: low
Query: alert when Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove model safety controls and allow u
Matching passage: Sigma rule: Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove model safety controls and allow u. Logsource: aws / cloudtrail. Rule: title: AWS Bedrock Guardrail Deleted id: 59b70e4d-dd17-44a9-b740-acf07ae3eb6a status: experimental description: 'Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove model safety controls and allow unsafe or unauthorized model responses. ' references: - https://docs.aws.amazon.com/bedrock/latest/APIReference/API_DeleteGuardrail.html author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) date: 2026-07-10 tags: - attack.defense-impairment - attack.t1685 logsource: product: aws service: cloudtrail detection: selection: eventName: DeleteGuardrail eventSource: bedrock.amazonaws.com condition: selection falsepositives: - Legitimate guardrail deletion by authorized identities. level: medium
Near-miss passage: Sigma rule: Detects remote thread creation in the "mstsc.exe" process by a process located in a potentially suspicious location. Thi. Logsource: windows / create_remote_thread. Rule: title: Remote Thread Creation In Mstsc.Exe From Suspicious Location id: c0aac16a-b1e7-4330-bab0-3c27bb4987c7 status: test description: 'Detects remote thread creation in the "mstsc.exe" process by a process located in a potentially suspicious location. This technique is often used by attackers in order to hook some APIs used by DLLs loaded by "mstsc.exe" during RDP authentications in order to steal credentials. ' references: - https://github.com/S12cybersecurity/RDPCredentialStealer/blob/1b8947cdd065a06c1b62e80967d3c7af895fcfed/APIHookInjectorBin/APIHookInjectorBin/Inject.h#L25 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-07-28 modified: 2024-01-22 tags: - attack.credential-access logsource: product: windows category: create_remote_thread detection: selection: TargetImage|endswith: \mstsc.exe SourceImage|contains: - :\Temp\ - :\Users\Public\ - :\Windows\PerfLogs\ - :\Windows\Tasks\ - :\Windows\Temp\ - \AppData\Local\Temp\ condition: selection falsepositives: - Unknown level: high
Query: Sigma rule for Detects the creation of the file "rootlog" which is used by the TripleCross rootkit as a way to check if the backdoor is
Matching passage: Sigma rule: Detects the creation of the file "rootlog" which is used by the TripleCross rootkit as a way to check if the backdoor is. Logsource: linux / file_event. Rule: title: Triple Cross eBPF Rootkit Default LockFile id: c0239255-822c-4630-b7f1-35362bcb8f44 status: test description: Detects the creation of the file "rootlog" which is used by the TripleCross rootkit as a way to check if the backdoor is already running. references: - https://github.com/h3xduck/TripleCross/blob/1f1c3e0958af8ad9f6ebe10ab442e75de33e91de/src/helpers/execve_hijack.c#L33 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-05 modified: 2022-12-31 tags: - attack.stealth logsource: product: linux category: file_event detection: selection: TargetFilename: /tmp/rootlog condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detect suspicious Kerberos TGT requests. Once an attacer obtains a computer certificate by abusing Active Directory Cert. Logsource: windows / security. Rule: title: PetitPotam Suspicious Kerberos TGT Request id: 6a53d871-682d-40b6-83e0-b7c1a6c4e3a5 status: test description: 'Detect suspicious Kerberos TGT requests. Once an attacer obtains a computer certificate by abusing Active Directory Certificate Services in combination with PetitPotam, the next step would be to leverage the certificate for malicious purposes. One way of doing this is to request a Kerberos Ticket Granting Ticket using a tool like Rubeus. This request will generate a 4768 event with some unusual fields depending on the environment. This analytic will require tuning, we recommend filtering Account_Name to the Domain Controller computer accounts. ' references: - https://github.com/topotam/PetitPotam - https://isc.sans.edu/forums/diary/Active+Directory+Certificate+Services+ADCS+PKI+domain+admin+vulnerability/27668/ - https://github.com/splunk/security_content/blob/88d689fe8a055d8284337b9fad5d9152b42043db/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml author: Mauricio Velazco, Michael Haag date: 2021-09-02 modified: 2022-10-05 tags: - attack.credential-access - attack.t1187 logsource: product: windows service: security definition: The advanced audit policy setting "Account Logon > Kerberos Authentication Service" must be configured for Success/Failure detection: selection: EventID: 4768 TargetUserName|endswith: $ CertThumbprint|contains: '*' filter_local: IpAddress: ::1 filter_thumbprint: CertThumbprint: '' condition: selection and not 1 of filter_* falsepositives: - False positives are possible if the environment is using certificates for authentication. We recommend filtering Account_Name to the Domain Controller computer accounts. level: high
Query: Multiple failed authentications followed by Lateral Tool Transfer
Matching passage: T1570 Lateral Tool Transfer. Tactics: lateral movement. Description: Adversaries may transfer tools or other files between systems in a compromised environment. Once brought into the victim environment (i.e., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) files may then be copied from one system to another to stage adversary tools or other files over the course of an operation. Adversaries may copy files between internal victim systems to support lateral movement using inherent file sharing protocols such as file sharing over [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) to connected network shares or with authenticated connections via [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001).(Citation: Unit42 LockerGoga 2019) Files can also be transferred using native or otherwise present tools on the victim system, such as scp, rsync, curl, sftp, and [ftp](https://attack.mitre.org/software/S0095). In some cases, adversaries may be able to leverage [Web Service](https://attack.mitre.org/techniques/T1102)s such as Dropbox or OneDrive to copy files from one machine to another via shared, automatically synced folders.(Citation: Dropbox Malware Sync)
Near-miss passage: T1021.001 Remote Desktop Protocol. Tactics: lateral movement. Description: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user. Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).(Citation: TechNet Remote Desktop Services) Adversaries may connect to a remote system over RDP/RDS to expand access if the service is enabled and allows access to accounts with known credentials. Adversaries will likely use Credential Access techniques to acquire credentials to use with RDP. Adversaries may also use RDP in conjunction with the [Accessibility Features](https://attack.mitre.org/techniques/T1546/008) or [Terminal Services DLL](https://attack.mitre.org/techniques/T1505/005) for Persistence.(Citation: Alperovitch Malware)
Query: patch priority for CVE-2015-8484
Matching passage: CVE-2015-8484. CWE: CWE-264. CVSS: 5.400000095367432. Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to bypass intended calendar-viewing restrictions via unspecified vectors, a different vulnerability than CVE-2015-8485, CVE-2015-8486, and CVE-2016-1152.
Near-miss passage: CVE-2015-5498. CWE: CWE-264. CVSS: 5.0. The Shipwire API module 7.x-1.x before 7.x-1.03 for Drupal does not check the view permission for the shipments overview (admin/shipwire/shipments), which allows remote attackers to obtain sensitive information via a request to the page.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Matching passage: CVE-2015-3948. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-0668. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the administration portal in Cisco WebEx Meetings Server 2.5 and 2.5.99.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCuq66737.
Query: alert when Detects when a GitHub Pages site of a repository is made public. This usually is part of a publishing process but could
Matching passage: Sigma rule: Detects when a GitHub Pages site of a repository is made public. This usually is part of a publishing process but could. Logsource: github / audit. Rule: title: GitHub Repository Pages Site Changed to Public id: 0c46d4f4-a2bf-4104-9597-8d653fc2bb55 status: experimental description: 'Detects when a GitHub Pages site of a repository is made public. This usually is part of a publishing process but could indicate or lead to potential unauthorized exposure of sensitive information or code. ' references: - https://docs.github.com/en/pages/getting-started-with-github-pages/creating-a-github-pages-site - https://www.sentinelone.com/blog/exploiting-repos-6-ways-threat-actors-abuse-github-other-devops-platforms - https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events author: Ivan Saakov date: 2025-10-18 tags: - attack.collection - attack.exfiltration - attack.t1567.001 logsource: product: github service: audit detection: selection: action: repo.pages_public condition: selection falsepositives: - Legitimate publishing of repository pages by authorized users level: low
Near-miss passage: Sigma rule: Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class. Logsource: windows / image_load. Rule: title: Potential DCOM InternetExplorer.Application DLL Hijack - Image Load id: f354eba5-623b-450f-b073-0b5b2773b6aa related: - id: e554f142-5cf3-4e55-ace9-a1b59e0def65 type: obsolete - id: 2f7979ae-f82b-45af-ac1d-2b10e93b0baa type: similar status: test description: Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class references: - https://threathunterplaybook.com/hunts/windows/201009-RemoteDCOMIErtUtilDLLHijack/notebook.html author: Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR), wagga date: 2020-10-12 modified: 2022-12-18 tags: - attack.lateral-movement - attack.t1021.002 - attack.t1021.003 logsource: product: windows category: image_load detection: selection: Image|endswith: \Internet Explorer\iexplore.exe ImageLoaded|endswith: \Internet Explorer\iertutil.dll condition: selection falsepositives: - Unknown level: critical
Query: detection rule: Detects a suspicious command line execution that invokes PowerShell with reference to an AppData folder
Matching passage: Sigma rule: Detects a suspicious command line execution that invokes PowerShell with reference to an AppData folder. Logsource: windows / process_creation. Rule: title: PowerShell Script Run in AppData id: ac175779-025a-4f12-98b0-acdaeb77ea85 status: test description: Detects a suspicious command line execution that invokes PowerShell with reference to an AppData folder references: - https://twitter.com/JohnLaTwC/status/1082851155481288706 - https://app.any.run/tasks/f87f1c4e-47e2-4c46-9cf4-31454c06ce03 author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community date: 2019-01-09 modified: 2022-07-14 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection1: CommandLine|contains: - powershell.exe - \powershell - \pwsh - pwsh.exe selection2: CommandLine|contains|all: - '/c ' - \AppData\ CommandLine|contains: - Local\ - Roaming\ condition: all of selection* falsepositives: - Administrative scripts level: medium
Near-miss passage: Sigma rule: Detects the image load of VSS DLL by uncommon executables. Logsource: windows / image_load. Rule: title: Suspicious Volume Shadow Copy Vssapi.dll Load id: 37774c23-25a1-4adb-bb6d-8bb9fd59c0f8 related: - id: 333cdbe8-27bb-4246-bf82-b41a0dca4b70 type: similar - id: 48bfd177-7cf2-412b-ad77-baf923489e82 type: similar status: test description: Detects the image load of VSS DLL by uncommon executables references: - https://github.com/ORCx41/DeleteShadowCopies author: frack113 date: 2022-10-31 modified: 2026-05-18 tags: - attack.impact - attack.t1490 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \vssapi.dll filter_main_windows: - Image: - C:\Windows\explorer.exe - C:\Windows\ImmersiveControlPanel\SystemSettings.exe - Image|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\Temp\{ - C:\Windows\WinSxS\ - C:\$WinREAgent\Scratch\ filter_main_program_files: Image|startswith: - C:\Program Files\ - C:\Program Files (x86)\ filter_main_null_image: Image: null filter_optional_programdata_packagecache: Image|startswith: C:\ProgramData\Package Cache\ filter_optional_avira: Image|contains|all: - \temp\is- - \avira_system_speedup.tmp condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: high
Query: intelligence brief on T1048
Matching passage: T1048 Exfiltration Over Alternative Protocol. Tactics: exfiltration. Description: Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel. Adversaries may also opt to encrypt and/or obfuscate these alternate channels. [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048) can be done using various common operating system utilities such as [Net](https://attack.mitre.org/software/S0039)/SMB or FTP.(Citation: Palo Alto OilRig Oct 2016) On macOS and Linux <code>curl</code> may be used to invoke protocols such as HTTP/S or FTP/S to exfiltrate data from a system.(Citation: 20 macOS Common Tools and Techniques) Many IaaS and SaaS platforms (such as Microsoft Exchange, Microsoft SharePoint, GitHub, and AWS S3) support the direct download of files, emails, source code, and other sensitive information via the web console or [Cloud API](https://attack.mitre.org/techniques/T1059/009).
Near-miss passage: T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol. Tactics: exfiltration. Description: Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.(Citation: copy_cmd_cisco) Adversaries may opt to obfuscate this data, without the use of encryption, within network protocols that are natively unencrypted (such as HTTP, FTP, or DNS). This may include custom or publicly available encoding/compression algorithms (such as base64) as well as embedding data within protocol headers and fields.
Query: exploit Array index error in the tcm_vhost_make_tpg function in drivers/vhost/scsi.c in the Linux kernel before 4.0 might allow guest OS users to cause a denial of service (memory corrupti
Matching passage: CVE-2015-4036. CWE: CWE-119. CVSS: 7.199999809265137. Array index error in the tcm_vhost_make_tpg function in drivers/vhost/scsi.c in the Linux kernel before 4.0 might allow guest OS users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted VHOST_SCSI_SET_ENDPOINT ioctl call. NOTE: the affected function was renamed to vhost_scsi_make_tpg before the vulnerability was announced.
Near-miss passage: CVE-2015-3681. CWE: CWE-119. CVSS: 6.800000190734863. Apple Type Services (ATS) in Apple OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-3679, CVE-2015-3680, and CVE-2015-3682.
Query: risk of Cross-site scripting (XSS) vulnerability in the amoCRM module 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified HTTP 
Matching passage: CVE-2015-7304. CWE: CWE-79. CVSS: 2.5999999046325684. Cross-site scripting (XSS) vulnerability in the amoCRM module 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified HTTP POST data.
Near-miss passage: CVE-2015-6387. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Cisco Unified Computing System (UCS) Central Software 1.3(0.1) allows remote attackers to inject arbitrary web script or HTML via a crafted value in a URL, aka Bug ID CSCux33573.
Query: patch priority for CVE-2015-5754
Matching passage: CVE-2015-5754. CWE: CWE-362. CVSS: 9.300000190734863. Race condition in runner in Install.framework in the Install Framework Legacy component in Apple OS X before 10.10.5 allows attackers to execute arbitrary code in a privileged context via a crafted app that leverages incorrect privilege dropping associated with a locking error.
Near-miss passage: CVE-2015-8963. CWE: CWE-362. CVSS: 7.0. Race condition in kernel/events/core.c in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging incorrect handling of an swevent data structure during a CPU unplug operation.
Query: vulnerability: The authentication_agent_new function in polkitbackend/polkitbackendinteractiveauthority.c in PolicyKit (aka polkit) before 0.113 allows local users to cause a denial of service (N
Matching passage: CVE-2015-3218. CWE: UNKNOWN. CVSS: 2.0999999046325684. The authentication_agent_new function in polkitbackend/polkitbackendinteractiveauthority.c in PolicyKit (aka polkit) before 0.113 allows local users to cause a denial of service (NULL pointer dereference and polkitd daemon crash) by calling RegisterAuthenticationAgent with an invalid object path.
Near-miss passage: CVE-2015-4773. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Hyperion Common Security component in Oracle Hyperion 11.1.2.2, 11.1.2.3, and 11.1.2.4 allows remote authenticated users to affect availability via unknown vectors related to User Account Update.
Query: Sigma YAML for windows / ps_script
Matching passage: Sigma rule: Detects calls to "Add-Content" cmdlet in order to modify the content of the user profile and potentially adding suspicio. Logsource: windows / ps_script. Rule: title: Potential Persistence Via PowerShell User Profile Using Add-Content id: 05b3e303-faf0-4f4a-9b30-46cc13e69152 status: test description: Detects calls to "Add-Content" cmdlet in order to modify the content of the user profile and potentially adding suspicious commands for persistence references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.013/T1546.013.md author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2021-08-18 modified: 2023-05-04 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.013 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_add: ScriptBlockText|contains: Add-Content $profile selection_options: ScriptBlockText|contains: - '-Value "IEX ' - -Value "Invoke-Expression - -Value "Invoke-WebRequest - -Value "Start-Process - '-Value ''IEX ' - -Value 'Invoke-Expression - -Value 'Invoke-WebRequest - -Value 'Start-Process condition: all of selection_* falsepositives: - Legitimate administration and tuning scripts that aim to add functionality to a user PowerShell session level: medium
Near-miss passage: Sigma rule: Detects the occurrence of numerous space characters in RunMRU registry paths, which may indicate execution via phishing. Logsource: windows / registry_set. Rule: title: Suspicious Space Characters in RunMRU Registry Path - ClickFix id: 7a1b4c5e-8f3d-4b9a-7c2e-1f4a5b8c6d9e related: - id: 3ae9974a-eb09-4044-8e70-8980a50c12c8 type: similar status: experimental description: 'Detects the occurrence of numerous space characters in RunMRU registry paths, which may indicate execution via phishing lures using clickfix techniques to hide malicious commands in the Windows Run dialog box from naked eyes. ' references: - https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/ - https://github.com/JohnHammond/recaptcha-phish author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-04 tags: - attack.execution - attack.stealth - attack.t1204.004 - attack.t1027.010 logsource: category: registry_set product: windows detection: selection_key: TargetObject|contains: \Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU\ Details|contains: '#' selection_space_variation: Details|contains: - - - - - - - - - - - - - ' ' condition: all of selection_* falsepositives: - Unlikely level: high