alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Detects PsExec service installation and execution events in logs
Matching passage: Sigma rule: Detects PsExec service installation and execution events. Logsource: windows / system. Rule: title: PsExec Service Installation id: 42c575ea-e41e-41f1-b248-8093c3e82a28 status: test description: Detects PsExec service installation and execution events references: - https://www.jpcert.or.jp/english/pub/sr/ir_research.html - https://jpcertcc.github.io/ToolAnalysisResultSheet author: Thomas Patzke date: 2017-06-12 modified: 2023-08-04 tags: - attack.execution - attack.t1569.002 - attack.s0029 logsource: product: windows service: system detection: selection_eid: Provider_Name: Service Control Manager EventID: 7045 selection_service: - ServiceName: PSEXESVC - ImagePath|endswith: \PSEXESVC.exe condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects an office suit application (Word, Excel, PowerPoint, Outlook) communicating to target systems over uncommon port. Logsource: windows / network_connection. Rule: title: Office Application Initiated Network Connection Over Uncommon Ports id: 3b5ba899-9842-4bc2-acc2-12308498bf42 status: test description: Detects an office suit application (Word, Excel, PowerPoint, Outlook) communicating to target systems over uncommon ports. references: - https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2023-07-12 modified: 2025-10-17 tags: - attack.command-and-control - attack.stealth logsource: category: network_connection product: windows detection: selection: Initiated: 'true' Image|endswith: - \excel.exe - \outlook.exe - \powerpnt.exe - \winword.exe - \wordview.exe filter_main_common_ports: DestinationPort: - 53 - 80 - 139 - 389 - 443 - 445 - 3268 filter_main_outlook_ports: Image|contains: :\Program Files\Microsoft Office\ Image|endswith: \OUTLOOK.EXE DestinationPort: - 143 - 465 - 587 - 993 - 995 condition: selection and not 1 of filter_main_* falsepositives: - Other ports can be used, apply additional filters accordingly level: medium
Query: risk of Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53 and 8.54 allows remote authenticated users to affect confidentiality
Matching passage: CVE-2015-2650. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53 and 8.54 allows remote authenticated users to affect confidentiality via unknown vectors related to Multichannel Framework.
Near-miss passage: CVE-2015-6775. CWE: UNKNOWN. CVSS: 7.5. fpdfsdk/src/jsapi/fxjs_v8.cpp in PDFium, as used in Google Chrome before 47.0.2526.73, does not use signatures, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion."
Query: Sigma YAML for windows / driver_load
Matching passage: Sigma rule: Detects the load of a signed WinRing0 driver often used by threat actors, crypto miners (XMRIG) or malware for privilege. Logsource: windows / driver_load. Rule: title: Vulnerable WinRing0 Driver Load id: 1a42dfa6-6cb2-4df9-9b48-295be477e835 status: test description: Detects the load of a signed WinRing0 driver often used by threat actors, crypto miners (XMRIG) or malware for privilege escalation references: - https://github.com/xmrig/xmrig/tree/master/bin/WinRing0 - https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/ author: Florian Roth (Nextron Systems) date: 2022-07-26 modified: 2024-11-23 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 logsource: product: windows category: driver_load detection: selection: - Hashes|contains: IMPHASH=D41FA95D4642DC981F10DE36F4DC8CD7 - ImageLoaded|endswith: - \WinRing0x64.sys - \WinRing0.sys - \WinRing0.dll - \WinRing0x64.dll - \winring00x64.sys condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects scheduled task creations that have suspicious action command and folder combinations. Logsource: windows / process_creation. Rule: title: Schtasks From Suspicious Folders id: 8a8379b8-780b-4dbf-b1e9-31c8d112fefb status: test description: Detects scheduled task creations that have suspicious action command and folder combinations references: - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lazarus-dream-job-chemical author: Florian Roth (Nextron Systems) date: 2022-04-15 modified: 2022-11-18 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1053.005 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \schtasks.exe - OriginalFileName: schtasks.exe selection_create: CommandLine|contains: ' /create ' selection_command: CommandLine|contains: - powershell - pwsh - 'cmd /c ' - 'cmd /k ' - 'cmd /r ' - 'cmd.exe /c ' - 'cmd.exe /k ' - 'cmd.exe /r ' selection_all_folders: CommandLine|contains: - C:\ProgramData\ - '%ProgramData%' condition: all of selection_* falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-1320
Matching passage: CVE-2015-1320. CWE: CWE-255. CVSS: 9.800000190734863. The SeaMicro provisioning of Ubuntu MAAS logs credentials, including username and password, for the management interface. This issue affects Ubuntu MAAS versions prior to 1.9.2.
Near-miss passage: CVE-2015-2766. CWE: CWE-255. CVSS: 5.0. The Personal Email Manager (PEM) in Websense TRITON AP-EMAIL before 8.0.0 allows attackers to have unspecified impact via a brute force attack.
Query: write Sigma for Detects successful authentication from potential clients using legacy authentication via user agent strings. This could
Matching passage: Sigma rule: Detects successful authentication from potential clients using legacy authentication via user agent strings. This could. Logsource: azure / signinlogs. Rule: title: Potential MFA Bypass Using Legacy Client Authentication id: 53bb4f7f-48a8-4475-ac30-5a82ddfdf6fc status: test description: Detects successful authentication from potential clients using legacy authentication via user agent strings. This could be a sign of MFA bypass using a password spray attack. references: - https://web.archive.org/web/20230217071802/https://blooteem.com/march-2022 - https://www.microsoft.com/en-us/security/blog/2021/10/26/protect-your-business-from-password-sprays-with-microsoft-dart-recommendations/ author: Harjot Singh, '@cyb3rjy0t' date: 2023-03-20 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.credential-access - attack.stealth - attack.t1078.004 - attack.t1110 logsource: product: azure service: signinlogs detection: selection: Status: Success userAgent|contains: - BAV2ROPC - CBAinPROD - CBAinTAR condition: selection falsepositives: - Known Legacy Accounts level: high
Near-miss passage: Sigma rule: Detects when an an application is removed from Google Workspace.. Logsource: gcp / google_workspace.admin. Rule: title: Google Workspace Application Removed id: ee2803f0-71c8-4831-b48b-a1fc57601ee4 status: test description: Detects when an an application is removed from Google Workspace. references: - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3 - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-domain-settings?hl=en#REMOVE_APPLICATION - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-domain-settings?hl=en#REMOVE_APPLICATION_FROM_WHITELIST author: Austin Songer date: 2021-08-26 modified: 2023-10-11 tags: - attack.impact logsource: product: gcp service: google_workspace.admin detection: selection: eventService: admin.googleapis.com eventName: - REMOVE_APPLICATION - REMOVE_APPLICATION_FROM_WHITELIST condition: selection falsepositives: - Application being removed may be performed by a System Administrator. level: medium
Query: ATT&CK technique for Exfiltration Over Bluetooth
Matching passage: T1011.001 Exfiltration Over Bluetooth. Tactics: exfiltration. Description: Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel. If the command and control network is a wired Internet connection, an adversary may opt to exfiltrate data using a Bluetooth communication channel. Adversaries may choose to do this if they have sufficient access and proximity. Bluetooth connections might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.
Near-miss passage: T1011 Exfiltration Over Other Network Medium. Tactics: exfiltration. Description: Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel. If the command and control network is a wired Internet connection, the exfiltration may occur, for example, over a WiFi connection, modem, cellular data connection, Bluetooth, or another radio frequency (RF) channel. Adversaries may choose to do this if they have sufficient access or proximity, and the connection might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.
Query: rule covering Detects the reporting of NTLMv1 being used between a client and server. NTLMv1 is insecure as the underlying encryption
Matching passage: Sigma rule: Detects the reporting of NTLMv1 being used between a client and server. NTLMv1 is insecure as the underlying encryption. Logsource: windows / system. Rule: title: NTLMv1 Logon Between Client and Server id: e9d4ab66-a532-4ef7-a502-66a9e4a34f5d status: test description: Detects the reporting of NTLMv1 being used between a client and server. NTLMv1 is insecure as the underlying encryption algorithms can be brute-forced by modern hardware. references: - https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows10/22H2/W10_22H2_Pro_20230321_19045.2728/WEPExplorer/LsaSrv.xml author: Tim Shelton, Nasreddine Bencherchali (Nextron Systems) date: 2022-04-26 modified: 2023-06-06 tags: - attack.lateral-movement - attack.t1550.002 logsource: product: windows service: system detection: selection: Provider_Name: LsaSrv EventID: - 6038 - 6039 condition: selection falsepositives: - Environments that use NTLMv1 level: medium
Near-miss passage: Sigma rule: Detects creation of files with specific name patterns seen used in various tools that export the NTDS.DIT for exfiltrati. Logsource: windows / file_event. Rule: title: NTDS Exfiltration Filename Patterns id: 3a8da4e0-36c1-40d2-8b29-b3e890d5172a status: test description: Detects creation of files with specific name patterns seen used in various tools that export the NTDS.DIT for exfiltration. references: - https://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/modules/post/windows/gather/ntds_grabber.rb - https://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/data/post/powershell/NTDSgrab.ps1 - https://github.com/SecureAuthCorp/impacket/blob/7d2991d78836b376452ca58b3d14daa61b67cb40/impacket/examples/secretsdump.py#L2405 author: Florian Roth (Nextron Systems) date: 2022-03-11 modified: 2023-05-05 tags: - attack.credential-access - attack.t1003.003 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: - \All.cab - .ntds.cleartext condition: selection falsepositives: - Unknown level: high
Query: explain T1039 Data from Network Shared Drive
Matching passage: T1039 Data from Network Shared Drive. Tactics: collection. Description: Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to Exfiltration. Interactive command shells may be in use, and common functionality within [cmd](https://attack.mitre.org/software/S0106) may be used to gather information.
Near-miss passage: T1557.003 DHCP Spoofing. Tactics: credential access, collection. Description: Adversaries may redirect network traffic to adversary-owned systems by spoofing Dynamic Host Configuration Protocol (DHCP) traffic and acting as a malicious DHCP server on the victim network. By achieving the adversary-in-the-middle (AiTM) position, adversaries may collect network communications, including passed credentials, especially those sent over insecure, unencrypted protocols. This may also enable follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040) or [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002). DHCP is based on a client-server model and has two functionalities: a protocol for providing network configuration settings from a DHCP server to a client and a mechanism for allocating network addresses to clients.(Citation: rfc2131) The typical server-client interaction is as follows: 1. The client broadcasts a `DISCOVER` message. 2. The server responds with an `OFFER` message, which includes an available network address. 3. The client broadcasts a `REQUEST` message, which includes the network address offered. 4. The server acknowledges with an `ACK` message and the client receives the network configuration parameters. Adversaries may spoof as a rogue DHCP server on the victim network, from which legitimate hosts may receive malicious network configurations. For example, malware can act as a DHCP server and provide adversary-owned DNS servers to the victimized computers.(Citation: new_rogue_DHCP_serv_malware)(Citation: w32.tidserv.g) Through the malicious network configurations, an adversary may achieve the AiTM position, route client traffic through adversary-controlled systems, and collect information from the client network. DHCPv6 clients can receive network configuration information without being assigned an IP address by sending a <code>INFORMATION-REQUEST (code 11)</code> message to the <code>All_DHCP_Relay_Agents_and_Servers</code> multicast address.(Citation: rfc3315) Adversaries may
Query: CVE similar to CVE-2015-3947
Matching passage: CVE-2015-3947. CWE: CWE-89. CVSS: 8.100000381469727. SQL injection vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-5078. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the insert function in application/controllers/admin/dataentry.php in LimeSurvey 2.06+ allows remote authenticated users to execute arbitrary SQL commands via the closedate parameter.
Query: detection rule: Detects the execution of a script event consumer. When scrcons.exe launches, it does so in response to the creation of a
Matching passage: Sigma rule: Detects the execution of a script event consumer. When scrcons.exe launches, it does so in response to the creation of a. Logsource: windows / process_creation. Rule: title: WMI Persistence - Script Event Consumer id: ec1d5e28-8f3b-4188-a6f8-6e8df81dc28e status: test description: 'Detects the execution of a script event consumer. When scrcons.exe launches, it does so in response to the creation of an ActiveScriptEventConsumer instance and will execute registered JScript or VBScript code as a result. Script event consumers are a built-in Windows Management Instrumentation (WMI) class that automatically executes a predefined script (in VBScript or JScript) whenever a specific system event occurs. Adversaries often abuse script event consumers to maintain persistence on a compromised host by executing a malicious script whenever a specific event occurs. ' references: - https://redcanary.com/blog/threat-detection/child-processes/ - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/ author: Thomas Patzke date: 2018-03-07 modified: 2022-10-11 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.003 logsource: category: process_creation product: windows detection: selection: Image: C:\WINDOWS\system32\wbem\scrcons.exe ParentImage: C:\Windows\System32\svchost.exe condition: selection falsepositives: - Legitimate event consumers - Dell computers on some versions register an event consumer that is known to cause false positives when brightness is changed by the corresponding keyboard button level: medium
Near-miss passage: Sigma rule: Detects known sensitive file extensions accessed on a network share. Logsource: windows / security. Rule: title: Suspicious Access to Sensitive File Extensions id: 91c945bc-2ad1-4799-a591-4d00198a1215 related: - id: 286b47ed-f6fe-40b3-b3a8-35129acd43bc type: similar status: test description: Detects known sensitive file extensions accessed on a network share references: - Internal Research author: Samir Bousseaden date: 2019-04-03 modified: 2025-10-17 tags: - attack.collection - attack.t1039 logsource: product: windows service: security detection: selection: EventID: 5145 RelativeTargetName|endswith: - .bak - .dmp - .edb - .kirbi - .msg - .nsf - .nst - .oab - .ost - .pst - .rdp condition: selection falsepositives: - Help Desk operator doing backup or re-imaging end user machine or backup software - Users working with these data types or exchanging message files level: medium
Query: describe CVE-2015-4694
Matching passage: CVE-2015-4694. CWE: CWE-22. CVSS: 8.600000381469727. Directory traversal vulnerability in download.php in the Zip Attachments plugin before 1.5.1 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the za_file parameter.
Near-miss passage: CVE-2015-2995. CWE: CWE-22. CVSS: 6.800000190734863. The RdsLogsEntry servlet in SysAid Help Desk before 15.2 does not properly check file extensions, which allows remote attackers to upload and execute arbitrary files via a NULL byte after the extension, as demonstrated by a .war%00 file.
Query: patch priority for CVE-2015-0798
Matching passage: CVE-2015-0798. CWE: CWE-264. CVSS: 5.0. The Reader mode feature in Mozilla Firefox before 37.0.1 on Android, and Desktop Firefox pre-release, does not properly handle privileged URLs, which makes it easier for remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging the ability to bypass the Same Origin Policy.
Near-miss passage: CVE-2015-1688. CWE: CWE-264. CVSS: 6.800000190734863. Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."
Query: vulnerability: Cisco Mobility Services Engine (MSE) 8.0(110.0) allows remote authenticated users to discover the passwords of arbitrary users by (1) reading log files or (2) using an unspecified 
Matching passage: CVE-2015-0673. CWE: CWE-200. CVSS: 4.0. Cisco Mobility Services Engine (MSE) 8.0(110.0) allows remote authenticated users to discover the passwords of arbitrary users by (1) reading log files or (2) using an unspecified GUI feature, aka Bug ID CSCut24792.
Near-miss passage: CVE-2015-5383. CWE: CWE-200. CVSS: 7.5. Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory.
Query: exploit Samsung Security Manager (SSM) before 1.31 allows remote attackers to execute arbitrary code by uploading a file with an HTTP (1) PUT or (2) MOVE request.
Matching passage: CVE-2015-3435. CWE: CWE-264. CVSS: 10.0. Samsung Security Manager (SSM) before 1.31 allows remote attackers to execute arbitrary code by uploading a file with an HTTP (1) PUT or (2) MOVE request.
Near-miss passage: CVE-2015-6413. CWE: CWE-264. CVSS: 4.0. Cisco TelePresence Video Communication Server (VCS) Expressway X8.6 allows remote authenticated users to bypass intended read-only restrictions and upload Tandberg Linux Package (TLP) files by visiting an administrative page, aka Bug ID CSCuw55651.
Query: describe CVE-2015-3726
Matching passage: CVE-2015-3726. CWE: CWE-20. CVSS: 4.599999904632568. The Telephony subsystem in Apple iOS before 8.4 allows physically proximate attackers to execute arbitrary code via a crafted (1) SIM or (2) UIM card.
Near-miss passage: CVE-2015-0638. CWE: CWE-20. CVSS: 7.099999904632568. Cisco IOS 12.2, 12.4, 15.0, 15.2, and 15.3, when a VRF interface is configured, allows remote attackers to cause a denial of service (interface queue wedge) via crafted ICMPv4 packets, aka Bug ID CSCsi02145.
Query: describe CVE-2015-1716
Matching passage: CVE-2015-1716. CWE: CWE-200. CVSS: 5.0. Schannel in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly restrict Diffie-Hellman Ephemeral (DHE) key lengths, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors, aka "Schannel Information Disclosure Vulnerability."
Near-miss passage: CVE-2015-1096. CWE: CWE-200. CVSS: 1.899999976158142. IOHIDFamily in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 allows attackers to obtain sensitive information about kernel memory via a crafted app.