alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Detects activity when the settings of the Windows firewall have been changed
Matching passage: Sigma rule: Detects activity when the settings of the Windows firewall have been changed. Logsource: windows / firewall-as. Rule: title: Windows Firewall Settings Have Been Changed id: 00bb5bd5-1379-4fcf-a965-a5b6f7478064 status: test description: Detects activity when the settings of the Windows firewall have been changed references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10) author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2022-02-19 modified: 2023-04-21 tags: - attack.defense-impairment - attack.t1686.003 logsource: product: windows service: firewall-as detection: selection: EventID: - 2002 - 2083 - 2003 - 2082 - 2008 condition: selection level: low
Near-miss passage: Sigma rule: Detects DNS queries for "anonfiles.com", which is an anonymous file upload platform often used for malicious purposes. Logsource: windows / dns_query. Rule: title: DNS Query for Anonfiles.com Domain - Sysmon id: 065cceea-77ec-4030-9052-fc0affea7110 related: - id: 29f171d7-aa47-42c7-9c7b-3c87938164d9 type: similar status: test description: Detects DNS queries for "anonfiles.com", which is an anonymous file upload platform often used for malicious purposes references: - https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbyte author: pH-T (Nextron Systems) date: 2022-07-15 modified: 2023-01-16 tags: - attack.exfiltration - attack.t1567.002 logsource: product: windows category: dns_query detection: selection: QueryName|contains: .anonfiles.com condition: selection falsepositives: - Rare legitimate access to anonfiles.com level: high
Query: exploit Multiple cross-site request forgery (CSRF) vulnerabilities in Wing FTP Server before 4.4.7 allow remote attackers to hijack the authentication of administrators for requests that (
Matching passage: CVE-2015-4108. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in Wing FTP Server before 4.4.7 allow remote attackers to hijack the authentication of administrators for requests that (1) execute arbitrary code via a crafted request to admin_lua_script.html or (2) add a domain administrator via a crafted request to admin_addadmin.html.
Near-miss passage: CVE-2015-7407. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in Lotus Mashups in IBM Mashup Center 3.0.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Query: describe CVE-2015-9445
Matching passage: CVE-2015-9445. CWE: CWE-352. CVSS: 8.800000190734863. The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin-ajax.php in a unitegallery_ajax_action operation.
Near-miss passage: CVE-2015-2905. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability on Actiontec GT784WN modems with firmware before NCS01-1.0.13 allows remote attackers to hijack the authentication or intranet connectivity of arbitrary users.
Query: Sigma rule for Detects the use of the RunXCmd tool to execute commands with System or TrustedInstaller accounts
Matching passage: Sigma rule: Detects the use of the RunXCmd tool to execute commands with System or TrustedInstaller accounts. Logsource: windows / process_creation. Rule: title: PUA - RunXCmd Execution id: 93199800-b52a-4dec-b762-75212c196542 status: test description: Detects the use of the RunXCmd tool to execute commands with System or TrustedInstaller accounts references: - https://www.d7xtech.com/free-software/runx/ - https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/ author: Florian Roth (Nextron Systems) date: 2022-01-24 modified: 2023-02-14 tags: - attack.execution - attack.t1569.002 - attack.s0029 logsource: category: process_creation product: windows detection: selection_account: CommandLine|contains: - ' /account=system ' - ' /account=ti ' selection_exec: CommandLine|contains: /exec= condition: all of selection_* falsepositives: - Legitimate use by administrators level: high
Near-miss passage: Sigma rule: Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy. Logsource: windows / process_creation. Rule: title: Potential Suspicious Activity Using SeCEdit id: c2c76b77-32be-4d1f-82c9-7e544bdfe0eb status: test description: Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy references: - https://blueteamops.medium.com/secedit-and-i-know-it-595056dee53d - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/secedit author: Janantha Marasinghe date: 2022-11-18 modified: 2022-12-30 tags: - attack.collection - attack.discovery - attack.persistence - attack.credential-access - attack.privilege-escalation - attack.execution - attack.stealth - attack.defense-impairment - attack.t1685.001 - attack.t1547.001 - attack.t1505.005 - attack.t1556.002 - attack.t1685 - attack.t1574.007 - attack.t1564.002 - attack.t1546.008 - attack.t1546.007 - attack.t1547.014 - attack.t1547.010 - attack.t1547.002 - attack.t1557 - attack.t1082 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \secedit.exe - OriginalFileName: SeCEdit selection_flags_discovery: CommandLine|contains|all: - /export - /cfg selection_flags_configure: CommandLine|contains|all: - /configure - /db condition: selection_img and (1 of selection_flags_*) falsepositives: - Legitimate administrative use level: medium
Query: describe CVE-2015-5957
Matching passage: CVE-2015-5957. CWE: CWE-119. CVSS: 10.0. Buffer overflow in the DumpSysVar function in var.c in Remind before 3.1.15 allows attackers to have unspecified impact via a long name.
Near-miss passage: CVE-2015-0100. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Query: write Sigma for Detect use of scrobj.dll as this DLL looks for the ScriptletURL key to get the location of the script to execute
Matching passage: Sigma rule: Detect use of scrobj.dll as this DLL looks for the ScriptletURL key to get the location of the script to execute. Logsource: windows / registry_set. Rule: title: Potential Persistence Via Scrobj.dll COM Hijacking id: fe20dda1-6f37-4379-bbe0-a98d400cae90 status: test description: Detect use of scrobj.dll as this DLL looks for the ScriptletURL key to get the location of the script to execute references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1546.015/T1546.015.md author: frack113 date: 2022-08-20 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.015 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: InprocServer32\(Default) Details: C:\WINDOWS\system32\scrobj.dll condition: selection falsepositives: - Legitimate use of the dll. level: medium
Near-miss passage: Sigma rule: Detects installation of new certificate on the system which attackers may use to avoid warnings when connecting to contr. Logsource: linux / process_creation. Rule: title: Install Root Certificate id: 78a80655-a51e-4669-bc6b-e9d206a462ee status: test description: Detects installation of new certificate on the system which attackers may use to avoid warnings when connecting to controlled web servers or C2s references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md author: Ömer Günal, oscd.community date: 2020-10-05 modified: 2022-07-07 tags: - attack.defense-impairment - attack.t1553.004 logsource: product: linux category: process_creation detection: selection: Image|endswith: - /update-ca-certificates - /update-ca-trust condition: selection falsepositives: - Legitimate administration activities level: low
Query: describe CVE-2015-8820
Matching passage: CVE-2015-8820. CWE: CWE-787. CVSS: 8.800000190734863. Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (out-of-bounds read and memory corruption) via crafted MPEG-4 data, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, CVE-2015-8451, CVE-2015-8455, CVE-2015-8652, CVE-2015-8654, CVE-2015-8656, CVE-2015-8657, and CVE-2015-8658.
Near-miss passage: CVE-2015-5627. CWE: CWE-787. CVSS: 9.800000190734863. Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry R3.09.50 and earlier, CENTUM VP R5.04.20 and earlier, CENTUM VP Entry R5.04.20 and earlier, ProSafe-RS R3.02.10 and earlier, Exaopc R3.72.00 and earlier, Exaquantum R2.85.00 and earlier, Exaquantum/Batch R2.50.30 and earlier, Exapilot R3.96.10 and earlier, Exaplog R3.40.00 and earlier, Exasmoc R4.03.20 and earlier, Exarqe R4.03.20 and earlier, Field Wireless Device OPC Server R2.01.02 and earlier, PRM R3.12.00 and earlier, STARDOM VDS R7.30.01 and earlier, STARDOM OPC Server for Windows R3.40 and earlier, FAST/TOOLS R10.01 and earlier, B/M9000CS R5.05.01 and earlier, B/M9000 VP R7.03.04 and earlier, and FieldMate R1.01 or R1.02 allows remote attackers to cause a denial of service (process outage) via a crafted packet.
Query: vulnerability: IniNet embeddedWebServer (aka eWebServer) before 2.02 mishandles URL encoding, which allows remote attackers to write to or delete files via a crafted string.
Matching passage: CVE-2015-1002. CWE: UNKNOWN. CVSS: 6.400000095367432. IniNet embeddedWebServer (aka eWebServer) before 2.02 mishandles URL encoding, which allows remote attackers to write to or delete files via a crafted string.
Near-miss passage: CVE-2015-6712. CWE: UNKNOWN. CVSS: 6.800000190734863. The ANSendApprovalToAuthorEnabled method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7616, CVE-2015-7618, CVE-2015-7619, CVE-2015-7620, and CVE-2015-7623.
Query: patch priority for CVE-2015-1541
Matching passage: CVE-2015-1541. CWE: CWE-284. CVSS: 4.300000190734863. The AppWidgetServiceImpl implementation in com/android/server/appwidget/AppWidgetServiceImpl.java in the Settings application in Android before 5.1.1 LMY48I allows attackers to obtain a URI permission via an application that sends an Intent with a (1) FLAG_GRANT_READ_URI_PERMISSION or (2) FLAG_GRANT_WRITE_URI_PERMISSION flag, as demonstrated by bypassing intended restrictions on reading contacts, aka internal bug 19618745.
Near-miss passage: CVE-2015-7895. CWE: CWE-284. CVSS: 5.5. Samsung Gallery on the Samsung Galaxy S6 allows local users to cause a denial of service (process crash).
Query: CVE similar to CVE-2015-9351
Matching passage: CVE-2015-9351. CWE: CWE-20. CVSS: 9.800000190734863. The feed-them-social plugin before 1.7.0 for WordPress has possible shortcode execution in the Facebook Feeds load more button.
Near-miss passage: CVE-2015-6243. CWE: CWE-20. CVSS: 4.300000190734863. The dissector-table implementation in epan/packet.c in Wireshark 1.12.x before 1.12.7 mishandles table searches for empty strings, which allows remote attackers to cause a denial of service (application crash) via a crafted packet, related to the (1) dissector_get_string_handle and (2) dissector_get_default_string_handle functions.
Query: write Sigma for Detect modification of TreatAs key to enable "rundll32.exe -sta" command
Matching passage: Sigma rule: Detect modification of TreatAs key to enable "rundll32.exe -sta" command. Logsource: windows / registry_set. Rule: title: COM Hijacking via TreatAs id: dc5c24af-6995-49b2-86eb-a9ff62199e82 status: test description: Detect modification of TreatAs key to enable "rundll32.exe -sta" command references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1546.015/T1546.015.md - https://www.youtube.com/watch?v=3gz1QmiMhss&t=1251s author: frack113 date: 2022-08-28 modified: 2025-07-11 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.015 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: TreatAs\(Default) filter_office: Image|startswith: C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ Image|endswith: \OfficeClickToRun.exe filter_office2: Image: - C:\Program Files\Microsoft Office\root\integration\integrator.exe - C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe filter_svchost: Image: C:\Windows\system32\svchost.exe filter_misexec: Image: - C:\Windows\system32\msiexec.exe - C:\Windows\SysWOW64\msiexec.exe condition: selection and not 1 of filter_* falsepositives: - Legitimate use level: medium
Near-miss passage: Sigma rule: Detects a highly relevant Antivirus alert that reports a hack tool or other attack tool. This event must not be ignored. Logsource: antivirus. Rule: title: Antivirus - Hacktool Signature id: fa0c05b6-8ad3-468d-8231-c1cbccb64fba status: stable description: 'Detects a highly relevant Antivirus alert that reports a hack tool or other attack tool. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place. ' references: - https://www.nextron-systems.com/2021/08/16/antivirus-event-analysis-cheat-sheet-v1-8-2/ - https://www.nextron-systems.com/?s=antivirus author: Florian Roth (Nextron Systems), Arnim Rupp date: 2021-08-16 modified: 2026-06-15 tags: - attack.execution - attack.t1204 logsource: category: antivirus detection: selection: - Signature|startswith: - ATK/ - Exploit.Script.CVE - HKTL - HTOOL - PWS. - PWSX - SecurityTool - Signature|contains: - Adfind - BloodH - BloodyAD - Brutel - BruteR - Cobalt - COBEACON - Cometer - DumpCreds - EDRfreeze - FastReverseProxy - Hacktool - Havoc - Impacket - Keylogger - Koadic - Mimikatz - Nighthawk - PentestPowerShell - Potato - PowerSploit - PowerSSH - PshlSpy - PSWTool - PWCrack - PWDump - Responder - Rozena - Rusthound - Sbelt - Seatbelt - SecurityTool - SharpDump - SharpHound - Shellcode - Sliver - Snaffler - SOAPHound - Splinter - Stowaway - Swrort - Trojan.Hound - TurtleLoader - Undefend - Undfnd condition: selection falsepositives: - Unlikely level: high
Query: patch priority for CVE-2015-8338
Matching passage: CVE-2015-8338. CWE: CWE-254. CVSS: 7.199999809265137. Xen 4.6.x and earlier does not properly enforce limits on page order inputs for the (1) XENMEM_increase_reservation, (2) XENMEM_populate_physmap, (3) XENMEM_exchange, and possibly other HYPERVISOR_memory_op suboperations, which allows ARM guest OS administrators to cause a denial of service (CPU consumption, guest reboot, or watchdog timeout and host reboot) and possibly have unspecified other impact via unknown vectors.
Near-miss passage: CVE-2015-3750. CWE: CWE-254. CVSS: 6.400000095367432. WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not enforce the HTTP Strict Transport Security (HSTS) protection mechanism for Content Security Policy (CSP) report requests, which allows man-in-the-middle attackers to obtain sensitive information by sniffing the network or spoof a report by modifying the client-server data stream.
Query: alert when Detects the use of SharpUp, a tool for local privilege escalation
Matching passage: Sigma rule: Detects the use of SharpUp, a tool for local privilege escalation. Logsource: windows / process_creation. Rule: title: HackTool - SharpUp PrivEsc Tool Execution id: c484e533-ee16-4a93-b6ac-f0ea4868b2f1 status: test description: Detects the use of SharpUp, a tool for local privilege escalation references: - https://github.com/GhostPack/SharpUp author: Florian Roth (Nextron Systems) date: 2022-08-20 modified: 2023-02-13 tags: - attack.persistence - attack.privilege-escalation - attack.discovery - attack.execution - attack.stealth - attack.t1615 - attack.t1569.002 - attack.t1574.005 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \SharpUp.exe - Description: SharpUp - CommandLine|contains: - HijackablePaths - UnquotedServicePath - ProcessDLLHijack - ModifiableServiceBinaries - ModifiableScheduledTask - DomainGPPPassword - CachedGPPPassword condition: selection falsepositives: - Unknown level: critical
Near-miss passage: Sigma rule: Attempts to load dismcore.dll after dropping it. Logsource: windows / image_load. Rule: title: UAC Bypass With Fake DLL id: a5ea83a7-05a5-44c1-be2e-addccbbd8c03 status: test description: Attempts to load dismcore.dll after dropping it references: - https://steemit.com/utopian-io/@ah101/uac-bypassing-utility author: oscd.community, Dmitry Uchakin date: 2020-10-06 modified: 2022-12-25 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1548.002 - attack.t1574.001 logsource: category: image_load product: windows detection: selection: Image|endswith: \dism.exe ImageLoaded|endswith: \dismcore.dll filter: ImageLoaded: C:\Windows\System32\Dism\dismcore.dll condition: selection and not filter falsepositives: - Actions of a legitimate telnet client level: high
Query: vulnerability: An Information Disclosure vulnerability exists in HP SiteScope 11.2 and 11.3 on Windows, Linux and Solaris, HP Asset Manager 9.30 through 9.32, 9.40 through 9.41, 9.50, and Asset M
Matching passage: CVE-2015-2802. CWE: CWE-200. CVSS: 7.5. An Information Disclosure vulnerability exists in HP SiteScope 11.2 and 11.3 on Windows, Linux and Solaris, HP Asset Manager 9.30 through 9.32, 9.40 through 9.41, 9.50, and Asset Manager Cloudsystem Chargeback 9.40, which could let a remote malicious user obtain sensitive information. This is the TLS vulnerability known as the RC4 cipher Bar Mitzvah vulnerability.
Near-miss passage: CVE-2015-3108. CWE: CWE-200. CVSS: 5.0. Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) 4.x before 4.0.12.1 allows remote authentica
Matching passage: CVE-2015-6810. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) 4.x before 4.0.12.1 allows remote authenticated users to inject arbitrary web script or HTML via the event_location[address] array parameter to calendar/submit/.
Near-miss passage: CVE-2015-5714. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by leveraging the mishandling of unclosed HTML elements during processing of shortcode tags.
Query: rule covering Detects suspicious usage of the cmd.exe 'for /f' loop combined with the 'tokens=' parameter and a recursive directory li
Matching passage: Sigma rule: Detects suspicious usage of the cmd.exe 'for /f' loop combined with the 'tokens=' parameter and a recursive directory li. Logsource: windows / process_creation. Rule: title: Suspicious Usage of For Loop with Recursive Directory Search in CMD id: 2782fbd8-b662-4eb5-9962-5bfbfb671e7b status: experimental description: 'Detects suspicious usage of the cmd.exe ''for /f'' loop combined with the ''tokens='' parameter and a recursive directory listing. This pattern may indicate an attempt to discover and execute system binaries dynamically, for example powershell, a technique sometimes used by attackers to evade detection. This behavior has been observed in various malicious lnk files. ' references: - https://www.virustotal.com/gui/file/29837d0d3202758063185828c8f8d9e0b7b42b365c8941cc926d2d7c7bae2fb3 author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2025-11-12 tags: - attack.execution - attack.stealth - attack.t1059.003 - attack.t1027.010 logsource: category: process_creation product: windows detection: selection_tokens: CommandLine|contains|all: - for /f - tokens= - in ( - dir selection_tokens_parent: ParentCommandLine|contains|all: - for /f - tokens= - in ( - dir condition: 1 of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects usage of system utilities to discover system network connections. Logsource: macos / process_creation. Rule: title: System Network Connections Discovery - MacOs id: 9a7a0393-2144-4626-9bf1-7c2f5a7321db status: test description: Detects usage of system utilities to discover system network connections references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md author: Daniil Yugoslavskiy, oscd.community date: 2020-10-19 modified: 2022-12-28 tags: - attack.discovery - attack.t1049 logsource: category: process_creation product: macos detection: selection: Image|endswith: - /who - /w - /last - /lsof - /netstat condition: selection falsepositives: - Legitimate activities level: informational