alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Detects system restore registry modification via command line, which can be used by adversaries to disable system restor
Matching passage: Sigma rule: Detects system restore registry modification via command line, which can be used by adversaries to disable system restor. Logsource: windows / process_creation. Rule: title: System Restore Registry Modification via CommandLine id: 7c06ab9b-b1d2-4ba9-b06e-09491ded20d9 related: - id: 5de03871-5d46-4539-a82d-3aa992a69a83 type: similar status: experimental description: 'Detects system restore registry modification via command line, which can be used by adversaries to disable system restore on the computer. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-9---disable-system-restore-through-registry author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-03-11 tags: - attack.impact - attack.t1490 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - \reg.exe - OriginalFileName: - powershell.exe - pwsh.dll - reg.exe selection_cli_action: CommandLine|contains: - ' add ' - Set-ItemProperty - New-ItemProperty selection_cli_reg_root: CommandLine|contains: - \SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore selection_cli_reg_key: CommandLine|contains: - DisableConfig - DisableSR condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_reg_system_restore_modification/info.yml simulation: - type: atomic-red-team name: Disable System Restore Through Registry technique: T1490 atomic_guid: 66e647d1-8741-4e43-b7c1-334760c2047f
Near-miss passage: Sigma rule: Detects any assembly DLL being loaded by an Office Product. Logsource: windows / image_load. Rule: title: DotNET Assembly DLL Loaded Via Office Application id: ff0f2b05-09db-4095-b96d-1b75ca24894a status: test description: Detects any assembly DLL being loaded by an Office Product references: - https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16 author: Antonlovesdnb date: 2020-02-19 modified: 2023-03-29 tags: - attack.execution - attack.t1204.002 logsource: category: image_load product: windows detection: selection: Image|endswith: - \excel.exe - \mspub.exe - \onenote.exe - \onenoteim.exe - \outlook.exe - \powerpnt.exe - \winword.exe ImageLoaded|startswith: C:\Windows\assembly\ condition: selection falsepositives: - Unknown level: medium
Query: describe CVE-2015-3236
Matching passage: CVE-2015-3236. CWE: CWE-200. CVSS: 5.0. cURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication credentials for a previous connection when reusing a reset (curl_easy_reset) connection handle to send a request to the same host name, which allows remote attackers to obtain sensitive information via unspecified vectors.
Near-miss passage: CVE-2015-7434. CWE: CWE-200. CVSS: 7.800000190734863. IBM Capacity Management Analytics 2.1.0.0 allows local users to discover encrypted usernames and passwords by leveraging access to the CMA install machine. IBM X-Force ID: 107863.
Query: detection rule: Detects execution of the Notepad++ updater (gup) to launch other commands or executables
Matching passage: Sigma rule: Detects execution of the Notepad++ updater (gup) to launch other commands or executables. Logsource: windows / process_creation. Rule: title: Arbitrary Binary Execution Using GUP Utility id: d65aee4d-2292-4cea-b832-83accd6cfa43 status: test description: Detects execution of the Notepad++ updater (gup) to launch other commands or executables references: - https://twitter.com/nas_bench/status/1535322445439180803 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-10 modified: 2023-03-02 tags: - attack.execution logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \gup.exe Image|endswith: \explorer.exe filter: Image|endswith: \explorer.exe CommandLine|contains: \Notepad++\notepad++.exe filter_parent: ParentImage|contains: \Notepad++\updater\ filter_null: CommandLine: null condition: selection and not 1 of filter* falsepositives: - Other parent binaries using GUP not currently identified level: medium
Near-miss passage: Sigma rule: Detects PsExec default pipe creation where the image executed is located in a suspicious location. Which could indicate. Logsource: windows / pipe_created. Rule: title: PsExec Tool Execution From Suspicious Locations - PipeName id: 41504465-5e3a-4a5b-a5b4-2a0baadd4463 related: - id: f3f3a972-f982-40ad-b63c-bca6afdfad7c type: derived status: test description: Detects PsExec default pipe creation where the image executed is located in a suspicious location. Which could indicate that the tool is being used in an attack references: - https://www.jpcert.or.jp/english/pub/sr/ir_research.html - https://jpcertcc.github.io/ToolAnalysisResultSheet author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-04 modified: 2023-09-20 tags: - attack.execution - attack.t1569.002 - attack.s0029 logsource: category: pipe_created product: windows definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection: PipeName: \PSEXESVC Image|contains: - :\Users\Public\ - :\Windows\Temp\ - \AppData\Local\Temp\ - \Desktop\ - \Downloads\ condition: selection falsepositives: - Rare legitimate use of psexec from the locations mentioned above. This will require initial tuning based on your environment. level: medium
Query: telemetry for T1021.008
Matching passage: T1021.008 Direct Cloud VM Connections. Tactics: lateral movement. Description: Adversaries may leverage [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log directly into accessible cloud hosted compute infrastructure through cloud native methods. Many cloud providers offer interactive connections to virtual infrastructure that can be accessed through the [Cloud API](https://attack.mitre.org/techniques/T1059/009), such as Azure Serial Console(Citation: Azure Serial Console), AWS EC2 Instance Connect(Citation: EC2 Instance Connect)(Citation: lucr-3: Getting SaaS-y in the cloud), and AWS System Manager.(Citation: AWS System Manager). Methods of authentication for these connections can include passwords, application access tokens, or SSH keys. These cloud native methods may, by default, allow for privileged access on the host with SYSTEM or root level access. Adversaries may utilize these cloud native methods to directly access virtual infrastructure and pivot through an environment.(Citation: SIM Swapping and Abuse of the Microsoft Azure Serial Console) These connections typically provide direct console access to the VM rather than the execution of scripts (i.e., [Cloud Administration Command](https://attack.mitre.org/techniques/T1651)).
Near-miss passage: T1021.007 Cloud Services. Tactics: lateral movement. Description: Adversaries may log into accessible cloud services within a compromised environment using [Valid Accounts](https://attack.mitre.org/techniques/T1078) that are synchronized with or federated to on-premises user identities. The adversary may then perform management actions or access cloud-hosted resources as the logged-on user. Many enterprises federate centrally managed user identities to cloud services, allowing users to login with their domain credentials in order to access the cloud control plane. Similarly, adversaries may connect to available cloud services through the web console or through the cloud command line interface (CLI) (e.g., [Cloud API](https://attack.mitre.org/techniques/T1059/009)), using commands such as <code>Connect-AZAccount</code> for Azure PowerShell, <code>Connect-MgGraph</code> for Microsoft Graph PowerShell, and <code>gcloud auth login</code> for the Google Cloud CLI. In some cases, adversaries may be able to authenticate to these services via [Application Access Token](https://attack.mitre.org/techniques/T1550/001) instead of a username and password.
Query: vulnerability: A vulnerability was found in kylebebak dronfelipe. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to sql injec
Matching passage: CVE-2015-10036. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability was found in kylebebak dronfelipe. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to sql injection. The patch is named 87405b74fe651892d79d0dff62ed17a7eaef6a60. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217951.
Near-miss passage: CVE-2015-10037. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability, which was classified as critical, was found in ACI_Escola. This affects an unknown part. The manipulation leads to sql injection. The identifier of the patch is 34eed1f7b9295d1424912f79989d8aba5de41e9f. It is recommended to apply a patch to fix this issue. The identifier VDB-217965 was assigned to this vulnerability.
Query: mitigate Fast Flux DNS
Matching passage: T1568.001 Fast Flux DNS. Tactics: command and control. Description: Adversaries may use Fast Flux DNS to hide a command and control channel behind an array of rapidly changing IP addresses linked to a single domain resolution. This technique uses a fully qualified domain name, with multiple IP addresses assigned to it which are swapped with high frequency, using a combination of round robin IP addressing and short Time-To-Live (TTL) for a DNS resource record.(Citation: MehtaFastFluxPt1)(Citation: MehtaFastFluxPt2)(Citation: Fast Flux - Welivesecurity) The simplest, "single-flux" method, involves registering and de-registering an addresses as part of the DNS A (address) record list for a single DNS name. These registrations have a five-minute average lifespan, resulting in a constant shuffle of IP address resolution.(Citation: Fast Flux - Welivesecurity) In contrast, the "double-flux" method registers and de-registers an address as part of the DNS Name Server record list for the DNS zone, providing additional resilience for the connection. With double-flux additional hosts can act as a proxy to the C2 host, further insulating the true source of the C2 channel.
Near-miss passage: T1568.003 DNS Calculation. Tactics: command and control. Description: Adversaries may perform calculations on addresses returned in DNS results to determine which port and IP address to use for command and control, rather than relying on a predetermined port number or the actual returned IP address. A IP and/or port number calculation can be used to bypass egress filtering on a C2 channel.(Citation: Meyers Numbered Panda) One implementation of [DNS Calculation](https://attack.mitre.org/techniques/T1568/003) is to take the first three octets of an IP address in a DNS response and use those values to calculate the port for command and control traffic.(Citation: Meyers Numbered Panda)(Citation: Moran 2014)(Citation: Rapid7G20Espionage)
Query: secure coding against Use of Singleton Pattern Without Synchronization in a Multithreaded Context
Matching passage: CWE-543 Use of Singleton Pattern Without Synchronization in a Multithreaded Context. The product uses the singleton pattern when creating a resource within a multithreaded environment.
Near-miss passage: CWE-487 Reliance on Package-level Scope. Java packages are not inherently closed; therefore, relying on them for code security is not a good practice.
Query: patch priority for CVE-2015-0854
Matching passage: CVE-2015-0854. CWE: CWE-19. CVSS: 7.800000190734863. App/HelperFunctions.pm in Shutter through 0.93.1 allows user-assisted remote attackers to execute arbitrary commands via a crafted image name that is mishandled during a "Show in Folder" action.
Near-miss passage: CVE-2015-7575. CWE: CWE-19. CVSS: 5.900000095367432. Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof servers by triggering a collision.
Query: risk of CA Spectrum 9.2.x and 9.3.x before 9.3 H02 does not properly validate serialized Java objects, which allows remote authenticated users to obtain administrative privileges via craft
Matching passage: CVE-2015-2828. CWE: CWE-264. CVSS: 9.0. CA Spectrum 9.2.x and 9.3.x before 9.3 H02 does not properly validate serialized Java objects, which allows remote authenticated users to obtain administrative privileges via crafted object data.
Near-miss passage: CVE-2015-2507. CWE: CWE-264. CVSS: 7.199999809265137. The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka "Font Driver Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2512.
Query: detect Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. in logs
Matching passage: Sigma rule: Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.. Logsource: macos / process_creation. Rule: title: System Shutdown/Reboot - MacOs id: 40b1fbe2-18ea-4ee7-be47-0294285811de status: test description: Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1529/T1529.md author: Igor Fits, Mikhail Larin, oscd.community date: 2020-10-19 modified: 2022-11-26 tags: - attack.impact - attack.t1529 logsource: product: macos category: process_creation detection: selection: Image|endswith: - /shutdown - /reboot - /halt condition: selection falsepositives: - Legitimate administrative activity level: informational
Near-miss passage: Sigma rule: Identifies when a owner is was removed from a application or service principal in Azure.. Logsource: azure / auditlogs. Rule: title: Azure Owner Removed From Application or Service Principal id: 636e30d5-3736-42ea-96b1-e6e2f8429fd6 status: test description: Identifies when a owner is was removed from a application or service principal in Azure. references: - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory author: Austin Songer @austinsonger date: 2021-09-03 modified: 2026-04-30 tags: - attack.stealth logsource: product: azure service: auditlogs detection: selection: operationName: - Remove owner from service principal - Remove owner from application condition: selection falsepositives: - Owner being removed may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Owner removed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: exploit Cross-site scripting (XSS) vulnerability in Let's PHP! p++BBS before 4.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Matching passage: CVE-2015-7783. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Let's PHP! p++BBS before 4.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-5612. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in October CMS build 271 and earlier allows remote attackers to inject arbitrary web script or HTML via the caption tag of a profile image.
Query: rule covering Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove model safety controls and allow u
Matching passage: Sigma rule: Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove model safety controls and allow u. Logsource: aws / cloudtrail. Rule: title: AWS Bedrock Guardrail Deleted id: 59b70e4d-dd17-44a9-b740-acf07ae3eb6a status: experimental description: 'Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove model safety controls and allow unsafe or unauthorized model responses. ' references: - https://docs.aws.amazon.com/bedrock/latest/APIReference/API_DeleteGuardrail.html author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) date: 2026-07-10 tags: - attack.defense-impairment - attack.t1685 logsource: product: aws service: cloudtrail detection: selection: eventName: DeleteGuardrail eventSource: bedrock.amazonaws.com condition: selection falsepositives: - Legitimate guardrail deletion by authorized identities. level: medium
Near-miss passage: Sigma rule: Adversaries may enumerate browser bookmarks to learn more about compromised hosts. Browser bookmarks may reveal personal. Logsource: windows / process_creation. Rule: title: Suspicious Where Execution id: 725a9768-0f5e-4cb3-aec2-bc5719c6831a status: test description: 'Adversaries may enumerate browser bookmarks to learn more about compromised hosts. Browser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1217/T1217.md author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2021-12-13 modified: 2022-06-29 tags: - attack.discovery - attack.t1217 logsource: category: process_creation product: windows detection: where_exe: - Image|endswith: \where.exe - OriginalFileName: where.exe where_opt: CommandLine|contains: - places.sqlite - cookies.sqlite - formhistory.sqlite - logins.json - key4.db - key3.db - sessionstore.jsonlz4 - History - Bookmarks - Cookies - Login Data condition: all of where_* falsepositives: - Unknown level: low
Query: CVE similar to CVE-2015-3151
Matching passage: CVE-2015-3151. CWE: CWE-22. CVSS: 7.800000190734863. Directory traversal vulnerability in abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to read, write to, or change ownership of arbitrary files via unspecified vectors to the (1) NewProblem, (2) GetInfo, (3) SetElement, or (4) DeleteElement method.
Near-miss passage: CVE-2015-8794. CWE: CWE-22. CVSS: 6.5. Absolute path traversal vulnerability in program/steps/addressbook/photo.inc in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via a full pathname in the _alt parameter, related to contact photo handling.
Query: risk of The default event handling scripts in Automatic Bug Reporting Tool (ABRT) allow local users to gain privileges as demonstrated by a symlink attack on a var_log_messages file.
Matching passage: CVE-2015-1869. CWE: CWE-59. CVSS: 7.800000190734863. The default event handling scripts in Automatic Bug Reporting Tool (ABRT) allow local users to gain privileges as demonstrated by a symlink attack on a var_log_messages file.
Near-miss passage: CVE-2015-7723. CWE: CWE-59. CVSS: 7.800000190734863. AMD fglrx-driver before 15.7 allows local users to gain privileges via a symlink attack.
Query: alert when Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary contro
Matching passage: Sigma rule: Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary contro. Logsource: windows / process_creation. Rule: title: Root Certificate Installed From Susp Locations id: 5f6a601c-2ecb-498b-9c33-660362323afa status: test description: Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. references: - https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/ - https://learn.microsoft.com/en-us/powershell/module/pki/import-certificate?view=windowsserver2022-ps author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-09 modified: 2023-01-16 tags: - attack.defense-impairment - attack.t1553.004 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - Import-Certificate - ' -FilePath ' - Cert:\LocalMachine\Root CommandLine|contains: - \AppData\Local\Temp\ - :\Windows\TEMP\ - \Desktop\ - \Downloads\ - \Perflogs\ - :\Users\Public\ condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects file creation events with filename patterns used by CrackMapExec.. Logsource: windows / file_event. Rule: title: HackTool - CrackMapExec File Indicators id: 736ffa74-5f6f-44ca-94ef-1c0df4f51d2a related: - id: 9433ff9c-5d3f-4269-99f8-95fc826ea489 type: obsolete status: test description: Detects file creation events with filename patterns used by CrackMapExec. references: - https://github.com/byt3bl33d3r/CrackMapExec/ author: Nasreddine Bencherchali (Nextron Systems) date: 2024-03-11 modified: 2024-06-27 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows category: file_event detection: selection_path: TargetFilename|startswith: C:\Windows\Temp\ selection_names_str: TargetFilename|endswith: - \temp.ps1 - \msol.ps1 selection_names_re: - TargetFilename|re: \\[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.txt$ - TargetFilename|re: \\[a-zA-Z]{8}\.tmp$ condition: selection_path and 1 of selection_names_* falsepositives: - Unknown level: high
Query: exploit WebKit in Apple iOS before 9 mishandles "Content-Disposition: attachment" HTTP headers, which might allow man-in-the-middle attackers to obtain sensitive information via unspecifie
Matching passage: CVE-2015-5921. CWE: CWE-200. CVSS: 4.300000190734863. WebKit in Apple iOS before 9 mishandles "Content-Disposition: attachment" HTTP headers, which might allow man-in-the-middle attackers to obtain sensitive information via unspecified vectors.
Near-miss passage: CVE-2015-7787. CWE: CWE-200. CVSS: 4.300000190734863. ASUS Japan WL-330NUL devices with firmware before 3.0.0.42 allow remote attackers to discover the WPA2-PSK passphrase via unspecified vectors.
Query: CVE similar to CVE-2015-0131
Matching passage: CVE-2015-0131. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-20019. CWE: CWE-79. CVSS: 5.400000095367432. The Content text slider on post WordPress plugin before 6.9 does not sanitise and escape the Title and Message/Content settings, which could lead to Cross-Site Scripting issues