alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Detects the PowerShell command lines with special characters
Matching passage: Sigma rule: Detects the PowerShell command lines with special characters. Logsource: windows / process_creation. Rule: title: Potential PowerShell Command Line Obfuscation id: d7bcd677-645d-4691-a8d4-7a5602b780d1 status: test description: Detects the PowerShell command lines with special characters references: - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=64 author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp) date: 2020-10-15 modified: 2024-04-15 tags: - attack.execution - attack.stealth - attack.t1027 - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_re: - CommandLine|re: \+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+ - CommandLine|re: \{.*\{.*\{.*\{.*\{.*\{.*\{.*\{.*\{.*\{ - CommandLine|re: \^.*\^.*\^.*\^.*\^ - CommandLine|re: '`.*`.*`.*`.*`' filter_optional_amazonSSM: ParentImage: C:\Program Files\Amazon\SSM\ssm-document-worker.exe filter_optional_defender_atp: CommandLine|contains: - new EventSource("Microsoft.Windows.Sense.Client.Management" - public static extern bool InstallELAMCertificateInfo(SafeFileHandle handle); condition: all of selection_* and not 1 of filter_optional_* falsepositives: - Amazon SSM Document Worker - Windows Defender ATP level: high
Near-miss passage: Sigma rule: Detects execution of JavaScript or JSC files using NodeJs binary node.exe, that could be potentially suspicious. Node.js. Logsource: windows / process_creation. Rule: title: NodeJS Execution of JavaScript File id: ba3874b9-0fae-465f-836c-eb5d071a1789 status: experimental description: 'Detects execution of JavaScript or JSC files using NodeJs binary node.exe, that could be potentially suspicious. Node.js is a popular open-source JavaScript runtime that runs code outside browsers and is widely used for both frontend and backend development. Adversaries have been observed abusing Node.js to disguise malware as legitimate processes, evade security defenses, and maintain persistence within target systems. Because Node.js is commonly used, this rule may generate false positives in some environments. However, if such activity is unusual in your environment, it is highly suspicious and warrants immediate investigation. ' references: - https://www.microsoft.com/en-us/security/blog/2025/04/15/threat-actors-misuse-node-js-to-deliver-malware-and-other-malicious-payloads/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-04-21 tags: - attack.execution - attack.t1059.007 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \node.exe - OriginalFileName: node.exe - Product: Node.js selection_cmd: CommandLine|contains: .js condition: all of selection_* falsepositives: - Legitimate use of node.exe to execute JavaScript or JSC files on your environment level: low
Query: describe CVE-2015-8345
Matching passage: CVE-2015-8345. CWE: CWE-399. CVSS: 6.5. The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of service (application crash and infinite loop) via vectors involving the command block list.
Near-miss passage: CVE-2015-1558. CWE: CWE-399. CVSS: 3.5. Asterisk Open Source 12.x before 12.8.1 and 13.x before 13.1.1, when using the PJSIP channel driver, does not properly reclaim RTP ports, which allows remote authenticated users to cause a denial of service (file descriptor consumption) via an SDP offer containing only incompatible codecs.
Query: patch priority for CVE-2015-0726
Matching passage: CVE-2015-0726. CWE: CWE-20. CVSS: 6.800000190734863. The web administration interface on Cisco Wireless LAN Controller (WLC) devices before 7.0.241, 7.1.x through 7.4.x before 7.4.122, and 7.5.x and 7.6.x before 7.6.120 allows remote authenticated users to cause a denial of service (device crash) via unspecified parameters, aka Bug IDs CSCum65159 and CSCum65252.
Near-miss passage: CVE-2015-8360. CWE: CWE-20. CVSS: 9.800000190734863. An unspecified resource in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 allows remote attackers to execute arbitrary Java code via serialized data to the JMS port.
Query: patch priority for CVE-2015-2902
Matching passage: CVE-2015-2902. CWE: CWE-310. CVSS: 6.800000190734863. HP ArcSight SmartConnectors before 7.1.6 do not verify X.509 certificates from Logger devices, which allows man-in-the-middle attackers to spoof devices and obtain sensitive information via a crafted certificate.
Near-miss passage: CVE-2015-4550. CWE: CWE-310. CVSS: 4.300000190734863. The Cavium cryptographic-module firmware on Cisco Adaptive Security Appliance (ASA) devices with software 9.3(3) and 9.4(1.1) does not verify the AES-GCM Integrity Check Value (ICV) octets, which makes it easier for man-in-the-middle attackers to spoof IPSec and IKEv2 traffic by modifying packet data, aka Bug ID CSCuu66218.
Query: risk of The interpreter in IBC Solar ServeMaster TLP+ and Danfoss TLX Pro+ allows remote attackers to discover script source code via unspecified vectors.
Matching passage: CVE-2015-6469. CWE: CWE-200. CVSS: 5.0. The interpreter in IBC Solar ServeMaster TLP+ and Danfoss TLX Pro+ allows remote attackers to discover script source code via unspecified vectors.
Near-miss passage: CVE-2015-3373. CWE: CWE-200. CVSS: 5.0. The Amazon AWS module before 7.x-1.3 for Drupal uses the base URL and AWS access key to generate the access token, which makes it easier for remote attackers to guess the token value and create backups via a crafted URL.
Query: CVE similar to CVE-2015-5920
Matching passage: CVE-2015-5920. CWE: UNKNOWN. CVSS: 4.300000190734863. The Software Update component in Apple iTunes before 12.3 does not properly handle redirection, which allows man-in-the-middle attackers to discover encrypted SMB credentials via unspecified vectors.
Near-miss passage: CVE-2015-2565. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle Installed Base component in Oracle E-Business Suite 11.5.10.2, 12.0.4, 12.0.6, 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect integrity via unknown vectors related to Create Item Instance.
Query: common weakness: Buffer Access Using Size of Source Buffer
Matching passage: CWE-806 Buffer Access Using Size of Source Buffer. The product uses the size of a source buffer when reading from or writing to a destination buffer, which may cause it to access memory that is outside of the bounds of the buffer.
Near-miss passage: CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'). The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.
Query: EDR alert: possible Content Injection (T1659)
Matching passage: T1659 Content Injection. Tactics: initial access, command and control. Description: Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic. Rather than luring victims to malicious payloads hosted on a compromised website (i.e., [Drive-by Target](https://attack.mitre.org/techniques/T1608/004) followed by [Drive-by Compromise](https://attack.mitre.org/techniques/T1189)), adversaries may initially access victims through compromised data-transfer channels where they can manipulate traffic and/or inject their own content. These compromised online network channels may also be used to deliver additional payloads (i.e., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) and other data to already compromised systems.(Citation: ESET MoustachedBouncer) Adversaries may inject content to victim systems in various ways, including: * From the middle, where the adversary is in-between legitimate online client-server communications (**Note:** this is similar but distinct from [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557), which describes AiTM activity solely within an enterprise environment) (Citation: Kaspersky Encyclopedia MiTM) * From the side, where malicious content is injected and races to the client as a fake response to requests of a legitimate online server (Citation: Kaspersky ManOnTheSide) Content injection is often the result of compromised upstream communication channels, for example at the level of an internet service provider (ISP) as is the case with "lawful interception."(Citation: Kaspersky ManOnTheSide)(Citation: ESET MoustachedBouncer)(Citation: EFF China GitHub Attack)
Near-miss passage: T1102.001 Dead Drop Resolver. Tactics: command and control. Description: Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of a dead drop resolver may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).
Query: CVE similar to CVE-2015-0770
Matching passage: CVE-2015-0770. CWE: CWE-20. CVSS: 5.0. CRLF injection vulnerability in Cisco TelePresence TC 6.x before 6.3.4 and 7.x before 7.3.3 on Integrator C SX20 devices allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL, aka Bug ID CSCut79341.
Near-miss passage: CVE-2015-8538. CWE: CWE-20. CVSS: 6.5. dwarf_leb.c in libdwarf allows attackers to cause a denial of service (SIGSEGV).
Query: risk of Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2875.
Matching passage: CVE-2015-5416. CWE: UNKNOWN. CVSS: 7.5. Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2875.
Near-miss passage: CVE-2015-0370. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, and 12.1.0.1 allows remote authenticated users to affect integrity via unknown vectors, a different vulnerability than CVE-2013-5858.
Query: exploit Off-by-one error in the READ_ENCINT macro in chmd.c in libmspack before 0.5 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified ot
Matching passage: CVE-2015-4472. CWE: CWE-189. CVSS: 6.800000190734863. Off-by-one error in the READ_ENCINT macro in chmd.c in libmspack before 0.5 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted CHM file.
Near-miss passage: CVE-2015-7804. CWE: CWE-189. CVSS: 6.800000190734863. Off-by-one error in the phar_parse_zipfile function in ext/phar/zip.c in PHP before 5.5.30 and 5.6.x before 5.6.14 allows remote attackers to cause a denial of service (uninitialized pointer dereference and application crash) by including the / filename in a .zip PHAR archive.
Query: rule covering Detects the execution of WMIC with the "csproduct" which is used to obtain information such as hardware models and vendo
Matching passage: Sigma rule: Detects the execution of WMIC with the "csproduct" which is used to obtain information such as hardware models and vendo. Logsource: windows / process_creation. Rule: title: Hardware Model Reconnaissance Via Wmic.EXE id: 3e3ceccd-6c06-48b8-b5ff-ab1d25db8c1d status: test description: Detects the execution of WMIC with the "csproduct" which is used to obtain information such as hardware models and vendor information references: - https://jonconwayuk.wordpress.com/2014/01/31/wmic-csproduct-using-wmi-to-identify-make-and-model-of-hardware/ - https://www.uptycs.com/blog/kuraystealer-a-bandit-using-discord-webhooks author: Florian Roth (Nextron Systems) date: 2023-02-14 tags: - attack.execution - attack.t1047 - car.2016-03-002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \wmic.exe - OriginalFileName: wmic.exe selection_cli: CommandLine|contains: csproduct condition: all of selection_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_csproduct/info.yml
Near-miss passage: Sigma rule: Detects registry modifications that disable Privacy Settings Experience. Logsource: windows / registry_set. Rule: title: Disable Privacy Settings Experience in Registry id: 0372e1f9-0fd2-40f7-be1b-a7b2b848fa7b status: test description: Detects registry modifications that disable Privacy Settings Experience references: - https://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1562.001/T1562.001.md author: frack113 date: 2022-10-02 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \SOFTWARE\Policies\Microsoft\Windows\OOBE\DisablePrivacyExperience Details: DWORD (0x00000000) condition: selection falsepositives: - Legitimate admin script level: medium
Query: patch priority for CVE-2015-1424
Matching passage: CVE-2015-1424. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Gecko CMS 2.2 and 2.3 allows remote attackers to hijack the authentication of administrators for requests that add an administrator user via a newuser request to admin/index.php.
Near-miss passage: CVE-2015-7612. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the Organizations page in Enterprise Manager in McAfee Vulnerability Manager (MVM) 7.5.9 and earlier allow remote attackers to hijack the authentication of administrators for requests that have unspecified impact via unknown vectors.
Query: alert when Detects the execution of Scheduled Tasks where the Program being run is located in a suspicious location or it's an unus
Matching passage: Sigma rule: Detects the execution of Scheduled Tasks where the Program being run is located in a suspicious location or it's an unus. Logsource: windows / taskscheduler. Rule: title: Scheduled Task Executed From A Suspicious Location id: 424273ea-7cf8-43a6-b712-375f925e481f status: test description: Detects the execution of Scheduled Tasks where the Program being run is located in a suspicious location or it's an unusale program to be run from a Scheduled Task references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-05 modified: 2023-02-07 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1053.005 logsource: product: windows service: taskscheduler definition: 'Requirements: The "Microsoft-Windows-TaskScheduler/Operational" is disabled by default and needs to be enabled in order for this detection to trigger' detection: selection: EventID: 129 Path|contains: - C:\Windows\Temp\ - \AppData\Local\Temp\ - \Desktop\ - \Downloads\ - \Users\Public\ - C:\Temp\ condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects unusual parent or children of the wab.exe (Windows Contacts) and Wabmig.exe (Microsoft Address Book Import Tool). Logsource: windows / process_creation. Rule: title: Wab/Wabmig Unusual Parent Or Child Processes id: 63d1ccc0-2a43-4f4b-9289-361b308991ff status: test description: Detects unusual parent or children of the wab.exe (Windows Contacts) and Wabmig.exe (Microsoft Address Book Import Tool) processes as seen being used with bumblebee activity references: - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime - https://thedfirreport.com/2022/09/26/bumblebee-round-two/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-12 modified: 2022-09-27 tags: - attack.execution - attack.stealth logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \WmiPrvSE.exe - \svchost.exe - \dllhost.exe Image|endswith: - \wab.exe - \wabmig.exe selection_child: ParentImage|endswith: - \wab.exe - \wabmig.exe condition: 1 of selection_* falsepositives: - Unknown level: high
Query: alert when Detects VBScript content stored into registry keys as seen being used by UNC2452 group
Matching passage: Sigma rule: Detects VBScript content stored into registry keys as seen being used by UNC2452 group. Logsource: windows / registry_set. Rule: title: VBScript Payload Stored in Registry id: 46490193-1b22-4c29-bdd6-5bf63907216f status: test description: Detects VBScript content stored into registry keys as seen being used by UNC2452 group references: - https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/ author: Florian Roth (Nextron Systems) date: 2021-03-05 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: Software\Microsoft\Windows\CurrentVersion Details|contains: - 'vbscript:' - 'jscript:' - mshtml, - RunHTMLApplication - Execute( - CreateObject - window.close filter: TargetObject|contains: Software\Microsoft\Windows\CurrentVersion\Run filter_dotnet: Image|endswith: \msiexec.exe TargetObject|contains: \SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\ Details|contains: - \Microsoft.NET\Primary Interop Assemblies\Microsoft.mshtml.dll - <\Microsoft.mshtml,fileVersion= - _mshtml_dll_ - <\Microsoft.mshtml,culture= condition: selection and not 1 of filter* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately. Logsource: azure / auditlogs. Rule: title: Azure Subscription Permission Elevation Via AuditLogs id: ca9bf243-465e-494a-9e54-bf9fc239057d status: test description: 'Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn''t planned. This setting could allow an attacker access to Azure subscriptions in your environment. ' references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#assignment-and-elevation author: Austin Songer @austinsonger date: 2021-11-26 modified: 2022-12-25 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078 logsource: product: azure service: auditlogs detection: selection: Category: Administrative OperationName: Assigns the caller to user access admin condition: selection falsepositives: - If this was approved by System Administrator. level: high
Query: CVE similar to CVE-2015-0220
Matching passage: CVE-2015-0220. CWE: CWE-79. CVSS: 4.300000190734863. The django.util.http.is_safe_url function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, related to redirect URLs, as demonstrated by a "\njavascript:" URL.
Near-miss passage: CVE-2015-8834. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3440.
Query: risk of The Administration Views module 7.x-1.x before 7.x-1.5 for Drupal checks access permissions based on the router path from the view instead of the display property, which allows rem
Matching passage: CVE-2015-7226. CWE: CWE-200. CVSS: 5.0. The Administration Views module 7.x-1.x before 7.x-1.5 for Drupal checks access permissions based on the router path from the view instead of the display property, which allows remote attackers to obtain sensitive information via vectors related to the access handler.
Near-miss passage: CVE-2015-0070. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site, aka "Internet Explorer Cross-domain Information Disclosure Vulnerability."
Query: secure coding against Exposed Dangerous Method or Function
Matching passage: CWE-749 Exposed Dangerous Method or Function. The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.
Near-miss passage: CWE-837 Improper Enforcement of a Single, Unique Action. The product requires that an actor should only be able to perform an action once, or to have only one unique action, but the product does not enforce or improperly enforces this restriction.
Query: exploit Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before
Matching passage: CVE-2015-3086. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-3077 and CVE-2015-3084.
Near-miss passage: CVE-2015-0400. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to Libraries.