alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Conti recommendation to its affiliates to use esentutl to access NTDS dumped file. Trickbot also uses this utilities to in logs
Matching passage: Sigma rule: Conti recommendation to its affiliates to use esentutl to access NTDS dumped file. Trickbot also uses this utilities to. Logsource: windows / process_creation. Rule: title: Esentutl Gather Credentials id: 7df1713a-1a5b-4a4b-a071-dc83b144a101 status: test description: Conti recommendation to its affiliates to use esentutl to access NTDS dumped file. Trickbot also uses this utilities to get MSEdge info via its module pwgrab. references: - https://twitter.com/vxunderground/status/1423336151860002816 - https://thedfirreport.com/2021/08/01/bazarcall-to-conti-ransomware-via-trickbot-and-cobalt-strike/ author: sam0x90 date: 2021-08-06 modified: 2022-10-09 tags: - attack.credential-access - attack.t1003 - attack.t1003.003 - attack.s0404 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - esentutl - ' /p' condition: selection falsepositives: - To be determined level: medium
Near-miss passage: Sigma rule: Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including: - Use of the `personality`. Logsource: linux / auditd. Rule: title: ASLR Disabled Via Sysctl or Direct Syscall - Linux id: e497a24e-9345-4a62-9803-b06d7d7cb132 status: experimental description: "Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including:\n - Use of the\ \ `personality` syscall with the ADDR_NO_RANDOMIZE flag (0x0040000)\n - Modification of the /proc/sys/kernel/randomize_va_space\ \ file\n - Execution of the `sysctl` command to set `kernel.randomize_va_space=0`\nDisabling ASLR is often used by attackers\ \ during exploit development or to bypass memory protection mechanisms.\nA successful use of these methods can reduce the\ \ effectiveness of ASLR and make memory corruption attacks more reliable.\n" references: - https://github.com/CheraghiMilad/bypass-Neo23x0-auditd-config/blob/f1c478a37911a5447d5ffcd580f22b167bf3df14/personality-syscall/README.md - https://man7.org/linux/man-pages/man2/personality.2.html - https://manual.cs50.io/2/personality - https://linux-audit.com/linux-aslr-and-kernelrandomize_va_space-setting/ author: Milad Cheraghi date: 2025-05-26 modified: 2025-12-05 tags: - attack.privilege-escalation - attack.stealth - attack.defense-impairment - attack.t1685 - attack.t1055.009 logsource: product: linux service: auditd detection: selection_syscall: type: SYSCALL SYSCALL: personality a0: 40000 selection_sysctl: type: EXECVE a0: sysctl a1: -w a2: kernel.randomize_va_space=0 condition: 1 of selection_* falsepositives: - Debugging or legitimate software testing level: high
Query: vulnerability: jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass th
Matching passage: CVE-2015-1840. CWE: CWE-200. CVSS: 5.0. jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.
Near-miss passage: CVE-2015-5041. CWE: CWE-200. CVSS: 9.100000381469727. The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20, 7 before SR9 FP30, and 7 R1 before SR3 FP30 allows remote attackers to obtain sensitive information or inject data by invoking non-public interface methods.
Query: exploit The kernel in Cisco NX-OS 5.2(9)N1(1) on Nexus 5000 devices allows local users to cause a denial of service (device crash) via crafted USB parameters, aka Bug ID CSCus89408.
Matching passage: CVE-2015-6394. CWE: CWE-399. CVSS: 4.900000095367432. The kernel in Cisco NX-OS 5.2(9)N1(1) on Nexus 5000 devices allows local users to cause a denial of service (device crash) via crafted USB parameters, aka Bug ID CSCus89408.
Near-miss passage: CVE-2015-1074. CWE: CWE-399. CVSS: 6.800000190734863. WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Query: detect Detects DNS queries for subdomains related to "Put.io" sharing website. in logs
Matching passage: Sigma rule: Detects DNS queries for subdomains related to "Put.io" sharing website.. Logsource: windows / dns-client. Rule: title: DNS Query To Put.io - DNS Client id: 8b69fd42-9dad-4674-abef-7fdef43ef92a status: test description: Detects DNS queries for subdomains related to "Put.io" sharing website. references: - https://darkatlas.io/blog/medusa-ransomware-group-opsec-failure author: Omar Khaled (@beacon_exe) date: 2024-08-23 tags: - attack.command-and-control logsource: product: windows service: dns-client definition: 'Requirements: Microsoft-Windows-DNS Client Events/Operational Event Log must be enabled/collected in order to receive the events.' detection: selection: EventID: 3008 QueryName|contains: - api.put.io - upload.put.io condition: selection falsepositives: - Legitimate DNS queries and usage of Put.io level: medium
Near-miss passage: Sigma rule: Shadow Copies creation using operating systems utilities, possible credential access. Logsource: windows / process_creation. Rule: title: Shadow Copies Creation Using Operating Systems Utilities id: b17ea6f7-6e90-447e-a799-e6c0a493d6ce status: test description: Shadow Copies creation using operating systems utilities, possible credential access references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/tutorial-for-ntds-goodness-vssadmin-wmis-ntdsdit-system/ author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community date: 2019-10-22 modified: 2022-11-10 tags: - attack.credential-access - attack.t1003 - attack.t1003.002 - attack.t1003.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - \wmic.exe - \vssadmin.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll - wmic.exe - VSSADMIN.EXE selection_cli: CommandLine|contains|all: - shadow - create condition: all of selection_* falsepositives: - Legitimate administrator working with shadow copies, access for backup purposes level: medium
Query: rule covering Detects usage of the "systeminfo" command to retrieve information
Matching passage: Sigma rule: Detects usage of the "systeminfo" command to retrieve information. Logsource: windows / process_creation. Rule: title: Suspicious Execution of Systeminfo id: 0ef56343-059e-4cb6-adc1-4c3c967c5e46 status: test description: Detects usage of the "systeminfo" command to retrieve information references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1082/T1082.md#atomic-test-1---system-information-discovery - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/systeminfo author: frack113 date: 2022-01-01 modified: 2022-07-14 tags: - attack.discovery - attack.t1082 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \systeminfo.exe - OriginalFileName: sysinfo.exe condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects the usage of the "Squirrel.exe" to download arbitrary files. This binary is part of multiple Electron based soft. Logsource: windows / process_creation. Rule: title: Arbitrary File Download Via Squirrel.EXE id: 1e75c1cc-c5d4-42aa-ac3d-91b0b68b3b4c related: - id: 45239e6a-b035-4aaf-b339-8ad379fcb67e type: similar - id: fa4b21c9-0057-4493-b289-2556416ae4d7 type: obsolete status: test description: 'Detects the usage of the "Squirrel.exe" to download arbitrary files. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.) ' references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Squirrel/ - http://www.hexacorn.com/blog/2019/03/30/sqirrel-packages-manager-as-a-lolbin-a-k-a-many-electron-apps-are-lolbins-by-default/ - http://www.hexacorn.com/blog/2018/08/16/squirrel-as-a-lolbin/ author: Nasreddine Bencherchali (Nextron Systems), Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community date: 2022-06-09 modified: 2023-11-09 tags: - attack.execution - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: - \squirrel.exe - \update.exe selection_download_cli: CommandLine|contains: - ' --download ' - ' --update ' - ' --updateRollback=' selection_download_http_keyword: CommandLine|contains: http condition: all of selection_* falsepositives: - Expected FP with some Electron based applications such as (1Clipboard, Beaker Browser, Caret, Discord, GitHub Desktop, etc.) level: medium
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects execution of "rundll32" with potential obfuscated ordinal calls. Logsource: windows / process_creation. Rule: title: Potential Obfuscated Ordinal Call Via Rundll32 id: 43fa5350-db63-4b8f-9a01-789a427074e1 status: test description: Detects execution of "rundll32" with potential obfuscated ordinal calls references: - Internal Research - https://www.youtube.com/watch?v=52tAmVLg1KM&t=2070s author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2023-05-17 modified: 2025-02-23 tags: - attack.stealth - attack.t1027.010 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE - CommandLine|contains: rundll32 selection_cli: CommandLine|contains: - '#+' - '#-' - '#0' - '#655' - '#656' condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects installation or execution of services. Logsource: windows / system. Rule: title: HackTool Service Registration or Execution id: d26ce60c-2151-403c-9a42-49420d87b5e4 status: test description: Detects installation or execution of services references: - Internal Research author: Florian Roth (Nextron Systems) date: 2022-03-21 modified: 2023-08-07 tags: - attack.execution - attack.t1569.002 - attack.s0029 logsource: product: windows service: system detection: selection_eid: Provider_Name: Service Control Manager EventID: - 7045 - 7036 selection_service_name: ServiceName|contains: - cachedump - DumpSvc - gsecdump - pwdump - UACBypassedService - WCE SERVICE - WCESERVICE - winexesvc selection_service_image: ImagePath|contains: bypass condition: selection_eid and 1 of selection_service_* falsepositives: - Unknown level: high
Query: secure coding against Improper Verification of Cryptographic Signature
Matching passage: CWE-347 Improper Verification of Cryptographic Signature. The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Near-miss passage: CWE-126 Buffer Over-read. The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
Query: Persistence mechanism resembling Application Exhaustion Flood
Matching passage: T1499.003 Application Exhaustion Flood. Tactics: impact. Description: Adversaries may target resource intensive features of applications to cause a denial of service (DoS), denying availability to those applications. For example, specific features in web applications may be highly resource intensive. Repeated requests to those features may be able to exhaust system resources and deny access to the application or the server itself.(Citation: Arbor AnnualDoSreport Jan 2018)
Near-miss passage: T1499.002 Service Exhaustion Flood. Tactics: impact. Description: Adversaries may target the different network services provided by systems to conduct a denial of service (DoS). Adversaries often target the availability of DNS and web services, however others have been targeted as well.(Citation: Arbor AnnualDoSreport Jan 2018) Web server software can be attacked through a variety of means, some of which apply generally while others are specific to the software being used to provide the service. One example of this type of attack is known as a simple HTTP flood, where an adversary sends a large number of HTTP requests to a web server to overwhelm it and/or an application that runs on top of it. This flood relies on raw volume to accomplish the objective, exhausting any of the various resources required by the victim software to provide the service.(Citation: Cloudflare HTTPflood) Another variation, known as a SSL renegotiation attack, takes advantage of a protocol feature in SSL/TLS. The SSL/TLS protocol suite includes mechanisms for the client and server to agree on an encryption algorithm to use for subsequent secure connections. If SSL renegotiation is enabled, a request can be made for renegotiation of the crypto algorithm. In a renegotiation attack, the adversary establishes a SSL/TLS connection and then proceeds to make a series of renegotiation requests. Because the cryptographic renegotiation has a meaningful cost in computation cycles, this can cause an impact to the availability of the service when done in volume.(Citation: Arbor SSLDoS April 2012)
Query: exploit Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow attackers
Matching passage: CVE-2015-2430. CWE: CWE-264. CVSS: 9.300000190734863. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow attackers to bypass an application sandbox protection mechanism and perform unspecified filesystem actions via a crafted application, aka "Windows Filesystem Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-8025. CWE: CWE-264. CVSS: 2.0999999046325684. driver/subprocs.c in XScreenSaver before 5.34 does not properly perform an internal consistency check, which allows physically proximate attackers to bypass the lock screen by hot swapping monitors.
Query: patch priority for CVE-2015-5475
Matching passage: CVE-2015-5475. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Request Tracker (RT) 4.x before 4.2.12 allow remote attackers to inject arbitrary web script or HTML via vectors related to the (1) user and (2) group rights management pages.
Near-miss passage: CVE-2015-7365. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the plugin upgrade form in Revive Adserver before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via the filename of an uploaded file containing errors.
Query: risk of The Session package 1.x before 1.3.1 for Joomla! Framework allows remote attackers to execute arbitrary code via unspecified session values.
Matching passage: CVE-2015-8566. CWE: UNKNOWN. CVSS: 7.5. The Session package 1.x before 1.3.1 for Joomla! Framework allows remote attackers to execute arbitrary code via unspecified session values.
Near-miss passage: CVE-2015-4492. CWE: UNKNOWN. CVSS: 7.5. Use-after-free vulnerability in the XMLHttpRequest::Open implementation in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 might allow remote attackers to execute arbitrary code via a SharedWorker object that makes recursive calls to the open method of an XMLHttpRequest object.
Query: detect Detects the enumeration and query of interesting and in some cases sensitive services on the system via "sc.exe". Attack in logs
Matching passage: Sigma rule: Detects the enumeration and query of interesting and in some cases sensitive services on the system via "sc.exe". Attack. Logsource: windows / process_creation. Rule: title: Interesting Service Enumeration Via Sc.EXE id: e83e8899-c9b2-483b-b355-5decc942b959 status: test description: 'Detects the enumeration and query of interesting and in some cases sensitive services on the system via "sc.exe". Attackers often try to enumerate the services currently running on a system in order to find different attack vectors. ' references: - https://www.n00py.io/2021/05/dumping-plaintext-rdp-credentials-from-svchost-exe/ - https://pentestlab.blog/tag/svchost/ author: Swachchhanda Shrawan Poudel date: 2024-02-12 tags: - attack.t1003 - attack.credential-access logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \sc.exe - OriginalFileName: sc.exe selection_cli: CommandLine|contains: query selection_cmd: CommandLine|contains: termservice condition: all of selection_* falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects the usage of wmic.exe to enumerate or read Windows registry via the WMI StdRegProv class read methods (EnumKey,. Logsource: windows / process_creation. Rule: title: Registry Enumeration via WMI Stdregprov id: a0e417e2-2fa1-40da-b6d2-e094cd5e1191 related: - id: c453ab7a-1f5c-4716-a3b4-dea8135fb43a type: similar status: experimental description: 'Detects the usage of wmic.exe to enumerate or read Windows registry via the WMI StdRegProv class read methods (EnumKey, EnumValues, GetStringValue, etc.). While registry reads are common, attackers may use this technique to perform reconnaissance and discover sensitive configuration values, credentials, or installed software. The use of WMI as an alternative to standard tools like reg.exe can indicate an attempt to evade detection focused on traditional registry query commands. ' references: - https://trustedsec.com/blog/command-line-underdog-wmic-in-action - https://trustedsec.com/blog/wmi-for-script-kiddies - https://learn.microsoft.com/en-us/previous-versions/windows/desktop/regprov/stdregprov author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-07-30 modified: 2026-06-19 tags: - attack.execution - attack.t1047 - attack.discovery - attack.t1012 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \wmic.exe - OriginalFileName: wmic.exe selection_cli: CommandLine|contains|all: - stdregprov - call CommandLine|contains: - CheckAccess - EnumKey - EnumValues - GetBinaryValue - GetDWORDValue - GetExpandedStringValue - GetMultiStringValue - GetQWORDValue - GetSecurityDescriptor - GetStringValue condition: all of selection_* falsepositives: - Legitimate administrative activity level: medium
Query: weakness Class Instance Self Destruction Control Element
Matching passage: CWE-1082 Class Instance Self Destruction Control Element. The code contains a class instance that calls the method or function to delete or destroy itself.
Near-miss passage: CWE-1242 Inclusion of Undocumented Features or Chicken Bits. The device includes chicken bits or undocumented features that can create entry points for unauthorized actors.
Query: patch priority for CVE-2015-6316
Matching passage: CVE-2015-6316. CWE: CWE-255. CVSS: 6.5. The default configuration of sshd_config in Cisco Mobility Services Engine (MSE) through 8.0.120.7 allows logins by the oracle account, which makes it easier for remote attackers to obtain access by entering this account's hardcoded password in an SSH session, aka Bug ID CSCuv40501.
Near-miss passage: CVE-2015-6424. CWE: CWE-255. CVSS: 7.199999809265137. The boot manager in Cisco Application Policy Infrastructure Controller (APIC) 1.1(0.920a) allows local users to bypass intended access restrictions and obtain single-user-mode root access via unspecified vectors, aka Bug ID CSCuu83985.
Query: vulnerability: Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous befo
Matching passage: CVE-2015-5115. CWE: CWE-119. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3095, CVE-2015-5087, CVE-2015-5094, CVE-2015-5100, CVE-2015-5102, CVE-2015-5103, and CVE-2015-5104.
Near-miss passage: CVE-2015-7109. CWE: CWE-119. CVSS: 9.300000190734863. IOAcceleratorFamily in Apple OS X before 10.11.2 and tvOS before 9.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Query: vulnerability: Multiple open redirect vulnerabilities in Web Reference Database (aka refbase) through 0.9.6 and bleeding-edge before 2015-01-08 allow remote attackers to redirect users to arbitra
Matching passage: CVE-2015-6012. CWE: UNKNOWN. CVSS: 5.800000190734863. Multiple open redirect vulnerabilities in Web Reference Database (aka refbase) through 0.9.6 and bleeding-edge before 2015-01-08 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the referrer parameter.
Near-miss passage: CVE-2015-4895. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB.