alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for windows / network_connection
Matching passage: Sigma rule: Detects a network connection initiated by the Add-In deployment cache updating utility "AddInutil.exe". This could indic. Logsource: windows / network_connection. Rule: title: Network Connection Initiated By AddinUtil.EXE id: 5205613d-2a63-4412-a895-3a2458b587b3 status: test description: 'Detects a network connection initiated by the Add-In deployment cache updating utility "AddInutil.exe". This could indicate a potential command and control communication as this tool doesn''t usually initiate network activity. ' references: - https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html author: Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri) date: 2023-09-18 modified: 2024-07-16 tags: - attack.stealth - attack.t1218 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' Image|endswith: \addinutil.exe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: The OpenWith.exe executes other binary. Logsource: windows / process_creation. Rule: title: OpenWith.exe Executes Specified Binary id: cec8e918-30f7-4e2d-9bfa-a59cc97ae60f status: test description: The OpenWith.exe executes other binary references: - https://github.com/LOLBAS-Project/LOLBAS/blob/4db780e0f0b2e2bb8cb1fa13e09196da9b9f1834/yml/LOLUtilz/OSBinaries/Openwith.yml - https://twitter.com/harr0ey/status/991670870384021504 author: Beyu Denis, oscd.community (rule), @harr0ey (idea) date: 2019-10-12 modified: 2021-11-27 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: Image|endswith: \OpenWith.exe CommandLine|contains: /c condition: selection falsepositives: - Unknown level: high
Query: risk of Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acr
Matching passage: CVE-2015-6696. CWE: CWE-787. CVSS: 6.800000190734863. Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-6698.
Near-miss passage: CVE-2015-8658. CWE: CWE-787. CVSS: 8.800000190734863. Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (uninitialized pointer dereference and memory corruption) via crafted MPEG-4 data, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, CVE-2015-8451, CVE-2015-8455, CVE-2015-8652, CVE-2015-8654, CVE-2015-8656, CVE-2015-8657, and CVE-2015-8820.
Query: CVE similar to CVE-2015-1437
Matching passage: CVE-2015-1437. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Asus RT-N10+ D1 router with firmware 2.1.1.1.70 allow remote attackers to inject arbitrary web script or HTML via the flag parameter to (1) result_of_get_changed_status.asp or (2) error_page.htm.
Near-miss passage: CVE-2015-5169. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20.
Query: alert when Detects usage of "xterm" as a potential reverse shell tunnel
Matching passage: Sigma rule: Detects usage of "xterm" as a potential reverse shell tunnel. Logsource: linux / process_creation. Rule: title: Potential Xterm Reverse Shell id: 4e25af4b-246d-44ea-8563-e42aacab006b status: test description: Detects usage of "xterm" as a potential reverse shell tunnel references: - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet - https://www.revshells.com/ author: '@d4ns4n_' date: 2023-04-24 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: linux detection: selection: Image|contains: xterm CommandLine|contains: -display CommandLine|endswith: :1 condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the creation of files with scripting or executable extensions by Mysql daemon. Which could be an indicator of "U. Logsource: windows / file_event. Rule: title: Uncommon File Creation By Mysql Daemon Process id: c61daa90-3c1e-4f18-af62-8f288b5c9aaf status: test description: 'Detects the creation of files with scripting or executable extensions by Mysql daemon. Which could be an indicator of "User Defined Functions" abuse to download malware. ' references: - https://asec.ahnlab.com/en/58878/ - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/honeypot-recon-mysql-malware-infection-via-user-defined-functions-udf/ author: Joseph Kamau date: 2024-05-27 tags: - attack.stealth logsource: product: windows category: file_event detection: selection: Image|endswith: - \mysqld.exe - \mysqld-nt.exe TargetFilename|endswith: - .bat - .dat - .dll - .exe - .ps1 - .psm1 - .vbe - .vbs condition: selection falsepositives: - Unknown level: high
Query: exploit Heap-based buffer overflow in Panda Security Kernel Memory Access Driver 1.0.0.13 allows attackers to execute arbitrary code with kernel privileges via a crafted size input for all
Matching passage: CVE-2015-1438. CWE: CWE-119. CVSS: 7.800000190734863. Heap-based buffer overflow in Panda Security Kernel Memory Access Driver 1.0.0.13 allows attackers to execute arbitrary code with kernel privileges via a crafted size input for allocated kernel paged pool and allocated non-paged pool buffers.
Near-miss passage: CVE-2015-3700. CWE: CWE-119. CVSS: 7.199999809265137. Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-3695, CVE-2015-3696, CVE-2015-3697, CVE-2015-3698, CVE-2015-3699, CVE-2015-3701, and CVE-2015-3702.
Query: rule covering Detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identif
Matching passage: Sigma rule: Detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identif. Logsource: aws / cloudtrail. Rule: title: AWS ConsoleLogin Failed Authentication id: 6393e346-1977-46ef-8987-ad414a145fad status: experimental description: 'Detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identifying potential brute-force attacks or unauthorized access attempts to AWS accounts. ' references: - https://naikordian.github.io/blog/posts/brute-force-aws-console/ - https://help.fortinet.com/fsiem/Public_Resource_Access/7_2_1/rules/PH_RULE_AWS_Management_Console_Brute_Force_of_Root_User_Identity.htm - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/aws_login_failure/aws_cloudtrail_events.json author: Ivan Saakov, Nasreddine Bencherchali date: 2025-10-19 tags: - attack.credential-access - attack.t1110 logsource: product: aws service: cloudtrail detection: selection: eventName: ConsoleLogin errorMessage: Failed authentication condition: selection falsepositives: - Legitimate failed login attempts by authorized users. Investigate the source of repeated failed login attempts. level: medium
Near-miss passage: Sigma rule: Detects remote thread creation from CACTUSTORCH as described in references.. Logsource: windows / create_remote_thread. Rule: title: HackTool - CACTUSTORCH Remote Thread Creation id: 2e4e488a-6164-4811-9ea1-f960c7359c40 status: test description: Detects remote thread creation from CACTUSTORCH as described in references. references: - https://twitter.com/SBousseaden/status/1090588499517079552 - https://github.com/mdsecactivebreach/CACTUSTORCH author: '@SBousseaden (detection), Thomas Patzke (rule)' date: 2019-02-01 modified: 2023-05-05 tags: - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1055.012 - attack.t1059.005 - attack.t1059.007 - attack.t1218.005 logsource: product: windows category: create_remote_thread detection: selection: SourceImage|endswith: - \System32\cscript.exe - \System32\wscript.exe - \System32\mshta.exe - \winword.exe - \excel.exe TargetImage|contains: \SysWOW64\ StartModule: null condition: selection falsepositives: - Unknown level: high
Query: SOC alert related to Modify Cloud Compute Configurations
Matching passage: T1578.005 Modify Cloud Compute Configurations. Tactics: defense impairment. Description: Adversaries may modify settings that directly affect the size, locations, and resources available to cloud compute infrastructure in order to evade defenses. These settings may include service quotas, subscription associations, tenant-wide policies, or other configurations that impact available compute. Such modifications may allow adversaries to abuse the victim’s compute resources to achieve their goals, potentially without affecting the execution of running instances and/or revealing their activities to the victim. For example, cloud providers often limit customer usage of compute resources via quotas. Customers may request adjustments to these quotas to support increased computing needs, though these adjustments may require approval from the cloud provider. Adversaries who compromise a cloud environment may similarly request quota adjustments in order to support their activities, such as enabling additional [Resource Hijacking](https://attack.mitre.org/techniques/T1496) without raising suspicion by using up a victim’s entire quota.(Citation: Microsoft Cryptojacking 2023) Adversaries may also increase allowed resource usage by modifying any tenant-wide policies that limit the sizes of deployed virtual machines.(Citation: Microsoft Azure Policy) Adversaries may also modify settings that affect where cloud resources can be deployed, such as enabling [Unused/Unsupported Cloud Regions](https://attack.mitre.org/techniques/T1535).
Near-miss passage: T1578 Modify Cloud Compute Infrastructure. Tactics: defense impairment. Description: An adversary may attempt to modify a cloud account's compute service infrastructure to evade defenses. A modification to the compute service infrastructure can include the creation, deletion, or modification of one or more components such as compute instances, virtual machines, and snapshots. Permissions gained from the modification of infrastructure components may bypass restrictions that prevent access to existing infrastructure. Modifying infrastructure components may also allow an adversary to evade detection and remove evidence of their presence.(Citation: Mandiant M-Trends 2020)
Query: risk of Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to spoof meeting organizers via unspecified vectors, aka "Exchange Forged Meeting Request Spoofin
Matching passage: CVE-2015-1631. CWE: CWE-284. CVSS: 5.0. Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to spoof meeting organizers via unspecified vectors, aka "Exchange Forged Meeting Request Spoofing Vulnerability."
Near-miss passage: CVE-2015-2952. CWE: CWE-284. CVSS: 6.5. The user-information management functionality in Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote authenticated users to bypass intended access restrictions and modify administrative credentials via unspecified vectors, a different vulnerability than CVE-2015-2953 and CVE-2015-2958.
Query: detect Detects the Installation of a Exchange Transport Agent in logs
Matching passage: Sigma rule: Detects the Installation of a Exchange Transport Agent. Logsource: windows / process_creation. Rule: title: MSExchange Transport Agent Installation id: 83809e84-4475-4b69-bc3e-4aad8568612f related: - id: 83809e84-4475-4b69-bc3e-4aad8568612f type: similar status: test description: Detects the Installation of a Exchange Transport Agent references: - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=7 author: Tobias Michalski (Nextron Systems) date: 2021-06-08 modified: 2022-10-09 tags: - attack.persistence - attack.t1505.002 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: Install-TransportAgent condition: selection falsepositives: - Legitimate installations of exchange TransportAgents. AssemblyPath is a good indicator for this. level: medium
Near-miss passage: Sigma rule: Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.. Logsource: windows / process_creation. Rule: title: PUA - Advanced IP Scanner Execution id: bef37fa2-f205-4a7b-b484-0759bfd5f86f status: test description: Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups. references: - https://news.sophos.com/en-us/2019/12/09/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection/ - https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html - https://labs.f-secure.com/blog/prelude-to-ransomware-systembc - https://assets.documentcloud.org/documents/20444693/fbi-pin-egregor-ransomware-bc-01062021.pdf - https://thedfirreport.com/2021/01/18/all-that-for-a-coinminer - https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Other/Advanced%20IP%20Scanner author: Nasreddine Bencherchali (Nextron Systems), @ROxPinTeddy date: 2020-05-12 modified: 2023-02-07 tags: - attack.discovery - attack.t1046 - attack.t1135 logsource: category: process_creation product: windows detection: selection_img: - Image|contains: \advanced_ip_scanner - OriginalFileName|contains: advanced_ip_scanner - Description|contains: Advanced IP Scanner selection_cli: CommandLine|contains|all: - /portable - /lng condition: 1 of selection_* falsepositives: - Legitimate administrative use level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_advanced_ip_scanner/info.yml
Query: describe CVE-2015-1546
Matching passage: CVE-2015-1546. CWE: UNKNOWN. CVSS: 5.0. Double free vulnerability in the get_vrFilter function in servers/slapd/filter.c in OpenLDAP 2.4.40 allows remote attackers to cause a denial of service (crash) via a crafted search query with a matched values control.
Near-miss passage: CVE-2015-2368. CWE: UNKNOWN. CVSS: 6.900000095367432. Untrusted search path vulnerability in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, Windows Server 2012 R2, and Windows RT 8.1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, aka "Windows DLL Remote Code Execution Vulnerability."
Query: vulnerability: Apple OS X before 10.10.5 does not properly implement authentication, which allows local users to obtain admin privileges via unspecified vectors.
Matching passage: CVE-2015-3775. CWE: CWE-287. CVSS: 7.199999809265137. Apple OS X before 10.10.5 does not properly implement authentication, which allows local users to obtain admin privileges via unspecified vectors.
Near-miss passage: CVE-2015-3457. CWE: CWE-287. CVSS: 5.0. Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote attackers to bypass authentication via the forwarded parameter.
Query: detect Detects the use of PSAsyncShell an Asynchronous TCP Reverse Shell written in powershell in logs
Matching passage: Sigma rule: Detects the use of PSAsyncShell an Asynchronous TCP Reverse Shell written in powershell. Logsource: windows / ps_script. Rule: title: PSAsyncShell - Asynchronous TCP Reverse Shell id: afd3df04-948d-46f6-ae44-25966c44b97f status: test description: Detects the use of PSAsyncShell an Asynchronous TCP Reverse Shell written in powershell references: - https://github.com/JoelGMSec/PSAsyncShell author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-04 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: PSAsyncShell condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects when adversaries try to stop system services or processes by deleting or disabling their respective scheduled ta. Logsource: windows / taskscheduler. Rule: title: Important Scheduled Task Deleted or Disabled id: 9e3cb244-bdb8-4632-8c90-6079c8f4f16d related: - id: dbc1f800-0fe0-4bc0-9c66-292c2abe3f78 type: similar - id: 7595ba94-cf3b-4471-aa03-4f6baa9e5fad type: similar - id: 9ac94dc8-9042-493c-ba45-3b5e7c86b980 type: similar status: test description: 'Detects when adversaries try to stop system services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities ' references: - https://www.socinvestigation.com/most-common-windows-event-ids-to-hunt-mind-map/ author: frack113 date: 2023-01-13 modified: 2026-03-11 tags: - attack.impact - attack.t1489 logsource: product: windows service: taskscheduler definition: 'Requirements: The "Microsoft-Windows-TaskScheduler/Operational" is disabled by default and needs to be enabled in order for this detection to trigger' detection: selection: EventID: - 141 - 142 TaskName|contains: - \Windows\SystemRestore\SR - \Windows\Windows Defender\ - \Windows\BitLocker - \Windows\WindowsBackup\ - \Windows\WindowsUpdate\ - \Windows\UpdateOrchestrator\ - \Windows\ExploitGuard filter_main_user: UserName|contains: - AUTHORI - AUTORI condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/builtin/taskscheduler/win_taskscheduler_susp_schtasks_delete_or_disable/info.yml simulation: - type: atomic-red-team name: Windows - Disable the SR scheduled task technique: T1490 atomic_guid: 1c68c68d-83a4-4981-974e-8993055fa034
Query: risk of GANMA! App for iOS does not verify SSL certificates.
Matching passage: CVE-2015-7785. CWE: CWE-295. CVSS: 5.900000095367432. GANMA! App for iOS does not verify SSL certificates.
Near-miss passage: CVE-2015-8960. CWE: CWE-295. CVSS: 8.100000381469727. The TLS protocol 1.2 and earlier supports the rsa_fixed_dh, dss_fixed_dh, rsa_fixed_ecdh, and ecdsa_fixed_ecdh values for ClientCertificateType but does not directly document the ability to compute the master secret in certain situations with a client secret key and server public key but not a server secret key, which makes it easier for man-in-the-middle attackers to spoof TLS servers by leveraging knowledge of the secret key for an arbitrary installed client X.509 certificate, aka the "Key Compromise Impersonation (KCI)" issue.
Query: indicators of Winlogon Helper DLL
Matching passage: T1547.004 Winlogon Helper DLL. Tactics: persistence, privilege escalation. Description: Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in. Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. Registry entries in <code>HKLM\Software[\\Wow6432Node\\]\Microsoft\Windows NT\CurrentVersion\Winlogon\</code> and <code>HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\</code> are used to manage additional helper programs and functionalities that support Winlogon.(Citation: Cylance Reg Persistence Sept 2013) Malicious modifications to these Registry keys may cause Winlogon to load and execute malicious DLLs and/or executables. Specifically, the following subkeys have been known to be possibly vulnerable to abuse: (Citation: Cylance Reg Persistence Sept 2013) * Winlogon\Notify - points to notification package DLLs that handle Winlogon events * Winlogon\Userinit - points to userinit.exe, the user initialization program executed when a user logs on * Winlogon\Shell - points to explorer.exe, the system shell executed when a user logs on Adversaries may take advantage of these features to repeatedly execute malicious code and establish persistence.
Near-miss passage: T1547 Boot or Logon Autostart Execution. Tactics: persistence, privilege escalation. Description: Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon.(Citation: Microsoft Run Key)(Citation: MSDN Authentication Packages)(Citation: Microsoft TimeProvider)(Citation: Cylance Reg Persistence Sept 2013)(Citation: Linux Kernel Programming) These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel. Since some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges.
Query: detection rule: Detects when a system process (i.e. located in system32, syswow64, etc.) loads a DLL from a suspicious location or a loc
Matching passage: Sigma rule: Detects when a system process (i.e. located in system32, syswow64, etc.) loads a DLL from a suspicious location or a loc. Logsource: windows / image_load. Rule: title: DLL Load By System Process From Suspicious Locations id: 9e9a9002-56c4-40fd-9eff-e4b09bfa5f6c status: test description: Detects when a system process (i.e. located in system32, syswow64, etc.) loads a DLL from a suspicious location or a location with permissive permissions such as "C:\Users\Public" references: - https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC (Idea) author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-17 modified: 2023-09-18 tags: - attack.stealth - attack.t1070 logsource: product: windows category: image_load detection: selection: Image|startswith: C:\Windows\ ImageLoaded|startswith: - C:\Users\Public\ - C:\PerfLogs\ condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects default install commands of the Triple Cross eBPF rootkit based on the "deployer.sh" script. Logsource: linux / process_creation. Rule: title: Triple Cross eBPF Rootkit Install Commands id: 22236d75-d5a0-4287-bf06-c93b1770860f status: test description: Detects default install commands of the Triple Cross eBPF rootkit based on the "deployer.sh" script references: - https://github.com/h3xduck/TripleCross/blob/1f1c3e0958af8ad9f6ebe10ab442e75de33e91de/apps/deployer.sh author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-05 tags: - attack.stealth - attack.t1014 logsource: category: process_creation product: linux detection: selection: Image|endswith: /sudo CommandLine|contains|all: - ' tc ' - ' enp0s3 ' CommandLine|contains: - ' qdisc ' - ' filter ' condition: selection falsepositives: - Unlikely level: high
Query: CVE similar to CVE-2015-0732
Matching passage: CVE-2015-0732. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Cisco AsyncOS on the Web Security Appliance (WSA) 9.0.0-193; Email Security Appliance (ESA) 8.5.6-113, 9.1.0-032, 9.1.1-000, and 9.6.0-000; and Content Security Management Appliance (SMA) 9.1.0-033 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug IDs CSCuu37430, CSCuu37420, CSCut71981, and CSCuv50167.
Near-miss passage: CVE-2015-2043. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Visualware MyConnection Server 8.2b allow remote attackers to inject arbitrary web script or HTML via the (1) bt, (2) variable, or (3) et parameter to myspeed/db/historyitem.