alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Detects the execution of PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (
Matching passage: Sigma rule: Detects the execution of PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (. Logsource: windows / process_creation. Rule: title: PowerShell MSI Install via WindowsInstaller COM From Remote Location id: 222720a7-047f-4054-baa5-bab9be757db0 status: experimental description: 'Detects the execution of PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (`WindowsInstaller.Installer`) hosted remotely. This could be indication of malicious software deployment or lateral movement attempts using Windows Installer functionality. And the usage of WindowsInstaller COM object rather than msiexec could be an attempt to bypass the detection. ' references: - https://informationsecuritybuzz.com/the-real-danger-behind-a-simple-windows-shortcut/ - https://redcanary.com/blog/threat-intelligence/intelligence-insights-may-2025/ - https://www.virustotal.com/gui/file/f9710b0ba4de5fa0e7ec27da462d4d2fc6838eba83a19f23f6617a466bbad457 author: Meroujan Antonyan (vx3r) date: 2025-06-05 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1218 - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell_ise.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell_ISE.EXE - PowerShell.EXE - pwsh.dll selection_cli: CommandLine|contains|all: - -ComObject - InstallProduct( selection_remote: CommandLine|contains: - http - \\\\ filter_main_localhost: CommandLine|contains: - ://127.0.0.1 - ://localhost condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of "odbcconf" with "INSTALLDRIVER" which installs a new ODBC driver. Attackers abuse this to install a. Logsource: windows / process_creation. Rule: title: Driver/DLL Installation Via Odbcconf.EXE id: 3f5491e2-8db8-496b-9e95-1029fce852d4 related: - id: cb0fe7c5-f3a3-484d-aa25-d350a7912729 type: similar status: test description: Detects execution of "odbcconf" with "INSTALLDRIVER" which installs a new ODBC driver. Attackers abuse this to install and run malicious DLLs. references: - https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/ - https://web.archive.org/web/20191023232753/https://twitter.com/Hexacorn/status/1187143326673330176 - https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-22 tags: - attack.stealth - attack.t1218.008 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \odbcconf.exe - OriginalFileName: odbcconf.exe selection_cli: CommandLine|contains|all: - 'INSTALLDRIVER ' - .dll condition: all of selection_* falsepositives: - Legitimate driver DLLs being registered via "odbcconf" will generate false positives. Investigate the path of the DLL and its contents to determine if the action is authorized. level: medium
Query: detect Detects file creation events with filename patterns used by CrackMapExec. in logs
Matching passage: Sigma rule: Detects file creation events with filename patterns used by CrackMapExec.. Logsource: windows / file_event. Rule: title: HackTool - CrackMapExec File Indicators id: 736ffa74-5f6f-44ca-94ef-1c0df4f51d2a related: - id: 9433ff9c-5d3f-4269-99f8-95fc826ea489 type: obsolete status: test description: Detects file creation events with filename patterns used by CrackMapExec. references: - https://github.com/byt3bl33d3r/CrackMapExec/ author: Nasreddine Bencherchali (Nextron Systems) date: 2024-03-11 modified: 2024-06-27 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows category: file_event detection: selection_path: TargetFilename|startswith: C:\Windows\Temp\ selection_names_str: TargetFilename|endswith: - \temp.ps1 - \msol.ps1 selection_names_re: - TargetFilename|re: \\[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.txt$ - TargetFilename|re: \\[a-zA-Z]{8}\.tmp$ condition: selection_path and 1 of selection_names_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects loading of diagcab packages from a remote path, as seen in DogWalk vulnerability. Logsource: windows / diagnosis-scripted. Rule: title: Loading Diagcab Package From Remote Path id: 50cb47b8-2c33-4b23-a2e9-4600657d9746 status: test description: Detects loading of diagcab packages from a remote path, as seen in DogWalk vulnerability references: - https://twitter.com/nas_bench/status/1539679555908141061 - https://twitter.com/j00sean/status/1537750439701225472 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-14 tags: - attack.execution logsource: product: windows service: diagnosis-scripted detection: selection: EventID: 101 PackagePath|contains: \\\\ condition: selection falsepositives: - Legitimate package hosted on a known and authorized remote location level: high
Query: describe CVE-2015-10007
Matching passage: CVE-2015-10007. CWE: CWE-79. CVSS: 6.099999904632568. ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in 82Flex WEIPDCRM and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross site scripting. The attack may be launched remotely. The name of the patch is 43bad79392332fa39e31b95268e76fbda9fec3a4. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217184. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Near-miss passage: CVE-2015-0737. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Cisco FireSIGHT System Software 5.3.1.1 allow remote attackers to inject arbitrary web script or HTML via a crafted (1) GET or (2) POST parameter, aka Bug ID CSCuu11099.
Query: rule covering Detects the usage of the "Accesschk" utility, an access and privilege audit tool developed by SysInternal and often bein
Matching passage: Sigma rule: Detects the usage of the "Accesschk" utility, an access and privilege audit tool developed by SysInternal and often bein. Logsource: windows / process_creation. Rule: title: Permission Check Via Accesschk.EXE id: c625d754-6a3d-4f65-9c9a-536aea960d37 status: test description: Detects the usage of the "Accesschk" utility, an access and privilege audit tool developed by SysInternal and often being abused by attacker to verify process privileges references: - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment?slide=43 - https://www.youtube.com/watch?v=JGs-aKf2OtU&ab_channel=OFFZONEMOSCOW - https://github.com/carlospolop/PEASS-ng/blob/fa0f2e17fbc1d86f1fd66338a40e665e7182501d/winPEAS/winPEASbat/winPEAS.bat - https://github.com/gladiatx0r/Powerless/blob/04f553bbc0c65baf4e57344deff84e3f016e6b51/Powerless.bat author: Teymur Kheirkhabarov (idea), Mangatas Tondang, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2020-10-13 modified: 2026-06-29 tags: - attack.discovery - attack.t1069.001 logsource: product: windows category: process_creation detection: selection_img: - Product|endswith: AccessChk - Description|contains: Reports effective permissions - Image|endswith: - \accesschk.exe - \accesschk64.exe - \accesschk64a.exe - OriginalFileName: accesschk.exe selection_cli: CommandLine|contains: - 'uwcqv ' - 'kwsu ' - 'qwsu ' - 'uwdqs ' condition: all of selection* falsepositives: - System administrator Usage level: medium
Near-miss passage: Sigma rule: Detects various command line and scripting engines/processes such as "PowerShell", "Wscript", "Cmd", etc. spawning a "re. Logsource: windows / process_creation. Rule: title: Scripting/CommandLine Process Spawned Regsvr32 id: ab37a6ec-6068-432b-a64e-2c7bf95b1d22 related: - id: 8e2b24c9-4add-46a0-b4bb-0057b4e6187d type: obsolete status: test description: Detects various command line and scripting engines/processes such as "PowerShell", "Wscript", "Cmd", etc. spawning a "regsvr32" instance. references: - https://web.archive.org/web/20171001085340/https://subt0x10.blogspot.com/2017/04/bypass-application-whitelisting-script.html - https://app.any.run/tasks/34221348-072d-4b70-93f3-aa71f6ebecad/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2023-05-26 tags: - attack.stealth - attack.t1218.010 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell_ise.exe - \powershell.exe - \pwsh.exe - \wscript.exe Image|endswith: \regsvr32.exe filter_main_rpcproxy: ParentImage: C:\Windows\System32\cmd.exe CommandLine|endswith: ' /s C:\Windows\System32\RpcProxy\RpcProxy.dll' condition: selection and not 1 of filter_main_* falsepositives: - Legitimate ".bat", ".hta", ".ps1" or ".vbs" scripts leverage legitimately often. Apply additional filter and exclusions as necessary - Some legitimate Windows services level: medium
Query: alert when Detects process execution from a fake recycle bin folder, often used to avoid security solution.
Matching passage: Sigma rule: Detects process execution from a fake recycle bin folder, often used to avoid security solution.. Logsource: windows / process_creation. Rule: title: Suspicious Process Execution From Fake Recycle.Bin Folder id: 5ce0f04e-3efc-42af-839d-5b3a543b76c0 related: - id: cd8b36ac-8e4a-4c2f-a402-a29b8fbd5bca type: derived status: test description: Detects process execution from a fake recycle bin folder, often used to avoid security solution. references: - https://www.mandiant.com/resources/blog/infected-usb-steal-secrets - https://unit42.paloaltonetworks.com/cloaked-ursa-phishing/ author: X__Junior (Nextron Systems) date: 2023-07-12 modified: 2023-12-11 tags: - attack.persistence - attack.stealth logsource: category: process_creation product: windows detection: selection: Image|contains: - RECYCLERS.BIN\ - RECYCLER.BIN\ condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects uncommon or suspicious child processes of "eventvwr.exe" which might indicate a UAC bypass attempt. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Event Viewer Child Process id: be344333-921d-4c4d-8bb8-e584cf584780 related: - id: 7c81fec3-1c1d-43b0-996a-46753041b1b6 type: derived status: test description: Detects uncommon or suspicious child processes of "eventvwr.exe" which might indicate a UAC bypass attempt references: - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/ - https://www.hybrid-analysis.com/sample/e122bc8bf291f15cab182a5d2d27b8db1e7019e4e96bb5cdbd1dfe7446f3f51f?environmentId=100 author: Florian Roth (Nextron Systems) date: 2017-03-19 modified: 2023-09-28 tags: - attack.privilege-escalation - attack.t1548.002 - car.2019-04-001 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \eventvwr.exe filter_main_generic: Image|endswith: - :\Windows\System32\mmc.exe - :\Windows\System32\WerFault.exe - :\Windows\SysWOW64\WerFault.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: risk of Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect availability via unknown vectors related to Solaris Kernel Zones, a different vulnerability than C
Matching passage: CVE-2015-4831. CWE: UNKNOWN. CVSS: 4.900000095367432. Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect availability via unknown vectors related to Solaris Kernel Zones, a different vulnerability than CVE-2015-4822.
Near-miss passage: CVE-2015-1295. CWE: UNKNOWN. CVSS: 7.5. Multiple use-after-free vulnerabilities in the PrintWebViewHelper class in components/printing/renderer/print_web_view_helper.cc in Google Chrome before 45.0.2454.85 allow user-assisted remote attackers to cause a denial of service or possibly have unspecified other impact by triggering nested IPC messages during preparation for printing, as demonstrated by messages associated with PDF documents in conjunction with messages about printer capabilities.
Query: explain CWE-1125
Matching passage: CWE-1125 Excessive Attack Surface. The product has an attack surface whose quantitative measurement exceeds a desirable maximum.
Near-miss passage: CWE-181 Incorrect Behavior Order: Validate Before Filter. The product validates data before it has been filtered, which prevents the product from detecting data that becomes invalid after the filtering step.
Query: CVE similar to CVE-2015-3363
Matching passage: CVE-2015-3363. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Contact Form Fields module before 6.x-2.3 for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete fields via unspecified vectors.
Near-miss passage: CVE-2015-10081. CWE: CWE-352. CVSS: 8.800000190734863. A vulnerability was found in arnoldle submitByMailPlugin 1.0b2.9 and classified as problematic. This issue affects some unknown processing of the file edit_list.php. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.0b2.9a is able to address this issue. The patch is named a739f680a1623d22f52ff1371e86ca472e63756f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-221495.
Query: playbook for alert: Encoded PowerShell / command-line abuse matching Network Security Appliances
Matching passage: Playbook for T1590.006 Network Security Appliances. 1) Validate alert telemetry against T1590.006. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: reconnaissance. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may gather information about the victim's network security appliances that can be used during targeting. Information about network security appliances may include a variety of details, such as the existence and specifics of deployed firewalls, content filters, and proxies/bastion hosts. Adversaries may also target information about victim network-based intrusion detection systems (NIDS
Near-miss passage: Playbook for T1590.004 Network Topology. Different response path focused on reconnaissance.
Query: CWE for Use of Blocking Code in Single-threaded, Non-blocking Context
Matching passage: CWE-1322 Use of Blocking Code in Single-threaded, Non-blocking Context. The product uses a non-blocking model that relies on a single threaded process for features such as scalability, but it contains code that can block when it is invoked.
Near-miss passage: CWE-827 Improper Control of Document Type Definition. The product does not restrict a reference to a Document Type Definition (DTD) to the intended control sphere. This might allow attackers to reference arbitrary DTDs, possibly causing the product to expose files, consume excessive system resources, or execute arbitrary http requests on behalf of the attacker.
Query: describe CVE-2015-3353
Matching passage: CVE-2015-3353. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Field Display Label module before 7.x-1.3 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via the alternate field label in content types settings.
Near-miss passage: CVE-2015-5375. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in unspecified dialogs for printing content in the Front End in Open-Xchange Server 6 and OX App Suite before 6.22.8-rev8, 6.22.9 before 6.22.9-rev15m, 7.x before 7.6.1-rev25, and 7.6.2 before 7.6.2-rev20 allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to object properties.
Query: Sigma rule for Potential adversaries stopping ETW providers recording loaded .NET assemblies.
Matching passage: Sigma rule: Potential adversaries stopping ETW providers recording loaded .NET assemblies.. Logsource: windows / registry_set. Rule: title: ETW Logging Disabled In .NET Processes - Sysmon Registry id: bf4fc428-dcc3-4bbd-99fe-2422aeee2544 related: - id: a4c90ea1-2634-4ca0-adbb-35eae169b6fc type: similar status: test description: Potential adversaries stopping ETW providers recording loaded .NET assemblies. references: - https://twitter.com/_xpn_/status/1268712093928378368 - https://social.msdn.microsoft.com/Forums/vstudio/en-US/0878832e-39d7-4eaf-8e16-a729c4c40975/what-can-i-use-e13c0d23ccbc4e12931bd9cc2eee27e4-for?forum=clr - https://github.com/dotnet/runtime/blob/ee2355c801d892f2894b0f7b14a20e6cc50e0e54/docs/design/coreclr/jit/viewing-jit-dumps.md#setting-configuration-variables - https://github.com/dotnet/runtime/blob/f62e93416a1799aecc6b0947adad55a0d9870732/src/coreclr/src/inc/clrconfigvalues.h#L35-L38 - https://github.com/dotnet/runtime/blob/7abe42dc1123722ed385218268bb9fe04556e3d3/src/coreclr/src/inc/clrconfig.h#L33-L39 - https://github.com/dotnet/runtime/search?p=1&q=COMPlus_&unscoped_q=COMPlus_ - https://bunnyinside.com/?term=f71e8cb9c76a - http://managed670.rssing.com/chan-5590147/all_p1.html - https://github.com/dotnet/runtime/blob/4f9ae42d861fcb4be2fcd5d3d55d5f227d30e723/docs/coding-guidelines/clr-jit-coding-conventions.md#1412-disabling-code - https://blog.xpnsec.com/hiding-your-dotnet-complus-etwenabled/ - https://i.blackhat.com/EU-21/Wednesday/EU-21-Teodorescu-Veni-No-Vidi-No-Vici-Attacks-On-ETW-Blind-EDRs.pdf author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-06-05 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 - attack.t1685 logsource: product: windows category: registry_set detection: selection_etw_enabled: TargetObject|endswith: SOFTWARE\Microsoft\.NETFramework\ETWEnabled Details: DWORD (0x00000000) selection_complus: TargetObject|endswith: - \COMPlus_ETWEnabled - \COMPlus_ETWFlags Details: - 0 - DWORD (0x00000000) condition: 1 of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detection use of the command "split" to split files into parts and possible transfer.. Logsource: linux / auditd. Rule: title: Split A File Into Pieces - Linux id: 2dad0cba-c62a-4a4f-949f-5f6ecd619769 status: test description: Detection use of the command "split" to split files into parts and possible transfer. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1030/T1030.md author: Igor Fits, oscd.community date: 2020-10-15 modified: 2022-11-28 tags: - attack.exfiltration - attack.t1030 logsource: product: linux service: auditd detection: selection: type: SYSCALL comm: split condition: selection falsepositives: - Legitimate administrative activity level: low
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the use of the Microsoft signed script "CL_mutexverifiers" to proxy the execution of additional PowerShell scrip. Logsource: windows / process_creation. Rule: title: Potential Script Proxy Execution Via CL_Mutexverifiers.ps1 id: 1e0e1a81-e79b-44bc-935b-ddb9c8006b3d status: test description: Detects the use of the Microsoft signed script "CL_mutexverifiers" to proxy the execution of additional PowerShell script commands references: - https://lolbas-project.github.io/lolbas/Scripts/CL_mutexverifiers/ author: Nasreddine Bencherchali (Nextron Systems), oscd.community, Natalia Shornikova, frack113 date: 2022-05-21 modified: 2023-08-17 tags: - attack.stealth - attack.t1216 logsource: category: process_creation product: windows detection: selection_pwsh: ParentImage|endswith: - \powershell.exe - \pwsh.exe Image|endswith: \powershell.exe CommandLine|contains: ' -nologo -windowstyle minimized -file ' selection_temp: CommandLine|contains: - \AppData\Local\Temp\ - \Windows\Temp\ condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects suspicious Spring framework exceptions that could indicate exploitation attempts. Logsource: spring / application. Rule: title: Spring Framework Exceptions id: ae48ab93-45f7-4051-9dfe-5d30a3f78e33 status: stable description: Detects suspicious Spring framework exceptions that could indicate exploitation attempts references: - https://docs.spring.io/spring-security/site/docs/current/api/overview-tree.html author: Thomas Patzke date: 2017-08-06 modified: 2020-09-01 tags: - attack.initial-access - attack.t1190 logsource: category: application product: spring detection: keywords: - AccessDeniedException - CsrfException - InvalidCsrfTokenException - MissingCsrfTokenException - CookieTheftException - InvalidCookieException - RequestRejectedException condition: keywords falsepositives: - Application bugs level: medium
Query: Sigma YAML for opencanary / application
Matching passage: Sigma rule: Detects instances where a VNC service on an OpenCanary node has had a connection attempt.. Logsource: opencanary / application. Rule: title: OpenCanary - VNC Connection Attempt id: 9db5446c-b44a-4291-8b89-fcab5609c3b3 status: test description: Detects instances where a VNC service on an OpenCanary node has had a connection attempt. references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.lateral-movement - attack.t1021 logsource: category: application product: opencanary detection: selection: logtype: 12001 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects registry changes to Microsoft Office "AccessVBOM" to a value of "1" which disables trust access for VBA on the v. Logsource: windows / registry_set. Rule: title: Trust Access Disable For VBApplications id: 1a5c46e9-f32f-42f7-b2bc-6e9084db7fbf related: - id: 9b894e57-033f-46cf-b7fa-a52804181973 type: obsolete status: test description: Detects registry changes to Microsoft Office "AccessVBOM" to a value of "1" which disables trust access for VBA on the victim machine and lets attackers execute malicious macros without any Microsoft Office warnings. references: - https://twitter.com/inversecos/status/1494174785621819397 - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/zloader-with-a-new-infection-technique/ - https://securelist.com/scarcruft-surveilling-north-korean-defectors-and-human-rights-activists/105074/ author: Trent Liffick (@tliffick), Nasreddine Bencherchali (Nextron Systems) date: 2020-05-22 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Security\AccessVBOM Details: DWORD (0x00000001) condition: selection falsepositives: - Unlikely level: high