alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection rule: Detects the usage of SystemSettingsAdminFlows.exe to disable Windows Defender. SystemSettingsAdminFlows.exe is a legitim
Matching passage: Sigma rule: Detects the usage of SystemSettingsAdminFlows.exe to disable Windows Defender. SystemSettingsAdminFlows.exe is a legitim. Logsource: windows / process_creation. Rule: title: Windows Defender Disabled Via SystemSettingsAdminFlows.EXE id: da92713f-ca2d-4fab-8320-098013d3f43a status: experimental description: 'Detects the usage of SystemSettingsAdminFlows.exe to disable Windows Defender. SystemSettingsAdminFlows.exe is a legitimate Windows component used for administrative configuration tasks. However, attackers may abuse it to disable Windows Defender as part of their attack chain, especially in the context of ransomware or other malware campaigns. ' references: - https://thedfirreport.com/2026/02/23/apache-activemq-exploit-leads-to-lockbit-ransomware/ - https://www.huntress.com/blog/lolbin-to-inc-ransomware tags: - attack.defense-impairment - attack.t1685 author: Chirag Damani (KPMG India), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-07-01 logsource: category: process_creation product: windows detection: selection_ssaf_img: - Image|endswith: \SystemSettingsAdminFlows.exe - OriginalFileName: SystemSettingsAdminFlows.EXE selection_ssaf_cli: CommandLine|contains: defender selection_cli_enable_opt: CommandLine|contains: - 'RTP ' - 'RealTimeProtection ' - 'DisableEnhancedNotifications ' selection_cli_enable_value: CommandLine|contains: '1' selection_cli_disable_opt: CommandLine|contains: - 'SubmitSamplesConsent ' - 'SpyNetReporting ' - 'DisableCDPUserAuthPolicy ' selection_cli_disable_value: CommandLine|contains: '0' condition: all of selection_ssaf_* and (all of selection_cli_enable_* or all of selection_cli_disable_*) falsepositives: - Legitimate turn off of Windows Defender by the technical users or administrators for troubleshooting or other purposes. level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_lolbin_systemsettingsadminflows_defender_disable/info.yml
Near-miss passage: Sigma rule: Detects PowerShell called from an executable by the version mismatch method. Logsource: windows / ps_classic_start. Rule: title: PowerShell Called from an Executable Version Mismatch id: c70e019b-1479-4b65-b0cc-cd0c6093a599 status: test description: Detects PowerShell called from an executable by the version mismatch method references: - https://adsecurity.org/?p=2921 author: Sean Metcalf (source), Florian Roth (Nextron Systems) date: 2017-03-05 modified: 2023-10-27 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_classic_start detection: selection_engine: Data|contains: - EngineVersion=2. - EngineVersion=4. - EngineVersion=5. selection_host: Data|contains: HostVersion=3. condition: all of selection_* falsepositives: - Unknown level: high
Query: rule covering Monitors for the hiding possible malicious files in the C:\Windows\Fonts\ location. This folder doesn't require admin pr
Matching passage: Sigma rule: Monitors for the hiding possible malicious files in the C:\Windows\Fonts\ location. This folder doesn't require admin pr. Logsource: windows / process_creation. Rule: title: Writing Of Malicious Files To The Fonts Folder id: ae9b0bd7-8888-4606-b444-0ed7410cb728 status: test description: Monitors for the hiding possible malicious files in the C:\Windows\Fonts\ location. This folder doesn't require admin privillege to be written and executed from. references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ author: Sreeman date: 2020-04-21 modified: 2022-03-08 tags: - attack.stealth - attack.t1211 - attack.t1059 - attack.persistence - attack.execution logsource: product: windows category: process_creation detection: selection_1: CommandLine|contains: - echo - copy - type - file createnew - cacls selection_2: CommandLine|contains: C:\Windows\Fonts\ selection_3: CommandLine|contains: - .sh - .exe - .dll - .bin - .bat - .cmd - .js - .msh - .reg - .scr - .ps - .vb - .jar - .pl - '.inf' - .cpl - .hta - .msi - .vbs condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: The Tasks folder in system32 and syswow64 are globally writable paths. Adversaries can take advantage of this and load o. Logsource: windows / process_creation. Rule: title: Tasks Folder Evasion id: cc4e02ba-9c06-48e2-b09e-2500cace9ae0 status: test description: 'The Tasks folder in system32 and syswow64 are globally writable paths. Adversaries can take advantage of this and load or influence any script hosts or ANY .NET Application in Tasks to load and execute a custom assembly into cscript, wscript, regsvr32, mshta, eventvwr ' references: - https://twitter.com/subTee/status/1216465628946563073 - https://gist.github.com/am0nsec/8378da08f848424e4ab0cc5b317fdd26 author: Sreeman date: 2020-01-13 modified: 2022-12-25 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: product: windows category: process_creation detection: selection1: CommandLine|contains: - 'echo ' - 'copy ' - 'type ' - file createnew selection2: CommandLine|contains: - ' C:\Windows\System32\Tasks\' - ' C:\Windows\SysWow64\Tasks\' condition: all of selection* falsepositives: - Unknown level: high
Query: detect System Binary Proxy Execution
Matching passage: T1218 System Binary Proxy Execution. Tactics: stealth. Description: Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system.(Citation: LOLBAS Project) Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands. Similarly, on Linux systems adversaries may abuse trusted binaries such as <code>split</code> to proxy execution of malicious commands.(Citation: split man page)(Citation: GTFO split)
Near-miss passage: T1218.015 Electron Applications. Tactics: stealth. Description: Adversaries may abuse components of the Electron framework to execute malicious code. The Electron framework hosts many common applications such as Signal, Slack, and Microsoft Teams.(Citation: Electron 2) Originally developed by GitHub, Electron is a cross-platform desktop application development framework that employs web technologies like JavaScript, HTML, and CSS.(Citation: Electron 3) The Chromium engine is used to display web content and Node.js runs the backend code.(Citation: Electron 1) Due to the functional mechanics of Electron (such as allowing apps to run arbitrary commands), adversaries may also be able to perform malicious functions in the background potentially disguised as legitimate tools within the framework.(Citation: Electron 1) For example, the abuse of `teams.exe` and `chrome.exe` may allow adversaries to execute malicious commands as child processes of the legitimate application (e.g., `chrome.exe --disable-gpu-sandbox --gpu-launcher="C:\Windows\system32\cmd.exe /c calc.exe`).(Citation: Electron 6-8) Adversaries may also execute malicious content by planting malicious [JavaScript](https://attack.mitre.org/techniques/T1059/007) within Electron applications.(Citation: Electron Security)
Query: explain T1132.002 Non-Standard Encoding
Matching passage: T1132.002 Non-Standard Encoding. Tactics: command and control. Description: Adversaries may encode data with a non-standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a non-standard data encoding system that diverges from existing protocol specifications. Non-standard data encoding schemes may be based on or related to standard data encoding schemes, such as a modified Base64 encoding for the message body of an HTTP request.(Citation: Wikipedia Binary-to-text Encoding)(Citation: Wikipedia Character Encoding)
Near-miss passage: T1132.001 Standard Encoding. Tactics: command and control. Description: Adversaries may encode data with a standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system that adheres to existing protocol specifications. Common data encoding schemes include ASCII, Unicode, hexadecimal, Base64, and MIME.(Citation: Wikipedia Binary-to-text Encoding)(Citation: Wikipedia Character Encoding) Some data encoding systems may also result in data compression, such as gzip.
Query: risk of Cross-site request forgery (CSRF) vulnerability on ZyXEL NBG-418N devices with firmware 1.00(AADZ.3)C0 allows remote attackers to hijack the authentication of arbitrary users.
Matching passage: CVE-2015-7284. CWE: CWE-352. CVSS: 8.0. Cross-site request forgery (CSRF) vulnerability on ZyXEL NBG-418N devices with firmware 1.00(AADZ.3)C0 allows remote attackers to hijack the authentication of arbitrary users.
Near-miss passage: CVE-2015-4252. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability on Cisco TelePresence ISDN Gateway devices with software 2.2(1.106) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu90724.
Query: vulnerability: OpenStack Cinder before 2014.1.5 (icehouse), 2014.2.x before 2014.2.4 (juno), and 2015.1.x before 2015.1.1 (kilo) allows remote authenticated users to read arbitrary files via a cr
Matching passage: CVE-2015-1851. CWE: CWE-200. CVSS: 6.800000190734863. OpenStack Cinder before 2014.1.5 (icehouse), 2014.2.x before 2014.2.4 (juno), and 2015.1.x before 2015.1.1 (kilo) allows remote authenticated users to read arbitrary files via a crafted qcow2 signature in an image to the upload-to-image command.
Near-miss passage: CVE-2015-5231. CWE: CWE-200. CVSS: 5.5. The service daemon in CRIU does not properly restrict access to non-dumpable processes, which allows local users to obtain sensitive information via (1) process dumps or (2) ptrace access.
Query: write Sigma for Detecting attempts to extract passwords with grep and laZagne
Matching passage: Sigma rule: Detecting attempts to extract passwords with grep and laZagne. Logsource: macos / process_creation. Rule: title: Credentials In Files id: 53b1b378-9b06-4992-b972-dde6e423d2b4 status: test description: Detecting attempts to extract passwords with grep and laZagne references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md author: Igor Fits, Mikhail Larin, oscd.community date: 2020-10-19 modified: 2021-11-27 tags: - attack.credential-access - attack.t1552.001 logsource: product: macos category: process_creation detection: selection1: Image|endswith: /grep CommandLine|contains: password selection2: CommandLine|contains: laZagne condition: 1 of selection* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious command line reg.exe tool adding key to RUN key in Registry. Logsource: windows / process_creation. Rule: title: Potential Persistence Attempt Via Run Keys Using Reg.EXE id: de587dce-915e-4218-aac4-835ca6af6f70 status: test description: Detects suspicious command line reg.exe tool adding key to RUN key in Registry references: - https://app.any.run/tasks/9c0f37bc-867a-4314-b685-e101566766d7/ - https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys - https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2021-06-28 modified: 2025-02-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: \reg.exe CommandLine|contains|all: - reg - ' add ' CommandLine|contains: - Software\Microsoft\Windows\CurrentVersion\Run - \Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run - \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run condition: selection falsepositives: - Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reasons. - Legitimate administrator sets up autorun keys for legitimate reasons. - Discord level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_reg_add_run_key/info.yml
Query: risk of Directory traversal vulnerability in osCommerce Japanese 2.2ms1j-R8 and earlier allows remote authenticated administrators to read arbitrary files via unspecified vectors.
Matching passage: CVE-2015-2965. CWE: CWE-22. CVSS: 4.0. Directory traversal vulnerability in osCommerce Japanese 2.2ms1j-R8 and earlier allows remote authenticated administrators to read arbitrary files via unspecified vectors.
Near-miss passage: CVE-2015-1195. CWE: CWE-22. CVSS: 6.5. The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a filesystem: URL in the image location property. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9493.
Query: secure coding against Non-Replicating Malicious Code
Matching passage: CWE-508 Non-Replicating Malicious Code. Non-replicating malicious code only resides on the target system or product that is attacked; it does not attempt to spread to other systems.
Near-miss passage: CWE-224 Obscured Security-relevant Information by Alternate Name. The product records security-relevant information according to an alternate name of the affected entity, instead of the canonical name.
Query: vulnerability: SQL injection vulnerability in search.php in NPDS Revolution 13 allows remote attackers to execute arbitrary SQL commands via the query parameter.
Matching passage: CVE-2015-1400. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in search.php in NPDS Revolution 13 allows remote attackers to execute arbitrary SQL commands via the query parameter.
Near-miss passage: CVE-2015-1560. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the isUserAdmin function in include/common/common-Func.php in Centreon (formerly Merethis Centreon) 2.5.4 and earlier (fixed in Centreon web 2.7.0) allows remote attackers to execute arbitrary SQL commands via the sid parameter to include/common/XmlTree/GetXmlTree.php.
Query: vulnerability: Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and A
Matching passage: CVE-2015-6691. CWE: CWE-416. CVSS: 10.0. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5586, CVE-2015-6683, CVE-2015-6684, CVE-2015-6687, CVE-2015-6688, CVE-2015-6689, CVE-2015-6690, CVE-2015-7615, CVE-2015-7617, and CVE-2015-7621.
Near-miss passage: CVE-2015-1720. CWE: CWE-416. CVSS: 7.199999809265137. Use-after-free vulnerability in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Microsoft Windows Kernel Use After Free Vulnerability."
Query: detect Detects the execution of "whoami.exe" by privileged accounts that are often abused by threat actors in logs
Matching passage: Sigma rule: Detects the execution of "whoami.exe" by privileged accounts that are often abused by threat actors. Logsource: windows / process_creation. Rule: title: Whoami.EXE Execution From Privileged Process id: 79ce34ca-af29-4d0e-b832-fc1b377020db related: - id: 80167ada-7a12-41ed-b8e9-aa47195c66a1 type: obsolete status: test description: Detects the execution of "whoami.exe" by privileged accounts that are often abused by threat actors references: - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment - https://web.archive.org/web/20221019044836/https://nsudo.m2team.org/en-us/ author: Florian Roth (Nextron Systems), Teymur Kheirkhabarov date: 2022-01-28 modified: 2023-12-04 tags: - attack.privilege-escalation - attack.discovery - attack.t1033 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: whoami.exe - Image|endswith: \whoami.exe selection_user: User|contains: - AUTHORI - AUTORI - TrustedInstaller condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale. Logsource: windows / security. Rule: title: Persistence and Execution at Scale via GPO Scheduled Task id: a8f29a7b-b137-4446-80a0-b804272f3da2 status: test description: Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale references: - https://twitter.com/menasec1/status/1106899890377052160 - https://www.secureworks.com/blog/ransomware-as-a-distraction - https://www.elastic.co/guide/en/security/7.17/prebuilt-rule-0-16-1-scheduled-task-execution-at-scale-via-gpo.html author: Samir Bousseaden date: 2019-04-03 modified: 2024-09-04 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.lateral-movement - attack.t1053.005 logsource: product: windows service: security definition: The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure detection: selection_5136: EventID: 5136 AttributeLDAPDisplayName: - gPCMachineExtensionNames - gPCUserExtensionNames AttributeValue|contains: - CAB54552-DEEA-4691-817E-ED4A4D1AFC72 - AADCED64-746C-4633-A97C-D61349046527 selection_5145: EventID: 5145 ShareName|endswith: \SYSVOL RelativeTargetName|endswith: ScheduledTasks.xml AccessList|contains: - WriteData - '%%4417' condition: 1 of selection_* falsepositives: - If the source IP is not localhost then it's super suspicious, better to monitor both local and remote changes to GPO scheduled tasks. level: high
Query: vulnerability: WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and appli
Matching passage: CVE-2015-7048. CWE: CWE-119. CVSS: 6.800000190734863. WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7095, CVE-2015-7096, CVE-2015-7097, CVE-2015-7098, CVE-2015-7099, CVE-2015-7100, CVE-2015-7101, CVE-2015-7102, and CVE-2015-7103.
Near-miss passage: CVE-2015-8365. CWE: CWE-119. CVSS: 6.800000190734863. The smka_decode_frame function in libavcodec/smacker.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 does not verify that the data size is consistent with the number of channels, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Smacker data.
Query: CVE similar to CVE-2015-0126
Matching passage: CVE-2015-0126. CWE: UNKNOWN. CVSS: 6.5. IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 allows remote authenticated users to bypass intended file-upload restrictions via a modified extension.
Near-miss passage: CVE-2015-7236. CWE: UNKNOWN. CVSS: 7.5. Use-after-free vulnerability in xprt_set_caller in rpcb_svc_com.c in rpcbind 0.2.1 and earlier allows remote attackers to cause a denial of service (daemon crash) via crafted packets, involving a PMAP_CALLIT code.
Query: weakness Missing Security-Relevant Feedback for Unexecuted Operations in Hardware Interface
Matching passage: CWE-1429 Missing Security-Relevant Feedback for Unexecuted Operations in Hardware Interface. The product has a hardware interface that silently discards operations in situations for which feedback would be security-relevant, such as the timely detection of failures or attacks.
Near-miss passage: CWE-1290 Incorrect Decoding of Security Identifiers. The product implements a decoding mechanism to decode certain bus-transaction signals to security identifiers. If the decoding is implemented incorrectly, then untrusted agents can now gain unauthorized access to the asset.
Query: playbook for alert: EDR alert: possible Account Access Removal (T1531)
Matching passage: Playbook for T1531 Account Access Removal. 1) Validate alert telemetry against T1531. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: impact. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials, revoked permissions for SaaS platforms such as Sharepoint) to remove access to accounts.(Citation: Obsidian Security SaaS Ransomware June 2023) Adversaries may also subsequently log off and/or
Near-miss passage: Playbook for T1529 System Shutdown/Reboot. Different response path focused on impact.
Query: patch priority for CVE-2015-3902
Matching passage: CVE-2015-3902. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the setup process in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x before 4.3.13.1, and 4.4.x before 4.4.6.1 allow remote attackers to hijack the authentication of administrators for requests that modify the configuration file.
Near-miss passage: CVE-2015-6493. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x through 2.6.0 build 430 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.
Query: CVE similar to CVE-2015-0623
Matching passage: CVE-2015-0623. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Administrator report page on Cisco Web Security Appliance (WSA) devices allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCus40627.
Near-miss passage: CVE-2015-5953. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the activity application in ownCloud Server before 7.0.5 and 8.0.x before 8.0.4 allows remote authenticated users to inject arbitrary web script or HTML via a " (double quote) character in a filename in a shared folder.
Query: CVE similar to CVE-2015-6617
Matching passage: CVE-2015-6617. CWE: CWE-119. CVSS: 9.300000190734863. Skia, as used in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23648740.
Near-miss passage: CVE-2015-3868. CWE: CWE-119. CVSS: 10.0. libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23270724.