alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Detects the execution of a renamed MegaSync.exe as seen used by ransomware families like Nefilim, Sodinokibi, Pysa, and
Matching passage: Sigma rule: Detects the execution of a renamed MegaSync.exe as seen used by ransomware families like Nefilim, Sodinokibi, Pysa, and. Logsource: windows / process_creation. Rule: title: Renamed MegaSync Execution id: 643bdcac-8b82-49f4-9fd9-25a90b929f3b status: test description: Detects the execution of a renamed MegaSync.exe as seen used by ransomware families like Nefilim, Sodinokibi, Pysa, and Conti. references: - https://redcanary.com/blog/rclone-mega-extortion/ author: Sittikorn S date: 2021-06-22 modified: 2023-02-03 tags: - attack.stealth - attack.t1218 logsource: product: windows category: process_creation detection: selection: OriginalFileName: megasync.exe filter: Image|endswith: \megasync.exe condition: selection and not filter falsepositives: - Software that illegally integrates MegaSync in a renamed form - Administrators that have renamed MegaSync level: high
Near-miss passage: Sigma rule: Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken model safety controls and allow un. Logsource: aws / cloudtrail. Rule: title: AWS Bedrock Guardrail Updated id: 1c722651-254a-4b04-a9f4-99b62a2d0a1f status: experimental description: 'Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken model safety controls and allow unsafe or unauthorized model responses. ' references: - https://docs.aws.amazon.com/bedrock/latest/APIReference/API_UpdateGuardrail.html author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) date: 2026-07-10 tags: - attack.defense-impairment - attack.t1685 logsource: product: aws service: cloudtrail detection: selection: eventName: UpdateGuardrail eventSource: bedrock.amazonaws.com condition: selection falsepositives: - Legitimate guardrail updates by authorized identities. level: medium
Query: detect Detects when an the Administrator role is assigned to an user or group. in logs
Matching passage: Sigma rule: Detects when an the Administrator role is assigned to an user or group.. Logsource: okta / okta. Rule: title: Okta Admin Role Assigned to an User or Group id: 413d4a81-6c98-4479-9863-014785fd579c status: test description: Detects when an the Administrator role is assigned to an user or group. references: - https://developer.okta.com/docs/reference/api/system-log/ - https://developer.okta.com/docs/reference/api/event-types/ author: Austin Songer @austinsonger date: 2021-09-12 modified: 2026-04-27 tags: - attack.privilege-escalation - attack.persistence - attack.t1098.003 logsource: product: okta service: okta detection: selection: eventType: - group.privilege.grant - user.account.privilege.grant condition: selection falsepositives: - Administrator roles could be assigned to users or group by other admin users. level: medium
Near-miss passage: Sigma rule: Potential threat actor tampering with Sysmon manifest and eventually disabling it. Logsource: windows / security. Rule: title: Sysmon Channel Reference Deletion id: 18beca67-ab3e-4ee3-ba7a-a46ca8d7d0cc status: test description: Potential threat actor tampering with Sysmon manifest and eventually disabling it references: - https://twitter.com/Flangvik/status/1283054508084473861 - https://twitter.com/SecurityJosh/status/1283027365770276866 - https://securityjosh.github.io/2020/04/23/Mute-Sysmon.html - https://gist.github.com/Cyb3rWard0g/cf08c38c61f7e46e8404b38201ca01c8 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-07-14 modified: 2025-10-22 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows service: security detection: selection1: EventID: 4657 ObjectName|contains: - WINEVT\Publishers\{5770385f-c22a-43e0-bf4c-06f5698ffbd9} - WINEVT\Channels\Microsoft-Windows-Sysmon/Operational ObjectValueName: Enabled NewValue: 0 selection2: EventID: 4663 ObjectName|contains: - WINEVT\Publishers\{5770385f-c22a-43e0-bf4c-06f5698ffbd9} - WINEVT\Channels\Microsoft-Windows-Sysmon/Operational AccessMask: '0x10000' condition: 1 of selection* falsepositives: - Unknown level: high
Query: vulnerability: Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel for Mac 2011, Excel 2016 for Mac, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code v
Matching passage: CVE-2015-6040. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel for Mac 2011, Excel 2016 for Mac, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-7096. CWE: CWE-119. CVSS: 6.800000190734863. WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7095, CVE-2015-7097, CVE-2015-7098, CVE-2015-7099, CVE-2015-7100, CVE-2015-7101, CVE-2015-7102, and CVE-2015-7103.
Query: risk of Quassel before 0.12.2 does not properly re-initialize the database session when the PostgreSQL database is restarted, which allows remote attackers to conduct SQL injection attacks
Matching passage: CVE-2015-3427. CWE: CWE-89. CVSS: 7.5. Quassel before 0.12.2 does not properly re-initialize the database session when the PostgreSQL database is restarted, which allows remote attackers to conduct SQL injection attacks via a \ (backslash) in a message. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4422.
Near-miss passage: CVE-2015-1477. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the CMSJunkie J-ClassifiedsManager component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a viewad task to classifieds/offerring-ads.
Query: exploit The Apple iWork application before 2.6 for iOS, Apple Keynote before 6.6, Apple Pages before 5.6, and Apple Numbers before 3.6 allow remote attackers to obtain sensitive informatio
Matching passage: CVE-2015-7032. CWE: CWE-200. CVSS: 4.300000190734863. The Apple iWork application before 2.6 for iOS, Apple Keynote before 6.6, Apple Pages before 5.6, and Apple Numbers before 3.6 allow remote attackers to obtain sensitive information via a crafted document.
Near-miss passage: CVE-2015-5016. CWE: CWE-200. CVSS: 4.300000190734863. IBM Maximo Asset Management 7.1, 7.5, and 7.6; Maximo Asset Management Essentials 7.1 and 7.5; Control Desk 7.5 and 7.6; Tivoli Asset Management for IT 7.1 and 7.2; and certain other IBM products allow remote authenticated users to bypass intended access restrictions and read arbitrary ticket worklog entries via unspecified vectors. IBM X-Force ID: 106460.
Query: risk of IOAcceleratorFamily in Apple OS X before 10.10.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted a
Matching passage: CVE-2015-3705. CWE: CWE-119. CVSS: 9.300000190734863. IOAcceleratorFamily in Apple OS X before 10.10.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2015-3706.
Near-miss passage: CVE-2015-5133. CWE: CWE-119. CVSS: 10.0. Buffer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5131 and CVE-2015-5132.
Query: describe CVE-2015-1661
Matching passage: CVE-2015-1661. CWE: CWE-264. CVSS: 4.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability."
Near-miss passage: CVE-2015-4505. CWE: CWE-264. CVSS: 6.599999904632568. updater.exe in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 on Windows allows local users to write to arbitrary files by conducting a junction attack and waiting for an update operation by the Mozilla Maintenance Service.
Query: alert when Detects the modification of the findings on SecurityHub.
Matching passage: Sigma rule: Detects the modification of the findings on SecurityHub.. Logsource: aws / cloudtrail. Rule: title: AWS SecurityHub Findings Evasion id: a607e1fe-74bf-4440-a3ec-b059b9103157 status: stable description: Detects the modification of the findings on SecurityHub. references: - https://docs.aws.amazon.com/cli/latest/reference/securityhub/ author: Sittikorn S date: 2021-06-28 tags: - attack.defense-impairment - attack.t1685 logsource: product: aws service: cloudtrail detection: selection: eventSource: securityhub.amazonaws.com eventName: - BatchUpdateFindings - DeleteInsight - UpdateFindings - UpdateInsight condition: selection falsepositives: - System or Network administrator behaviors - DEV, UAT, SAT environment. You should apply this rule with PROD environment only. level: high
Near-miss passage: Sigma rule: Detects suspicious DACL modifications via the "Set-Service" cmdlet using the "SecurityDescriptorSddl" flag (Only availab. Logsource: windows / process_creation. Rule: title: Suspicious Service DACL Modification Via Set-Service Cmdlet id: a95b9b42-1308-4735-a1af-abb1c5e6f5ac related: - id: 99cf1e02-00fb-4c0d-8375-563f978dfd37 type: derived status: test description: Detects suspicious DACL modifications via the "Set-Service" cmdlet using the "SecurityDescriptorSddl" flag (Only available with PowerShell 7) that can be used to hide services or make them unstopable references: - https://www.sans.org/blog/red-team-tactics-hiding-windows-services/ - https://learn.microsoft.com/pt-br/windows/win32/secauthz/sid-strings author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-18 tags: - attack.privilege-escalation - attack.persistence - attack.t1543.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \pwsh.exe - OriginalFileName: pwsh.dll selection_sddl_flag: CommandLine|contains: - '-SecurityDescriptorSddl ' - '-sd ' selection_set_service: CommandLine|contains|all: - 'Set-Service ' - D;; CommandLine|contains: - ;;;IU - ;;;SU - ;;;BA - ;;;SY - ;;;WD condition: all of selection_* falsepositives: - Unknown level: high
Query: CWE for Improper Neutralization of Whitespace
Matching passage: CWE-156 Improper Neutralization of Whitespace. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as whitespace when they are sent to a downstream component.
Near-miss passage: CWE-343 Predictable Value Range from Previous Values. The product's random number generator produces a series of values which, when observed, can be used to infer a relatively small range of possibilities for the next value that could be generated.
Query: describe CVE-2015-4704
Matching passage: CVE-2015-4704. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in the Download Zip Attachments plugin 1.0 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the File parameter to download.php.
Near-miss passage: CVE-2015-4181. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in get_file.php in phpMyBackupPro 2.1 through 2.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: this vulnerability exists due to an incomplete fix to CVE-2015-4180.
Query: intelligence brief on T1027.002
Matching passage: T1027.002 Software Packing. Tactics: stealth. Description: Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.(Citation: ESET FinFisher Jan 2018) Utilities used to perform software packing are called packers. Example packers are MPRESS and UPX. A more comprehensive list of known packers is available, but adversaries may create their own packing techniques that do not leave the same artifacts as well-known packers to evade defenses.(Citation: Awesome Executable Packing)
Near-miss passage: T1027.004 Compile After Delivery. Tactics: stealth. Description: Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as ilasm.exe(Citation: ATTACK IQ), csc.exe, or GCC/MinGW.(Citation: ClearSky MuddyWater Nov 2018) Source code payloads may also be encrypted, encoded, and/or embedded within other files, such as those delivered as a [Phishing](https://attack.mitre.org/techniques/T1566). Payloads may also be delivered in formats unrecognizable and inherently benign to the native OS (ex: EXEs on macOS/Linux) before later being (re)compiled into a proper executable binary with a bundled compiler and execution framework.(Citation: TrendMicro WindowsAppMac)
Query: campaign using Systemctl
Matching passage: T1569.003 Systemctl. Tactics: execution. Description: Adversaries may abuse systemctl to execute commands or programs. Systemctl is the primary interface for systemd, the Linux init system and service manager. Typically invoked from a shell, Systemctl can also be integrated into scripts or applications. Adversaries may use systemctl to execute commands or programs as [Systemd Service](https://attack.mitre.org/techniques/T1543/002)s. Common subcommands include: `systemctl start`, `systemctl stop`, `systemctl enable`, `systemctl disable`, and `systemctl status`.(Citation: Red Hat Systemctl 2022)
Near-miss passage: T1569 System Services. Tactics: execution. Description: Adversaries may abuse system services or daemons to execute commands or programs. Adversaries can execute malicious content by interacting with or creating services either locally or remotely. Many services are set to run at boot, which can aid in achieving persistence ([Create or Modify System Process](https://attack.mitre.org/techniques/T1543)), but adversaries can also abuse services for one-time or temporary execution.
Query: patch priority for CVE-2015-9113
Matching passage: CVE-2015-9113. CWE: CWE-476. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 810, SD 820, and SD 820A, untrusted pointer dereference in QSEE Syscall without proper validation can lead to access of blacklisted memory.
Near-miss passage: CVE-2015-7068. CWE: CWE-476. CVSS: 7.800000190734863. IOKit SCSI in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via an app that provides an unspecified userclient type.
Query: exploit IBM WebSphere MQ 8.0.0.4 on IBM i platforms allows local users to discover cleartext certificate-keystore passwords within MQ trace output by leveraging administrator privileges to
Matching passage: CVE-2015-7462. CWE: CWE-200. CVSS: 4.400000095367432. IBM WebSphere MQ 8.0.0.4 on IBM i platforms allows local users to discover cleartext certificate-keystore passwords within MQ trace output by leveraging administrator privileges to execute the mqcertck program.
Near-miss passage: CVE-2015-5041. CWE: CWE-200. CVSS: 9.100000381469727. The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20, 7 before SR9 FP30, and 7 R1 before SR3 FP30 allows remote attackers to obtain sensitive information or inject data by invoking non-public interface methods.
Query: write Sigma for Detects a potentially suspicious empty user agent strings in proxy log. Could potentially indicate an uncommon request m
Matching passage: Sigma rule: Detects a potentially suspicious empty user agent strings in proxy log. Could potentially indicate an uncommon request m. Logsource: proxy. Rule: title: HTTP Request With Empty User Agent id: 21e44d78-95e7-421b-a464-ffd8395659c4 status: test description: 'Detects a potentially suspicious empty user agent strings in proxy log. Could potentially indicate an uncommon request method. ' references: - https://twitter.com/Carlos_Perez/status/883455096645931008 author: Florian Roth (Nextron Systems) date: 2017-07-08 modified: 2021-11-27 tags: - attack.command-and-control - attack.t1071.001 logsource: category: proxy detection: selection: c-useragent: '' condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of the "esxcli" command with the "system" flag in order to retrieve information about the different co. Logsource: linux / process_creation. Rule: title: ESXi System Information Discovery Via ESXCLI id: e80273e1-9faf-40bc-bd85-dbaff104c4e9 status: test description: Detects execution of the "esxcli" command with the "system" flag in order to retrieve information about the different component of the system. Such as accounts, modules, NTP, etc. references: - https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/ - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html author: Cedric Maurugeon date: 2023-09-04 tags: - attack.discovery - attack.execution - attack.t1033 - attack.t1007 - attack.t1059.012 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: /esxcli CommandLine|contains: system selection_cli: CommandLine|contains: - ' get' - ' list' condition: all of selection_* falsepositives: - Legitimate administration activities level: medium
Query: rule covering Detects suspicious child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execu
Matching passage: Sigma rule: Detects suspicious child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execu. Logsource: windows / process_creation. Rule: title: Suspicious Child Process Of BgInfo.EXE id: 811f459f-9231-45d4-959a-0266c6311987 related: - id: aaf46cdc-934e-4284-b329-34aa701e3771 type: similar status: test description: Detects suspicious child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Bginfo/ - https://oddvar.moe/2017/05/18/bypassing-application-whitelisting-with-bginfo/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-16 tags: - attack.execution - attack.stealth - attack.t1059.005 - attack.t1218 - attack.t1202 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \bginfo.exe - \bginfo64.exe selection_child: - Image|endswith: - \calc.exe - \cmd.exe - \cscript.exe - \mshta.exe - \notepad.exe - \powershell.exe - \pwsh.exe - \wscript.exe - Image|contains: - \AppData\Local\ - \AppData\Roaming\ - :\Users\Public\ - :\Temp\ - :\Windows\Temp\ - :\PerfLogs\ condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension. Logsource: windows / process_creation. Rule: title: Cscript/Wscript Uncommon Script Extension Execution id: 99b7460d-c9f1-40d7-a316-1f36f61d52ee status: test description: Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-15 modified: 2023-06-19 tags: - attack.execution - attack.t1059.005 - attack.t1059.007 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: - wscript.exe - cscript.exe - Image|endswith: - \wscript.exe - \cscript.exe selection_extension: CommandLine|contains: - .csv - .dat - .doc - .gif - .jpeg - .jpg - .png - .ppt - .txt - .xls - .xml condition: all of selection_* falsepositives: - Unknown level: high
Query: describe CVE-2015-7907
Matching passage: CVE-2015-7907. CWE: CWE-22. CVSS: 8.600000381469727. Directory traversal vulnerability in the web server on Honeywell Midas gas detectors before 1.13b3 and Midas Black gas detectors before 2.13b3 allows remote attackers to bypass authentication, and write to a configuration file or trigger a calibration or test, via unspecified vectors.
Near-miss passage: CVE-2015-3309. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.2 through 1.5.4 allows remote attackers to read arbitrary files with permissions of the user running the service via a .. (dot dot) in the path parameter of HTTP API requests. NOTE: This vulnerability is due to an incomplete fix to CVE-2015-3297.
Query: exploit Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability 
Matching passage: CVE-2015-4733. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI.
Near-miss passage: CVE-2015-0319. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-0317.
Query: threat report mentioning Outlook Forms
Matching passage: T1137.003 Outlook Forms. Tactics: persistence. Description: Adversaries may abuse Microsoft Outlook forms to obtain persistence on a compromised system. Outlook forms are used as templates for presentation and functionality in Outlook messages. Custom Outlook forms can be created that will execute code when a specifically crafted email is sent by an adversary utilizing the same custom Outlook form.(Citation: SensePost Outlook Forms) Once malicious forms have been added to the user’s mailbox, they will be loaded when Outlook is started. Malicious forms will execute when an adversary sends a specifically crafted email to the user.(Citation: SensePost Outlook Forms)
Near-miss passage: T1137 Office Application Startup. Tactics: persistence. Description: Adversaries may leverage Microsoft Office-based applications for persistence between startups. Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins. A variety of features have been discovered in Outlook that can be abused to obtain persistence, such as Outlook rules, forms, and Home Page.(Citation: SensePost Ruler GitHub) These persistence mechanisms can work within Outlook or be used through Office 365.(Citation: TechNet O365 Outlook Rules)