alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Detects when Okta FastPass prevents a known phishing site.
Matching passage: Sigma rule: Detects when Okta FastPass prevents a known phishing site.. Logsource: okta / okta. Rule: title: Okta FastPass Phishing Detection id: ee39a9f7-5a79-4b0a-9815-d36b3cf28d3e status: test description: Detects when Okta FastPass prevents a known phishing site. references: - https://sec.okta.com/fastpassphishingdetection - https://developer.okta.com/docs/reference/api/system-log/ - https://developer.okta.com/docs/reference/api/event-types/ author: Austin Songer @austinsonger date: 2023-05-07 modified: 2026-04-27 tags: - attack.initial-access - attack.t1566 logsource: product: okta service: okta detection: selection: outcome.reason: FastPass declined phishing attempt outcome.result: FAILURE eventType: user.authentication.auth_via_mfa condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects execution of binaries located in potentially suspicious locations via "nohup". Logsource: linux / process_creation. Rule: title: Suspicious Nohup Execution id: 457df417-8b9d-4912-85f3-9dbda39c3645 related: - id: e4ffe466-6ff8-48d4-94bd-e32d1a6061e2 type: derived status: test description: Detects execution of binaries located in potentially suspicious locations via "nohup" references: - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/ - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-06-02 tags: - attack.execution logsource: product: linux category: process_creation detection: selection: Image|endswith: /nohup CommandLine|contains: /tmp/ condition: selection falsepositives: - Unknown level: high
Query: risk of Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 4.0.32, 4.1.40, 4.2.32, and 4.3.30 allows local users to affect confide
Matching passage: CVE-2015-2594. CWE: UNKNOWN. CVSS: 6.599999904632568. Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 4.0.32, 4.1.40, 4.2.32, and 4.3.30 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core.
Near-miss passage: CVE-2015-0320. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0313, CVE-2015-0315, and CVE-2015-0322.
Query: patch priority for CVE-2015-1126
Matching passage: CVE-2015-1126. CWE: CWE-20. CVSS: 4.300000190734863. WebKit, as used in Apple iOS before 8.3 and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, does not properly handle the userinfo field in FTP URLs, which allows remote attackers to trigger incorrect resource access via unspecified vectors.
Near-miss passage: CVE-2015-6259. CWE: CWE-20. CVSS: 9.399999618530273. The JavaServer Pages (JSP) component in Cisco Integrated Management Controller (IMC) Supervisor before 1.0.0.1 and UCS Director (formerly Cloupia Unified Infrastructure Controller) before 5.2.0.1 allows remote attackers to write to arbitrary files via crafted HTTP requests, aka Bug IDs CSCus36435 and CSCus62625.
Query: risk of Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, 
Matching passage: CVE-2015-7625. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-7626, CVE-2015-7627, CVE-2015-7630, CVE-2015-7633, and CVE-2015-7634.
Near-miss passage: CVE-2015-8407. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8457.
Query: vulnerability: WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and appli
Matching passage: CVE-2015-7097. CWE: CWE-119. CVSS: 6.800000190734863. WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7095, CVE-2015-7096, CVE-2015-7098, CVE-2015-7099, CVE-2015-7100, CVE-2015-7101, CVE-2015-7102, and CVE-2015-7103.
Near-miss passage: CVE-2015-6979. CWE: CWE-119. CVSS: 9.300000190734863. GasGauge in Apple iOS before 9.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Query: risk of GNU patch 2.7.1 allows remote attackers to write to arbitrary files via a symlink attack in a patch file.
Matching passage: CVE-2015-1196. CWE: CWE-59. CVSS: 4.300000190734863. GNU patch 2.7.1 allows remote attackers to write to arbitrary files via a symlink attack in a patch file.
Near-miss passage: CVE-2015-1869. CWE: CWE-59. CVSS: 7.800000190734863. The default event handling scripts in Automatic Bug Reporting Tool (ABRT) allow local users to gain privileges as demonstrated by a symlink attack on a var_log_messages file.
Query: vulnerability: Cross-site request forgery (CSRF) vulnerability in Cisco Unified Intelligence Center 10.6(1) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSC
Matching passage: CVE-2015-0740. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Cisco Unified Intelligence Center 10.6(1) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCus28826.
Near-miss passage: CVE-2015-6655. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Pligg CMS 2.0.2 allows remote attackers to hijack the authentication of administrators for requests that add an administrator via a request to admin/admin_users.php.
Query: weakness Inclusion of Undocumented Features or Chicken Bits
Matching passage: CWE-1242 Inclusion of Undocumented Features or Chicken Bits. The device includes chicken bits or undocumented features that can create entry points for unauthorized actors.
Near-miss passage: CWE-455 Non-exit on Failed Initialization. The product does not exit or otherwise modify its operation when security-relevant errors occur during initialization, such as when a configuration file has a format error or a hardware security module (HSM) cannot be activated, which can cause the product to execute in a less secure fashion than intended by the administrator.
Query: CWE for Access of Resource Using Incompatible Type ('Type Confusion')
Matching passage: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion'). The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
Near-miss passage: CWE-1326 Missing Immutable Root of Trust in Hardware. A missing immutable root of trust in the hardware results in the ability to bypass secure boot or execute untrusted or adversarial boot code.
Query: alert when Detects PowerShell download activity, via the .DownloadFile() or .DownloadString() methods of the Net.WebClient class. T
Matching passage: Sigma rule: Detects PowerShell download activity, via the .DownloadFile() or .DownloadString() methods of the Net.WebClient class. T. Logsource: windows / ps_classic_start. Rule: title: PowerShell Download Via Net.WebClient - PowerShell Classic id: 3236fcd0-b7e3-4433-b4f8-86ad61a9af2d related: - id: 65531a81-a694-4e31-ae04-f8ba5bc33759 type: derived status: test description: 'Detects PowerShell download activity, via the .DownloadFile() or .DownloadString() methods of the Net.WebClient class. This technique is often abused by attackers to download additional payloads. ' references: - https://www.trendmicro.com/en_us/research/22/j/lv-ransomware-exploits-proxyshell-in-attack.html author: Florian Roth (Nextron Systems) date: 2017-03-05 modified: 2026-04-28 tags: - attack.execution - attack.command-and-control - attack.t1059.001 - attack.t1105 logsource: product: windows category: ps_classic_start detection: selection_webclient: Data|contains: Net.WebClient selection_download: Data|contains: - .DownloadFile( - .DownloadString( condition: all of selection_* falsepositives: - This activity may be used by legitimate software, such as patch management tools or software updaters. Investigate any such activity and apply the necessary filter. level: low
Near-miss passage: Sigma rule: Detects potential malicious modification of run keys by winekey or team9 backdoor. Logsource: windows / registry_event. Rule: title: WINEKEY Registry Modification id: b98968aa-dbc0-4a9c-ac35-108363cbf8d5 status: test description: Detects potential malicious modification of run keys by winekey or team9 backdoor references: - https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html author: omkar72 date: 2020-10-30 modified: 2021-11-27 tags: - attack.privilege-escalation - attack.persistence - attack.t1547 logsource: category: registry_event product: windows detection: selection: TargetObject|endswith: Software\Microsoft\Windows\CurrentVersion\Run\Backup Mgr condition: selection falsepositives: - Unknown level: high
Query: write Sigma for Detects the execution of some potentially unwanted tools such as PsExec, Procdump, etc. (part of the Sysinternals suite)
Matching passage: Sigma rule: Detects the execution of some potentially unwanted tools such as PsExec, Procdump, etc. (part of the Sysinternals suite). Logsource: windows / registry_set. Rule: title: PUA - Sysinternals Tools Execution - Registry id: c7da8edc-49ae-45a2-9e61-9fd860e4e73d related: - id: 25ffa65d-76d8-4da5-a832-3f2b0136e133 type: derived - id: 9841b233-8df8-4ad7-9133-b0b4402a9014 type: obsolete status: test description: Detects the execution of some potentially unwanted tools such as PsExec, Procdump, etc. (part of the Sysinternals suite) via the creation of the "accepteula" registry key. references: - https://twitter.com/Moti_B/status/1008587936735035392 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-24 modified: 2025-10-26 tags: - attack.resource-development - attack.t1588.002 logsource: product: windows category: registry_set detection: selection: TargetObject|contains: - \Active Directory Explorer - \Handle - \LiveKd - \Process Explorer - \ProcDump - \PsExec - \PsLoglist - \PsPasswd - \SDelete - \Sysinternals TargetObject|endswith: \EulaAccepted condition: selection falsepositives: - Legitimate use of SysInternals tools. Filter the legitimate paths used in your environment level: medium regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_pua_sysinternals_susp_execution_via_eula/info.yml
Near-miss passage: Sigma rule: Detects potential abuse of the "manage-bde.wsf" script as a LOLBIN to proxy execution. Logsource: windows / process_creation. Rule: title: Potential Manage-bde.wsf Abuse To Proxy Execution id: c363385c-f75d-4753-a108-c1a8e28bdbda status: test description: Detects potential abuse of the "manage-bde.wsf" script as a LOLBIN to proxy execution references: - https://lolbas-project.github.io/lolbas/Scripts/Manage-bde/ - https://gist.github.com/bohops/735edb7494fe1bd1010d67823842b712 - https://twitter.com/bohops/status/980659399495741441 - https://twitter.com/JohnLaTwC/status/1223292479270600706 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1216/T1216.md author: oscd.community, Natalia Shornikova, Nasreddine Bencherchali (Nextron Systems) date: 2020-10-13 modified: 2023-02-03 tags: - attack.stealth - attack.t1216 logsource: category: process_creation product: windows detection: selection_wscript_img: - Image|endswith: \wscript.exe - OriginalFileName: wscript.exe selection_wscript_cli: CommandLine|contains: manage-bde.wsf selection_parent: ParentImage|endswith: - \cscript.exe - \wscript.exe ParentCommandLine|contains: manage-bde.wsf selection_filter_cmd: Image|endswith: \cmd.exe condition: all of selection_wscript_* or (selection_parent and not selection_filter_cmd) falsepositives: - Unlikely level: high
Query: exploit The kernel in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to gain privileges via a crafted application, aka internal bug 23520714.
Matching passage: CVE-2015-6619. CWE: CWE-264. CVSS: 9.300000190734863. The kernel in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to gain privileges via a crafted application, aka internal bug 23520714.
Near-miss passage: CVE-2015-4351. CWE: CWE-264. CVSS: 4.900000095367432. The Spider Video Player module for Drupal allows remote authenticated users with the "access Spider Video Player administration" permission to delete arbitrary files via a crafted URL.
Query: rule covering Dependabot performs a scan to detect insecure dependencies, and sends Dependabot alerts. This rule detects when an organ
Matching passage: Sigma rule: Dependabot performs a scan to detect insecure dependencies, and sends Dependabot alerts. This rule detects when an organ. Logsource: github / audit. Rule: title: Outdated Dependency Or Vulnerability Alert Disabled id: 34e1c7d4-0cd5-419d-9f1b-1dad3f61018d status: test description: 'Dependabot performs a scan to detect insecure dependencies, and sends Dependabot alerts. This rule detects when an organization owner disables Dependabot alerts private repositories or Dependabot security updates for all repositories. ' author: Muhammad Faisal (@faisalusuf) date: 2023-01-27 references: - https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization tags: - attack.initial-access - attack.t1195.001 logsource: product: github service: audit definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming' detection: selection: action: - dependabot_alerts_new_repos.disable - dependabot_alerts.disable - dependabot_security_updates_new_repos.disable - dependabot_security_updates.disable - repository_vulnerability_alerts.disable condition: selection falsepositives: - Approved changes by the Organization owner. Please validate the 'actor' if authorized to make the changes. level: high
Near-miss passage: Sigma rule: Detects files that have extensions commonly seen while SDelete is used to wipe files.. Logsource: windows / security. Rule: title: Potential Secure Deletion with SDelete id: 39a80702-d7ca-4a83-b776-525b1f86a36d status: test description: Detects files that have extensions commonly seen while SDelete is used to wipe files. references: - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/sdelete.htm - https://www.jpcert.or.jp/english/pub/sr/ir_research.html - https://learn.microsoft.com/en-gb/sysinternals/downloads/sdelete author: Thomas Patzke date: 2017-06-14 modified: 2024-12-13 tags: - attack.impact - attack.stealth - attack.defense-impairment - attack.t1070.004 - attack.t1027.005 - attack.t1485 - attack.t1553.002 - attack.s0195 logsource: product: windows service: security detection: selection: EventID: - 4656 - 4663 - 4658 ObjectName|endswith: - .AAA - .ZZZ condition: selection falsepositives: - Legitimate usage of SDelete - Files that are interacted with that have these extensions legitimately level: medium
Query: CWE for Embedded Malicious Code
Matching passage: CWE-506 Embedded Malicious Code. The product contains code that appears to be malicious in nature.
Near-miss passage: CWE-326 Inadequate Encryption Strength. The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
Query: Sigma rule for Detects the execution of EDRSilencer, a tool that leverages Windows Filtering Platform (WFP) to block Endpoint Detection
Matching passage: Sigma rule: Detects the execution of EDRSilencer, a tool that leverages Windows Filtering Platform (WFP) to block Endpoint Detection. Logsource: windows / process_creation. Rule: title: HackTool - EDRSilencer Execution id: eb2d07d4-49cb-4523-801a-da002df36602 status: test description: 'Detects the execution of EDRSilencer, a tool that leverages Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server based on PE metadata information. ' references: - https://github.com/netero1010/EDRSilencer author: '@gott_cyber' date: 2024-01-02 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \EDRSilencer.exe - OriginalFileName: EDRSilencer.exe - Description|contains: EDRSilencer condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects changes to "DsrmAdminLogonBehavior" registry value. During a Domain Controller (DC) promotion, administrators cr. Logsource: windows / registry_set. Rule: title: Directory Service Restore Mode(DSRM) Registry Value Tampering id: b61e87c0-50db-4b2e-8986-6a2be94b33b0 related: - id: 53ad8e36-f573-46bf-97e4-15ba5bf4bb51 type: similar status: test description: 'Detects changes to "DsrmAdminLogonBehavior" registry value. During a Domain Controller (DC) promotion, administrators create a Directory Services Restore Mode (DSRM) local administrator account with a password that rarely changes. The DSRM account is an “Administrator” account that logs in with the DSRM mode when the server is booting up to restore AD backups or recover the server from a failure. Attackers could abuse DSRM account to maintain their persistence and access to the organization''s Active Directory. If the "DsrmAdminLogonBehavior" value is set to "0", the administrator account can only be used if the DC starts in DSRM. If the "DsrmAdminLogonBehavior" value is set to "1", the administrator account can only be used if the local AD DS service is stopped. If the "DsrmAdminLogonBehavior" value is set to "2", the administrator account can always be used. ' references: - https://adsecurity.org/?p=1785 - https://www.sentinelone.com/blog/detecting-dsrm-account-misconfigurations/ - https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/dsrm-credentials author: Nischal Khadgi date: 2024-07-11 tags: - attack.credential-access - attack.persistence - attack.defense-impairment - attack.t1556 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Control\Lsa\DsrmAdminLogonBehavior filter_main_default_value: Details: DWORD (0x00000000) condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-8844
Matching passage: CVE-2015-8844. CWE: CWE-20. CVSS: 5.5. The signal implementation in the Linux kernel before 4.3.5 on powerpc platforms does not check for an MSR with both the S and T bits set, which allows local users to cause a denial of service (TM Bad Thing exception and panic) via a crafted application.
Near-miss passage: CVE-2015-7893. CWE: CWE-20. CVSS: 8.800000190734863. SecEmailUI in Samsung Galaxy S6 does not sanitize HTML email content, allows remote attackers to execute arbitrary JavaScript.
Query: risk of Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Mem
Matching passage: CVE-2015-1665. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1659 and CVE-2015-1662.
Near-miss passage: CVE-2015-6326. CWE: CWE-399. CVSS: 7.800000190734863. Cisco Adaptive Security Appliance (ASA) software 7.2 and 8.2 before 8.2(5.58), 8.3 and 8.4 before 8.4(7.29), 8.5 through 8.7 before 8.7(1.17), 9.0 before 9.0(4.37), 9.1 before 9.1(6.6), 9.2 before 9.2(4), 9.3 before 9.3(3.5), and 9.4 before 9.4(1.5) allows remote attackers to cause a denial of service (device reload) via a crafted DNS response, aka Bug ID CSCuu07799.