alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Bypasses User Account Control using a fileless method in logs
Matching passage: Sigma rule: Bypasses User Account Control using a fileless method. Logsource: windows / registry_set. Rule: title: Bypass UAC Using DelegateExecute id: 46dd5308-4572-4d12-aa43-8938f0184d4f status: test description: Bypasses User Account Control using a fileless method references: - https://learn.microsoft.com/en-us/windows/win32/api/shobjidl_core/nn-shobjidl_core-iexecutecommand - https://devblogs.microsoft.com/oldnewthing/20100312-01/?p=14623 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md#atomic-test-7---bypass-uac-using-sdclt-delegateexecute author: frack113 date: 2022-01-05 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \open\command\DelegateExecute Details: (Empty) condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_bypass_uac_using_delegateexecute/info.yml simulation: - type: atomic-red-team name: Bypass UAC using sdclt DelegateExecute technique: T1548.002 atomic_guid: 3be891eb-4608-4173-87e8-78b494c029b7
Near-miss passage: Sigma rule: Detects access to Signal Desktop's sensitive data files: db.sqlite and config.json. The db.sqlite file in Signal Desktop. Logsource: windows / security. Rule: title: File Access Of Signal Desktop Sensitive Data id: 5d6c375a-18ae-4952-b4f6-8b803f6c8555 status: experimental description: 'Detects access to Signal Desktop''s sensitive data files: db.sqlite and config.json. The db.sqlite file in Signal Desktop stores all locally saved messages in an encrypted SQLite database, while the config.json contains the decryption key needed to access that data. Since the key is stored in plain text, a threat actor who gains access to both files can decrypt and read sensitive messages without needing the users credentials. Currently the rule only covers the default Signal installation path in AppData\Roaming. Signal Portable installations may use different paths based on user configuration. Additional paths can be added to the selection as needed. ' references: - https://cloud.google.com/blog/topics/threat-intelligence/russia-targeting-signal-messenger/ - https://vmois.dev/query-signal-desktop-messages-sqlite/ author: Andreas Braathen (mnemonic.io) date: 2025-10-19 tags: - attack.credential-access - attack.t1003 logsource: product: windows service: security definition: 'Requirements: System Access Control List (SACL) policy with attributes List folder/read data on Objects' detection: selection: EventID: 4663 ObjectType: File ObjectName|contains: \AppData\Roaming\Signal\ ObjectName|endswith: - \config.json - \db.sqlite filter_main_signal: ProcessName|endswith: - \signal-portable.exe - \signal.exe condition: selection and not 1 of filter_main_* falsepositives: - Unlikely, but possible from AV or backup software accessing the files. level: medium
Query: describe CVE-2015-2074
Matching passage: CVE-2015-2074. CWE: CWE-22. CVSS: 7.5. The File Repository Server (FRS) CORBA listener in SAP BussinessObjects Edge 4.0 allows remote attackers to write to arbitrary files via a full pathname, aka SAP Note 2018681.
Near-miss passage: CVE-2015-4461. CWE: CWE-22. CVSS: 6.5. Absolute path traversal vulnerability in eFront CMS 3.6.15.4 and earlier allows remote Professor users to obtain sensitive information via a full pathname in the other parameter.
Query: Multiple failed authentications followed by Execution Guardrails
Matching passage: T1480 Execution Guardrails. Tactics: stealth. Description: Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target. Guardrails ensure that a payload only executes against an intended target and reduces collateral damage from an adversary’s campaign.(Citation: FireEye Kevin Mandia Guardrails) Values an adversary can provide about a target system or environment to use as guardrails may include specific network share names, attached physical devices, files, joined Active Directory (AD) domains, and local/external IP addresses.(Citation: FireEye Outlook Dec 2019) Guardrails can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within. This use of guardrails is distinct from typical [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497). While use of [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) may involve checking for known sandbox values and continuing with execution only if there is no match, the use of guardrails will involve checking for an expected target-specific value and only continuing with execution if there is such a match. Adversaries may identify and block certain user-agents to evade defenses and narrow the scope of their attack to victims and platforms on which it will be most effective. A user-agent self-identifies data such as a user's software application, operating system, vendor, and version. Adversaries may check user-agents for operating system identification and then only serve malware for the exploitable software while ignoring all other operating systems.(Citation: Trellix-Qakbot)
Near-miss passage: T1480.002 Mutual Exclusion. Tactics: stealth. Description: Adversaries may constrain execution or actions based on the presence of a mutex associated with malware. A mutex is a locking mechanism used to synchronize access to a resource. Only one thread or process can acquire a mutex at a given time.(Citation: Microsoft Mutexes) While local mutexes only exist within a given process, allowing multiple threads to synchronize access to a resource, system mutexes can be used to synchronize the activities of multiple processes.(Citation: Microsoft Mutexes) By creating a unique system mutex associated with a particular malware, adversaries can verify whether or not a system has already been compromised.(Citation: Sans Mutexes 2012) In Linux environments, malware may instead attempt to acquire a lock on a mutex file. If the malware is able to acquire the lock, it continues to execute; if it fails, it exits to avoid creating a second instance of itself.(Citation: Intezer RedXOR 2021)(Citation: Deep Instinct BPFDoor 2023) Mutex names may be hard-coded or dynamically generated using a predictable algorithm.(Citation: ICS Mutexes 2015)
Query: alert when Detects system restore registry modification via command line, which can be used by adversaries to disable system restor
Matching passage: Sigma rule: Detects system restore registry modification via command line, which can be used by adversaries to disable system restor. Logsource: windows / process_creation. Rule: title: System Restore Registry Modification via CommandLine id: 7c06ab9b-b1d2-4ba9-b06e-09491ded20d9 related: - id: 5de03871-5d46-4539-a82d-3aa992a69a83 type: similar status: experimental description: 'Detects system restore registry modification via command line, which can be used by adversaries to disable system restore on the computer. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-9---disable-system-restore-through-registry author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-03-11 tags: - attack.impact - attack.t1490 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - \reg.exe - OriginalFileName: - powershell.exe - pwsh.dll - reg.exe selection_cli_action: CommandLine|contains: - ' add ' - Set-ItemProperty - New-ItemProperty selection_cli_reg_root: CommandLine|contains: - \SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore selection_cli_reg_key: CommandLine|contains: - DisableConfig - DisableSR condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_reg_system_restore_modification/info.yml simulation: - type: atomic-red-team name: Disable System Restore Through Registry technique: T1490 atomic_guid: 66e647d1-8741-4e43-b7c1-334760c2047f
Near-miss passage: Sigma rule: Detects a remote DLL load event via "rundll32.exe".. Logsource: windows / image_load. Rule: title: Remote DLL Load Via Rundll32.EXE id: f40017b3-cb2e-4335-ab5d-3babf679c1de status: test description: Detects a remote DLL load event via "rundll32.exe". references: - https://github.com/gabe-k/themebleed - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-09-18 tags: - attack.execution - attack.t1204.002 logsource: category: image_load product: windows detection: selection: Image|endswith: \rundll32.exe ImageLoaded|startswith: \\\\ condition: selection falsepositives: - Unknown level: medium
Query: CVE similar to CVE-2015-8902
Matching passage: CVE-2015-8902. CWE: CWE-835. CVSS: 6.5. The ReadBlobByte function in coders/pdb.c in ImageMagick 6.x before 6.9.0-5 Beta allows remote attackers to cause a denial of service (infinite loop) via a crafted PDB file.
Near-miss passage: CVE-2015-6815. CWE: CWE-835. CVSS: 3.5. The process_tx_desc function in hw/net/e1000.c in QEMU before 2.4.0.1 does not properly process transmit descriptor data when sending a network packet, which allows attackers to cause a denial of service (infinite loop and guest crash) via unspecified vectors.
Query: vulnerability: Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12.1 allows remote attackers to execute arbitrary code via a crafted packet, a diffe
Matching passage: CVE-2015-4934. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12.1 allows remote attackers to execute arbitrary code via a crafted packet, a different vulnerability than CVE-2015-4931, CVE-2015-4932, CVE-2015-4933, and CVE-2015-4935.
Near-miss passage: CVE-2015-1495. CWE: CWE-119. CVSS: 6.800000190734863. Multiple stack-based buffer overflows in Motorola Scanner SDK allow remote attackers to execute arbitrary code via a crafted string to the Open method in (1) IOPOSScanner.ocx or (2) IOPOSScale.ocx.
Query: patch priority for CVE-2015-1699
Matching passage: CVE-2015-1699. CWE: CWE-94. CVSS: 9.300000190734863. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted Journal file, aka "Windows Journal Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-1675, CVE-2015-1695, CVE-2015-1696, CVE-2015-1697, and CVE-2015-1698.
Near-miss passage: CVE-2015-0855. CWE: CWE-94. CVSS: 9.800000190734863. The _mediaLibraryPlayCb function in mainwindow.py in pitivi before 0.95 allows attackers to execute arbitrary code via shell metacharacters in a file path.
Query: vulnerability: Cross-site request forgery (CSRF) vulnerability in the ASUS RT-G32 routers with firmware 2.0.2.6 and 2.0.3.2 allows remote attackers to hijack the authentication of administrators 
Matching passage: CVE-2015-2676. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the ASUS RT-G32 routers with firmware 2.0.2.6 and 2.0.3.2 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a request to start_apply.htm.
Near-miss passage: CVE-2015-7364. CWE: CWE-352. CVSS: 6.800000190734863. The HTML_Quickform library, as used in Revive Adserver before 3.2.2, allows remote attackers to bypass the CSRF protection mechanism via an empty token.
Query: Sigma YAML for windows / bits-client
Matching passage: Sigma rule: Detects a suspicious download using the BITS client from a FQDN that is unusual. Adversaries may abuse BITS jobs to pers. Logsource: windows / bits-client. Rule: title: BITS Transfer Job With Uncommon Or Suspicious Remote TLD id: 6d44fb93-e7d2-475c-9d3d-54c9c1e33427 status: test description: Detects a suspicious download using the BITS client from a FQDN that is unusual. Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md - https://twitter.com/malmoeb/status/1535142803075960832 author: Florian Roth (Nextron Systems) date: 2022-06-10 modified: 2025-02-28 tags: - attack.persistence - attack.execution - attack.stealth - attack.t1197 logsource: product: windows service: bits-client detection: selection: EventID: 16403 filter_main_generic: RemoteName|contains: - .azureedge.net/ - .com/ - .sfx.ms/ - download.mozilla.org/ - cdn.onenote.net/ - cdn.office.net/ - tscdn.m365.static.microsoft/ condition: selection and not 1 of filter_main_* falsepositives: - This rule doesn't exclude other known TLDs such as ".org" or ".net". It's recommended to apply additional filters for software and scripts that leverage the BITS service level: medium
Near-miss passage: Sigma rule: Detects when a system process (i.e. located in system32, syswow64, etc.) loads a DLL from a suspicious location or a loc. Logsource: windows / image_load. Rule: title: DLL Load By System Process From Suspicious Locations id: 9e9a9002-56c4-40fd-9eff-e4b09bfa5f6c status: test description: Detects when a system process (i.e. located in system32, syswow64, etc.) loads a DLL from a suspicious location or a location with permissive permissions such as "C:\Users\Public" references: - https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC (Idea) author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-17 modified: 2023-09-18 tags: - attack.stealth - attack.t1070 logsource: product: windows category: image_load detection: selection: Image|startswith: C:\Windows\ ImageLoaded|startswith: - C:\Users\Public\ - C:\PerfLogs\ condition: selection falsepositives: - Unknown level: medium
Query: exploit Cross-site scripting (XSS) vulnerability in Coremail XT3.0 allows remote attackers to inject arbitrary web script or HTML via a hyperlink in a document attachment.
Matching passage: CVE-2015-6942. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Coremail XT3.0 allows remote attackers to inject arbitrary web script or HTML via a hyperlink in a document attachment.
Near-miss passage: CVE-2015-4294. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Cisco IM and Presence Service before 10.5 MR1 allows remote attackers to inject arbitrary web script or HTML by constructing a crafted URL that leverages incomplete filtering of HTML elements, aka Bug ID CSCut41766.
Query: describe CVE-2015-0898
Matching passage: CVE-2015-0898. CWE: CWE-94. CVSS: 7.5. futomi CGI Cafe MP Form Mail CGI eCommerce before 2.0.12 on Windows allows remote attackers to execute arbitrary Perl code via unspecified vectors.
Near-miss passage: CVE-2015-1399. CWE: CWE-94. CVSS: 6.5. PHP remote file inclusion vulnerability in the fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary PHP code via a URL in unspecified vectors involving the setScriptPath function. NOTE: it is not clear whether this issue crosses privilege boundaries, since administrators might already have privileges to include arbitrary files.
Query: explain CWE-621
Matching passage: CWE-621 Variable Extraction Error. The product uses external input to determine the names of variables into which information is extracted, without verifying that the names of the specified variables are valid. This could cause the program to overwrite unintended variables.
Near-miss passage: CWE-1262 Improper Access Control for Register Interface. The product uses memory-mapped I/O registers that act as an interface to hardware functionality from software, but there is improper access control to those registers.
Query: patch priority for CVE-2015-2418
Matching passage: CVE-2015-2418. CWE: CWE-362. CVSS: 6.900000095367432. Race condition in Microsoft Malicious Software Removal Tool (MSRT) before 5.26 allows local users to gain privileges via a crafted DLL, aka "MSRT Race Condition Vulnerability."
Near-miss passage: CVE-2015-1340. CWE: CWE-362. CVSS: 8.100000381469727. LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer() has an unsafe Chmod() call that races against the stat in the Filepath.Walk() function. A symbolic link created in that window could cause any file on the system to have any mode of the attacker's choice.
Query: Sigma rule for Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility
Matching passage: Sigma rule: Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility. Logsource: macos / process_creation. Rule: title: Potential Persistence Via PlistBuddy id: 65d506d3-fcfe-4071-b4b2-bcefe721bbbb status: test description: Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility references: - https://redcanary.com/blog/clipping-silver-sparrows-wings/ - https://www.manpagez.com/man/8/PlistBuddy/ author: Sohan G (D4rkCiph3r) date: 2023-02-18 tags: - attack.privilege-escalation - attack.persistence - attack.t1543.001 - attack.t1543.004 logsource: category: process_creation product: macos detection: selection: Image|endswith: /PlistBuddy CommandLine|contains|all: - RunAtLoad - 'true' CommandLine|contains: - LaunchAgents - LaunchDaemons condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode. Restr. Logsource: windows / process_creation. Rule: title: RestrictedAdminMode Registry Value Tampering - ProcCreation id: 28ac00d6-22d9-4a3c-927f-bbd770104573 related: - id: d6ce7ebd-260b-4323-9768-a9631c8d4db2 type: similar status: test description: 'Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode. RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop. This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise ' references: - https://github.com/redcanaryco/atomic-red-team/blob/a8e3cf63e97b973a25903d3df9fd55da6252e564/atomics/T1112/T1112.md - https://social.technet.microsoft.com/wiki/contents/articles/32905.remote-desktop-services-enable-restricted-admin-mode.aspx - https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/ author: frack113 date: 2023-01-13 modified: 2025-08-28 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: process_creation detection: selection: CommandLine|contains|all: - \System\CurrentControlSet\Control\Lsa - DisableRestrictedAdmin condition: selection falsepositives: - Unknown level: high
Query: rule covering Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting
Matching passage: Sigma rule: Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting. Logsource: windows / process_creation. Rule: title: Windows Recall Feature Enabled Via Reg.EXE id: 817f252c-5143-4dae-b418-48c3e9f63728 related: - id: 5dfc1465-8f65-4fde-8eb5-6194380c6a62 type: similar - id: 75180c5f-4ea1-461a-a4f6-6e4700c065d4 type: similar status: test description: 'Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting the existing "DisableAIDataAnalysis" value, or setting it to 0. Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary. ' references: - https://learn.microsoft.com/en-us/windows/client-management/manage-recall - https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsai#disableaidataanalysis author: Sajid Nawaz Khan date: 2024-06-02 tags: - attack.collection - attack.t1113 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_value: CommandLine|contains|all: - Microsoft\Windows\WindowsAI - DisableAIDataAnalysis selection_action_add: CommandLine|contains: - add - '0' selection_action_delete: CommandLine|contains: delete condition: selection_img and selection_value and 1 of selection_action_* falsepositives: - Legitimate use/activation of Windows Recall level: medium
Near-miss passage: Sigma rule: Detects creation of ".vhd"/".vhdx" files by browser processes. Malware can use mountable Virtual Hard Disk ".vhd" files. Logsource: windows / file_event. Rule: title: VHD Image Download Via Browser id: 8468111a-ef07-4654-903b-b863a80bbc95 status: test description: 'Detects creation of ".vhd"/".vhdx" files by browser processes. Malware can use mountable Virtual Hard Disk ".vhd" files to encapsulate payloads and evade security controls. ' references: - https://redcanary.com/blog/intelligence-insights-october-2021/ - https://www.kaspersky.com/blog/lazarus-vhd-ransomware/36559/ - https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/ author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io' date: 2021-10-25 modified: 2023-05-05 tags: - attack.resource-development - attack.t1587.001 logsource: category: file_event product: windows detection: selection: Image|endswith: - \brave.exe - \chrome.exe - \firefox.exe - \iexplore.exe - \maxthon.exe - \MicrosoftEdge.exe - \msedge.exe - \msedgewebview2.exe - \opera.exe - \safari.exe - \seamonkey.exe - \vivaldi.exe - \whale.exe TargetFilename|contains: .vhd condition: selection falsepositives: - Legitimate downloads of ".vhd" files would also trigger this level: medium
Query: vulnerability: CFNetwork in Apple iOS before 8.3 does not delete HTTP Strict Transport Security (HSTS) state information in response to a Safari history-clearing action, which allows attackers to
Matching passage: CVE-2015-1090. CWE: CWE-200. CVSS: 5.0. CFNetwork in Apple iOS before 8.3 does not delete HTTP Strict Transport Security (HSTS) state information in response to a Safari history-clearing action, which allows attackers to obtain sensitive information by reading a history file.
Near-miss passage: CVE-2015-5880. CWE: CWE-200. CVSS: 4.300000190734863. CoreAnimation in Apple iOS before 9 allows attackers to bypass intended IOSurface restrictions and obtain screen-framebuffer access via a crafted background app.
Query: risk of The ff_dwt_decode function in libavcodec/jpeg2000dwt.c in FFmpeg before 2.8.4 does not validate the number of decomposition levels before proceeding with Discrete Wavelet Transform
Matching passage: CVE-2015-8662. CWE: CWE-119. CVSS: 7.300000190734863. The ff_dwt_decode function in libavcodec/jpeg2000dwt.c in FFmpeg before 2.8.4 does not validate the number of decomposition levels before proceeding with Discrete Wavelet Transform decoding, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG 2000 data.
Near-miss passage: CVE-2015-8472. CWE: CWE-119. CVSS: 7.300000190734863. Buffer overflow in the png_set_PLTE function in libpng before 1.0.65, 1.1.x and 1.2.x before 1.2.55, 1.3.x, 1.4.x before 1.4.18, 1.5.x before 1.5.25, and 1.6.x before 1.6.20 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8126.