alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Detects when a user tampers with S3 data management in Amazon Web Services.
Matching passage: Sigma rule: Detects when a user tampers with S3 data management in Amazon Web Services.. Logsource: aws / cloudtrail. Rule: title: AWS S3 Data Management Tampering id: 78b3756a-7804-4ef7-8555-7b9024a02e2d status: test description: Detects when a user tampers with S3 data management in Amazon Web Services. references: - https://github.com/elastic/detection-rules/pull/1145/files - https://docs.aws.amazon.com/AmazonS3/latest/API/API_Operations.html - https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketLogging.html - https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketWebsite.html - https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketEncryption.html - https://docs.aws.amazon.com/AmazonS3/latest/userguide/setting-repl-config-perm-overview.html - https://docs.aws.amazon.com/AmazonS3/latest/API/API_RestoreObject.html author: Austin Songer @austinsonger date: 2021-07-24 modified: 2022-10-09 tags: - attack.exfiltration - attack.t1537 logsource: product: aws service: cloudtrail detection: selection: eventSource: s3.amazonaws.com eventName: - PutBucketLogging - PutBucketWebsite - PutEncryptionConfiguration - PutLifecycleConfiguration - PutReplicationConfiguration - ReplicateObject - RestoreObject condition: selection falsepositives: - A S3 configuration change may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. S3 configuration change from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: low
Near-miss passage: Sigma rule: Detects the execution of a shell (powershell, bash, wsl...) via Visual Studio Code tunnel. Attackers can abuse this func. Logsource: windows / process_creation. Rule: title: Visual Studio Code Tunnel Shell Execution id: f4a623c2-4ef5-4c33-b811-0642f702c9f1 status: test description: Detects the execution of a shell (powershell, bash, wsl...) via Visual Studio Code tunnel. Attackers can abuse this functionality to establish a C2 channel and execute arbitrary commands on the system. references: - https://ipfyx.fr/post/visual-studio-code-tunnel/ - https://badoption.eu/blog/2023/01/31/code_c2.html - https://code.visualstudio.com/docs/remote/tunnels author: Nasreddine Bencherchali (Nextron Systems) date: 2023-10-25 tags: - attack.command-and-control - attack.t1071.001 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|contains: \servers\Stable- ParentImage|endswith: \server\node.exe ParentCommandLine|contains: .vscode-server selection_child_1: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains: \terminal\browser\media\shellIntegration.ps1 selection_child_2: Image|endswith: - \wsl.exe - \bash.exe condition: selection_parent and 1 of selection_child_* falsepositives: - Legitimate use of Visual Studio Code tunnel and running code from there level: medium
Query: describe CVE-2015-2530
Matching passage: CVE-2015-2530. CWE: CWE-20. CVSS: 9.300000190734863. Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to execute arbitrary code via a crafted .jnt file, aka "Windows Journal RCE Vulnerability," a different vulnerability than CVE-2015-2513 and CVE-2015-2514.
Near-miss passage: CVE-2015-7835. CWE: CWE-20. CVSS: 7.199999809265137. The mod_l2_entry function in arch/x86/mm.c in Xen 3.4 through 4.6.x does not properly validate level 2 page table entries, which allows local PV guest administrators to gain privileges via a crafted superpage mapping.
Query: weakness Use of Implicit Intent for Sensitive Communication
Matching passage: CWE-927 Use of Implicit Intent for Sensitive Communication. The Android application uses an implicit intent for transmitting sensitive data to other applications.
Near-miss passage: CWE-1293 Missing Source Correlation of Multiple Independent Data. The product relies on one source of data, preventing the ability to detect if an adversary has compromised a data source.
Query: detect Detects the use of the filename DumpStack.log to evade Microsoft Defender in logs
Matching passage: Sigma rule: Detects the use of the filename DumpStack.log to evade Microsoft Defender. Logsource: windows / process_creation. Rule: title: DumpStack.log Defender Evasion id: 4f647cfa-b598-4e12-ad69-c68dd16caef8 status: test description: Detects the use of the filename DumpStack.log to evade Microsoft Defender references: - https://twitter.com/mrd0x/status/1479094189048713219 author: Florian Roth (Nextron Systems) date: 2022-01-06 modified: 2022-06-17 tags: - attack.defense-impairment logsource: category: process_creation product: windows detection: selection: Image|endswith: \DumpStack.log selection_download: CommandLine|contains: ' -o DumpStack.log' condition: 1 of selection* falsepositives: - Unknown level: critical
Near-miss passage: Sigma rule: When configured with suitable command line arguments, w32tm can act as a delay mechanism. Logsource: windows / process_creation. Rule: title: Use of W32tm as Timer id: 6da2c9f5-7c53-401b-aacb-92c040ce1215 status: test description: When configured with suitable command line arguments, w32tm can act as a delay mechanism references: - https://github.com/redcanaryco/atomic-red-team/blob/d0dad62dbcae9c60c519368e82c196a3db577055/atomics/T1124/T1124.md - https://blogs.blackberry.com/en/2022/05/dirty-deeds-done-dirt-cheap-russian-rat-offers-backdoor-bargains author: frack113 date: 2022-09-25 tags: - attack.discovery - attack.t1124 logsource: category: process_creation product: windows detection: selection_w32tm: - Image|endswith: \w32tm.exe - OriginalFileName: w32time.dll selection_cmd: CommandLine|contains|all: - /stripchart - '/computer:' - '/period:' - /dataonly - '/samples:' condition: all of selection_* falsepositives: - Legitimate use level: high
Query: CVE similar to CVE-2015-4395
Matching passage: CVE-2015-4395. CWE: CWE-200. CVSS: 3.5. The HybridAuth Social Login module 7.x-2.x before 7.x-2.10 for Drupal stores passwords in plaintext when the "Ask user for a password when registering" option is enabled, which allows remote authenticated users with certain permissions to obtain sensitive information by leveraging access to the database.
Near-miss passage: CVE-2015-7846. CWE: CWE-200. CVSS: 4.599999904632568. Huawei S7700, S9700, S9300 before V200R07C00SPC500, and AR200, AR1200, AR2200, AR3200 before V200R005C20SPC200 allows attackers with physical access to the CF card to obtain sensitive information.
Query: vulnerability: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0
Matching passage: CVE-2015-8638. CWE: UNKNOWN. CVSS: 8.800000190734863. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8634, CVE-2015-8635, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, and CVE-2015-8650.
Near-miss passage: CVE-2015-2644. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle Agile PLM Framework component in Oracle Supply Chain Products Suite 9.3.3 allows remote attackers to affect confidentiality via unknown vectors related to Security.
Query: Sigma rule for Transferring files with well-known filenames (sensitive files with credential data) using network shares
Matching passage: Sigma rule: Transferring files with well-known filenames (sensitive files with credential data) using network shares. Logsource: windows / security. Rule: title: Transferring Files with Credential Data via Network Shares id: 910ab938-668b-401b-b08c-b596e80fdca5 related: - id: 2e69f167-47b5-4ae7-a390-47764529eff5 type: similar status: test description: Transferring files with well-known filenames (sensitive files with credential data) using network shares references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment author: Teymur Kheirkhabarov, oscd.community date: 2019-10-22 modified: 2025-07-11 tags: - attack.credential-access - attack.t1003.002 - attack.t1003.001 - attack.t1003.003 logsource: product: windows service: security detection: selection_eid: EventID: 5145 selection_object: - RelativeTargetName|contains: - \mimidrv - \lsass - \windows\minidump\ - \hiberfil - \sqldmpr - RelativeTargetName: - Windows\NTDS\ntds.dit - Windows\System32\config\SAM - Windows\System32\config\SECURITY - Windows\System32\config\SYSTEM condition: all of selection_* falsepositives: - Transferring sensitive files for legitimate administration work by legitimate administrator level: medium
Near-miss passage: Sigma rule: Detects a Get-Process command on lsass process, which is in almost all cases a sign of malicious activity. Logsource: windows / ps_script. Rule: title: PowerShell Get-Process LSASS in ScriptBlock id: 84c174ab-d3ef-481f-9c86-a50d0b8e3edb status: test description: Detects a Get-Process command on lsass process, which is in almost all cases a sign of malicious activity references: - https://web.archive.org/web/20220205033028/https://twitter.com/PythonResponder/status/1385064506049630211 author: Florian Roth (Nextron Systems) date: 2021-04-23 modified: 2022-12-25 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: Get-Process lsass condition: selection falsepositives: - Legitimate certificate exports invoked by administrators or users (depends on processes in the environment - filter if unusable) level: high
Query: describe CVE-2015-5530
Matching passage: CVE-2015-5530. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in Free Reprintables ArticleFR 3.0.6 allow remote attackers to hijack the authentication of administrators for requests that add an administrator account via a request to dashboard/users/create/.
Near-miss passage: CVE-2015-7678. CWE: CWE-352. CVSS: 8.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in Ipswitch MOVEit Mobile 1.2.0.962 and earlier allow remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Query: describe CVE-2015-7207
Matching passage: CVE-2015-7207. CWE: CWE-200. CVSS: 5.0. Mozilla Firefox before 43.0 does not properly restrict the availability of IFRAME Resource Timing API times, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaScript code that leverages history.back and performance.getEntries calls, a related issue to CVE-2015-1300.
Near-miss passage: CVE-2015-6632. CWE: CWE-200. CVSS: 5.0. libstagefright in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 24346430.
Query: risk of Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or caus
Matching passage: CVE-2015-0350. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0347, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, CVE-2015-3042, and CVE-2015-3043.
Near-miss passage: CVE-2015-2118. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Secure Pull Print and Security Pull Print components in HP Access Control (AC) Software 12.x through 14.x before 14.1.2 allows remote authenticated users to obtain sensitive information via unknown vectors.
Query: vulnerability: Incomplete blacklist vulnerability in the chfn function in libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, allows local 
Matching passage: CVE-2015-3245. CWE: CWE-20. CVSS: 2.0999999046325684. Incomplete blacklist vulnerability in the chfn function in libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, allows local users to cause a denial of service (/etc/passwd corruption) via a newline character in the GECOS field.
Near-miss passage: CVE-2015-1105. CWE: CWE-20. CVSS: 5.0. The TCP implementation in the kernel in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 does not properly implement the Urgent (aka out-of-band data) mechanism, which allows remote attackers to cause a denial of service via crafted packets.
Query: common weakness: Storing Passwords in a Recoverable Format
Matching passage: CWE-257 Storing Passwords in a Recoverable Format. The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.
Near-miss passage: CWE-233 Improper Handling of Parameters. The product does not properly handle when the expected number of parameters, fields, or arguments is not provided in input, or if those parameters are undefined.
Query: describe CVE-2015-1856
Matching passage: CVE-2015-1856. CWE: CWE-264. CVSS: 5.5. OpenStack Object Storage (Swift) before 2.3.0, when allow_version is configured, allows remote authenticated users to delete the latest version of an object by leveraging listing access to the x-versions-location container.
Near-miss passage: CVE-2015-7371. CWE: CWE-264. CVSS: 5.0. Revive Adserver before 3.2.2 does not restrict access to run-mpe.php, which allows remote attackers to run the Maintenance Priority Engine and possibly cause a denial of service (resource consumption) via a direct request.
Query: Sigma rule for Detects password policy discovery commands
Matching passage: Sigma rule: Detects password policy discovery commands. Logsource: linux / auditd. Rule: title: Password Policy Discovery - Linux id: ca94a6db-8106-4737-9ed2-3e3bb826af0a status: stable description: Detects password policy discovery commands references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1201/T1201.md - https://linux.die.net/man/1/chage - https://man7.org/linux/man-pages/man1/passwd.1.html - https://superuser.com/questions/150675/how-to-display-password-policy-information-for-a-user-ubuntu author: Ömer Günal, oscd.community, Pawel Mazur date: 2020-10-08 modified: 2024-12-01 tags: - attack.discovery - attack.t1201 logsource: product: linux service: auditd detection: selection_files: type: PATH name: - /etc/login.defs - /etc/pam.d/auth - /etc/pam.d/common-account - /etc/pam.d/common-auth - /etc/pam.d/common-password - /etc/pam.d/system-auth - /etc/security/pwquality.conf selection_chage: type: EXECVE a0: chage a1: - --list - -l selection_passwd: type: EXECVE a0: passwd a1: - -S - --status condition: 1 of selection_* falsepositives: - Legitimate administration activities level: low
Near-miss passage: Sigma rule: Detects usage of known powershell cmdlets such as "Clear-EventLog" to clear the Windows event logs. Logsource: windows / ps_script. Rule: title: Suspicious Eventlog Clear id: 0f017df3-8f5a-414f-ad6b-24aff1128278 related: - id: cc36992a-4671-4f21-a91d-6c2b72a2edf5 type: derived status: test description: Detects usage of known powershell cmdlets such as "Clear-EventLog" to clear the Windows event logs references: - https://twitter.com/oroneequalsone/status/1568432028361830402 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.001/T1070.001.md - https://eqllib.readthedocs.io/en/latest/analytics/5b223758-07d6-4100-9e11-238cfdd0fe97.html - https://stackoverflow.com/questions/66011412/how-to-clear-a-event-log-in-powershell-7 - https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventing.reader.eventlogsession.clearlog?view=windowsdesktop-9.0&viewFallbackFrom=dotnet-plat-ext-5.0#System_Diagnostics_Eventing_Reader_EventLogSession_ClearLog_System_String_ - https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventlog.clear author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2022-09-12 modified: 2025-10-06 tags: - attack.defense-impairment - attack.t1685.005 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: - ScriptBlockText|contains: - 'Clear-EventLog ' - 'Remove-EventLog ' - 'Limit-EventLog ' - 'Clear-WinEvent ' - ScriptBlockText|contains|all: - Eventing.Reader.EventLogSession - ClearLog - ScriptBlockText|contains|all: - Diagnostics.EventLog - Clear condition: selection falsepositives: - Rare need to clear logs before doing something. Sometimes used by installers or cleaner scripts. The script should be investigated to determine if it's legitimate level: medium
Query: risk of Microsoft Internet Explorer 7 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explore
Matching passage: CVE-2015-6145. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 7 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6146.
Near-miss passage: CVE-2015-8505. CWE: CWE-119. CVSS: 9.300000190734863. mediaserver in Android before 5.1.1 LMY48Z allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 17769851, a different vulnerability than CVE-2015-6616, CVE-2015-8506, and CVE-2015-8507.
Query: Sigma YAML for aws / cloudtrail
Matching passage: Sigma rule: Detects the use of the EnableRegion command in AWS CloudTrail logs. While AWS has 30+ regions, some of them are enabled. Logsource: aws / cloudtrail. Rule: title: AWS EnableRegion Command Monitoring id: a5ffb6ea-c784-4e01-b30a-deb6e58ca2ab status: experimental description: 'Detects the use of the EnableRegion command in AWS CloudTrail logs. While AWS has 30+ regions, some of them are enabled by default, others must be explicitly enabled in each account separately. There may be situations where security monitoring does not cover some new AWS regions. Monitoring the EnableRegion command is important for identifying potential persistence mechanisms employed by adversaries, as enabling additional regions can facilitate continued access and operations within an AWS environment. ' references: - https://docs.aws.amazon.com/accounts/latest/reference/API_EnableRegion.html - https://awscli.amazonaws.com/v2/documentation/api/2.14.0/reference/account/enable-region.html author: Ivan Saakov, Sergey Zelenskiy date: 2025-10-19 tags: - attack.persistence logsource: product: aws service: cloudtrail detection: selection: eventName: EnableRegion eventSource: account.amazonaws.com condition: selection falsepositives: - Legitimate use of the EnableRegion command by authorized administrators. level: medium
Near-miss passage: Sigma rule: Detection of sc.exe utility adding a new service with special permission which hides that service.. Logsource: windows / process_creation. Rule: title: Service Security Descriptor Tampering Via Sc.EXE id: 98c5aeef-32d5-492f-b174-64a691896d25 related: - id: 99cf1e02-00fb-4c0d-8375-563f978dfd37 type: similar - id: a537cfc3-4297-4789-92b5-345bfd845ad0 type: similar status: test description: Detection of sc.exe utility adding a new service with special permission which hides that service. references: - https://blog.talosintelligence.com/2021/10/threat-hunting-in-large-datasets-by.html - https://www.sans.org/blog/red-team-tactics-hiding-windows-services/ - https://twitter.com/Alh4zr3d/status/1580925761996828672 - https://twitter.com/0gtweet/status/1628720819537936386 - https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-28 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.011 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \sc.exe - OriginalFileName: sc.exe selection_cli: CommandLine|contains: sdset condition: all of selection_* falsepositives: - Unknown level: medium