alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for windows / security
Matching passage: Sigma rule: Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$).. Logsource: windows / security. Rule: title: SMB Create Remote File Admin Share id: b210394c-ba12-4f89-9117-44a2464b9511 status: test description: Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$). references: - https://github.com/OTRF/ThreatHunter-Playbook/blob/f7a58156dbfc9b019f17f638b8c62d22e557d350/playbooks/WIN-201012004336.yaml - https://securitydatasets.com/notebooks/atomic/windows/lateral_movement/SDWIN-200806015757.html?highlight=create%20file author: Jose Rodriguez (@Cyb3rPandaH), OTR (Open Threat Research) date: 2020-08-06 modified: 2025-10-17 tags: - attack.lateral-movement - attack.t1021.002 logsource: product: windows service: security detection: selection: EventID: 5145 ShareName|endswith: C$ AccessMask: '0x2' filter_main_subjectusername: SubjectUserName|endswith: $ filter_optional_local_ip: IpAddress: ::1 condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the Installation of a Exchange Transport Agent. Logsource: windows / msexchange-management. Rule: title: MSExchange Transport Agent Installation - Builtin id: 4fe151c2-ecf9-4fae-95ae-b88ec9c2fca6 related: - id: 83809e84-4475-4b69-bc3e-4aad8568612f type: derived status: test description: Detects the Installation of a Exchange Transport Agent references: - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=7 author: Tobias Michalski (Nextron Systems) date: 2021-06-08 modified: 2022-11-27 tags: - attack.persistence - attack.t1505.002 logsource: product: windows service: msexchange-management detection: selection: - Install-TransportAgent condition: selection falsepositives: - Legitimate installations of exchange TransportAgents. AssemblyPath is a good indicator for this. level: medium
Query: risk of Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows local users to have unspecified impact via vectors related to weak passwords.
Matching passage: CVE-2015-4681. CWE: CWE-255. CVSS: 7.800000190734863. Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows local users to have unspecified impact via vectors related to weak passwords.
Near-miss passage: CVE-2015-4400. CWE: CWE-255. CVSS: 4.599999904632568. Ring (formerly DoorBot) video doorbells allow remote attackers to obtain sensitive information about the wireless network configuration by pressing the set up button and leveraging an API in the GainSpan Wi-Fi module.
Query: patch priority for CVE-2015-3134
Matching passage: CVE-2015-3134. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3117, CVE-2015-3123, CVE-2015-3130, CVE-2015-3133, and CVE-2015-4431.
Near-miss passage: CVE-2015-5803. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects suspicious execution of "PDQDeployRunner" which is part of the PDQDeploy service stack that is responsible for e. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Execution Of PDQDeployRunner id: 12b8e9f5-96b2-41e1-9a42-8c6779a5c184 related: - id: d679950c-abb7-43a6-80fb-2a480c4fc450 type: similar status: test description: Detects suspicious execution of "PDQDeployRunner" which is part of the PDQDeploy service stack that is responsible for executing commands and packages on a remote machines references: - https://twitter.com/malmoeb/status/1550483085472432128 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-22 modified: 2024-05-02 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_parent: ParentImage|contains: \PDQDeployRunner- selection_child: - Image|endswith: - \bash.exe - \certutil.exe - \cmd.exe - \csc.exe - \cscript.exe - \dllhost.exe - \mshta.exe - \msiexec.exe - \regsvr32.exe - \rundll32.exe - \scriptrunner.exe - \wmic.exe - \wscript.exe - \wsl.exe - Image|contains: - :\ProgramData\ - :\Users\Public\ - :\Windows\TEMP\ - \AppData\Local\Temp - CommandLine|contains: - ' -decode ' - ' -enc ' - ' -encodedcommand ' - ' -w hidden' - DownloadString - FromBase64String - http - 'iex ' - Invoke- condition: all of selection_* falsepositives: - Legitimate use of the PDQDeploy tool to execute these commands level: medium
Near-miss passage: Sigma rule: Detects instances where an SSH service on an OpenCanary node has had a connection attempt.. Logsource: opencanary / application. Rule: title: OpenCanary - SSH New Connection Attempt id: cd55f721-5623-4663-bd9b-5229cab5237d status: test description: Detects instances where an SSH service on an OpenCanary node has had a connection attempt. references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.privilege-escalation - attack.initial-access - attack.lateral-movement - attack.persistence - attack.stealth - attack.t1133 - attack.t1021 - attack.t1078 logsource: category: application product: opencanary detection: selection: logtype: 4000 condition: selection falsepositives: - Unlikely level: high
Query: exploit IBM General Parallel File System (GPFS) 3.5.x before 3.5.0.27 and 4.1.x before 4.1.1.2 and Spectrum Scale 4.1.1.x before 4.1.1.2 allow local users to obtain sensitive information f
Matching passage: CVE-2015-4981. CWE: CWE-200. CVSS: 2.0999999046325684. IBM General Parallel File System (GPFS) 3.5.x before 3.5.0.27 and 4.1.x before 4.1.1.2 and Spectrum Scale 4.1.1.x before 4.1.1.2 allow local users to obtain sensitive information from system memory via unspecified vectors.
Near-miss passage: CVE-2015-3882. CWE: CWE-200. CVSS: 5.300000190734863. qdPM 8.3 allows remote attackers to obtain sensitive information via invalid ID value to index.php/users/info/id/[ID], which reveals the installation path in an error message.
Query: vulnerability: MobileInstallation in Apple iOS before 8.4 does not ensure the uniqueness of Watch bundle IDs, which allows attackers to cause a denial of service (ID collision and Watch launch ou
Matching passage: CVE-2015-3725. CWE: CWE-399. CVSS: 4.300000190734863. MobileInstallation in Apple iOS before 8.4 does not ensure the uniqueness of Watch bundle IDs, which allows attackers to cause a denial of service (ID collision and Watch launch outage) via a crafted universal provisioning profile app.
Near-miss passage: CVE-2015-6994. CWE: CWE-399. CVSS: 7.099999904632568. The kernel in Apple iOS before 9.1 and OS X before 10.11.1 mishandles reuse of virtual memory, which allows attackers to cause a denial of service via a crafted app.
Query: detection rule: Detects file creation events indicating NetExec (nxc.exe) execution on the local machine. NetExec is a PyInstaller-bundl
Matching passage: Sigma rule: Detects file creation events indicating NetExec (nxc.exe) execution on the local machine. NetExec is a PyInstaller-bundl. Logsource: windows / file_event. Rule: title: HackTool - NetExec File Indicators id: efc21479-9e83-41da-8cf1-122e06ba8db3 status: experimental description: 'Detects file creation events indicating NetExec (nxc.exe) execution on the local machine. NetExec is a PyInstaller-bundled binary that extracts its embedded data files to a "_MEI<random>" directory under the Temp folder upon execution. Files dropped under the "\nxc\" sub-directory of that extraction path are unique to NetExec and serve as reliable on-disk indicators of execution. NetExec (formerly CrackMapExec) is a widely used post-exploitation and lateral movement tool used for Active Directory enumeration, credential harvesting, and remote code execution. ' references: - https://github.com/Pennyw0rth/NetExec - https://www.netexec.wiki/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-04-08 tags: - attack.execution - attack.lateral-movement - attack.discovery - attack.t1021.002 - attack.t1059.005 logsource: product: windows category: file_event detection: selection: - Image|contains: \nxc-windows-latest\ - TargetFilename|contains|all: - \Temp\_MEI - \nxc\data\ condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_hktl_netexec_file_indicators/info.yml
Near-miss passage: Sigma rule: Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that m. Logsource: windows / ps_script. Rule: title: Powershell Timestomp id: c6438007-e081-42ce-9483-b067fbef33c3 status: test description: 'Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.006/T1070.006.md - https://www.offensive-security.com/metasploit-unleashed/timestomp/ author: frack113 date: 2021-08-03 modified: 2022-12-25 tags: - attack.stealth - attack.t1070.006 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_ioc: ScriptBlockText|contains: - .CreationTime = - .LastWriteTime = - .LastAccessTime = - '[IO.File]::SetCreationTime' - '[IO.File]::SetLastAccessTime' - '[IO.File]::SetLastWriteTime' condition: selection_ioc falsepositives: - Legitimate admin script level: medium
Query: risk of In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9645, MDM9650, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 427, SD 430, SD 435
Matching passage: CVE-2015-9142. CWE: CWE-118. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9645, MDM9650, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SDM630, SDM636, SDM660, and Snapdragon_High_Med_2016, bounds check is missing for vtable index in DAL-TO-QDI conversion framework.
Near-miss passage: CVE-2015-2003. CWE: CWE-118. CVSS: 9.800000190734863. The PJSIP PJSUA2 SDK before SVN Changeset 51322 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.
Query: CWE for Cryptographic Operations are run Before Supporting Units are Ready
Matching passage: CWE-1279 Cryptographic Operations are run Before Supporting Units are Ready. Performing cryptographic operations without ensuring that the supporting inputs are ready to supply valid data may compromise the cryptographic result.
Near-miss passage: CWE-791 Incomplete Filtering of Special Elements. The product receives data from an upstream component, but does not completely filter special elements before sending it to a downstream component.
Query: stealth using Electron Applications
Matching passage: T1218.015 Electron Applications. Tactics: stealth. Description: Adversaries may abuse components of the Electron framework to execute malicious code. The Electron framework hosts many common applications such as Signal, Slack, and Microsoft Teams.(Citation: Electron 2) Originally developed by GitHub, Electron is a cross-platform desktop application development framework that employs web technologies like JavaScript, HTML, and CSS.(Citation: Electron 3) The Chromium engine is used to display web content and Node.js runs the backend code.(Citation: Electron 1) Due to the functional mechanics of Electron (such as allowing apps to run arbitrary commands), adversaries may also be able to perform malicious functions in the background potentially disguised as legitimate tools within the framework.(Citation: Electron 1) For example, the abuse of `teams.exe` and `chrome.exe` may allow adversaries to execute malicious commands as child processes of the legitimate application (e.g., `chrome.exe --disable-gpu-sandbox --gpu-launcher="C:\Windows\system32\cmd.exe /c calc.exe`).(Citation: Electron 6-8) Adversaries may also execute malicious content by planting malicious [JavaScript](https://attack.mitre.org/techniques/T1059/007) within Electron applications.(Citation: Electron Security)
Near-miss passage: T1218.004 InstallUtil. Tactics: stealth. Description: Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. (Citation: MSDN InstallUtil) The InstallUtil binary may also be digitally signed by Microsoft and located in the .NET directories on a Windows system: <code>C:\Windows\Microsoft.NET\Framework\v<version>\InstallUtil.exe</code> and <code>C:\Windows\Microsoft.NET\Framework64\v<version>\InstallUtil.exe</code>. InstallUtil may also be used to bypass application control through use of attributes within the binary that execute the class decorated with the attribute <code>[System.ComponentModel.RunInstaller(true)]</code>. (Citation: LOLBAS Installutil)
Query: alert when Detects the execution of a renamed BOINC binary.
Matching passage: Sigma rule: Detects the execution of a renamed BOINC binary.. Logsource: windows / process_creation. Rule: title: Renamed BOINC Client Execution id: 30d07da2-83ab-45d8-ae75-ec7c0edcaffc status: test description: Detects the execution of a renamed BOINC binary. references: - https://boinc.berkeley.edu/ - https://www.virustotal.com/gui/file/91e405e8a527023fb8696624e70498ae83660fe6757cef4871ce9bcc659264d3/details - https://www.huntress.com/blog/fake-browser-updates-lead-to-boinc-volunteer-computing-software author: Matt Anderson (Huntress) date: 2024-07-23 tags: - attack.defense-impairment - attack.t1553 logsource: category: process_creation product: windows detection: selection: OriginalFileName: BOINC.exe filter_main_legit_name: Image|endswith: \BOINC.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects potential DLL sideloading of "libvlc.dll", a DLL that is legitimately used by "VLC.exe". Logsource: windows / image_load. Rule: title: Potential Libvlc.DLL Sideloading id: bf9808c4-d24f-44a2-8398-b65227d406b6 status: test description: Detects potential DLL sideloading of "libvlc.dll", a DLL that is legitimately used by "VLC.exe" references: - https://www.trendmicro.com/en_us/research/23/c/earth-preta-updated-stealthy-strategies.html - https://hijacklibs.net/entries/3rd_party/vlc/libvlc.html author: X__Junior date: 2023-04-17 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \libvlc.dll filter_main_vlc: ImageLoaded|startswith: - C:\Program Files (x86)\VideoLAN\VLC\ - C:\Program Files\VideoLAN\VLC\ condition: selection and not 1 of filter_main_* falsepositives: - False positives are expected if VLC is installed in non-default locations level: medium
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects potential "ShellDispatch.dll" functionality abuse to execute arbitrary binaries via "ShellExecute". Logsource: windows / process_creation. Rule: title: Potential ShellDispatch.DLL Functionality Abuse id: 82343930-652f-43f5-ab70-2ee9fdd6d5e9 status: test description: Detects potential "ShellDispatch.dll" functionality abuse to execute arbitrary binaries via "ShellExecute" references: - https://www.hexacorn.com/blog/2023/06/07/this-lolbin-doesnt-exist/ author: X__Junior (Nextron Systems) date: 2023-06-20 tags: - attack.execution - attack.stealth logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE selection_cli: CommandLine|contains: RunDll_ShellExecuteW condition: all of selection_* falsepositives: - Unlikely level: medium
Near-miss passage: Sigma rule: Detects a child process spawned by 'winrshost.exe', which suggests remote command execution through Windows Remote Shell. Logsource: windows / process_creation. Rule: title: Potential Lateral Movement via Windows Remote Shell id: 79df3f68-dccb-48e9-9171-b75cbc37c51d status: experimental description: 'Detects a child process spawned by ''winrshost.exe'', which suggests remote command execution through Windows Remote Shell (WinRs) and may indicate potential lateral movement activity. ' references: - https://cardinalops.com/blog/living-off-winrm-abusing-complexity-in-remote-management/ - https://www.ired.team/offensive-security/lateral-movement/winrs-for-lateral-movement author: Liran Ravich date: 2025-10-22 tags: - attack.lateral-movement - attack.t1021.006 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \winrshost.exe filter_main_conhost: Image: C:\Windows\System32\conhost.exe condition: selection and not 1 of filter_main_* falsepositives: - Legitimate use of WinRM within the organization level: medium
Query: CVE similar to CVE-2015-3627
Matching passage: CVE-2015-3627. CWE: CWE-59. CVSS: 7.199999809265137. Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a symlink attack in an image.
Near-miss passage: CVE-2015-3759. CWE: CWE-59. CVSS: 4.599999904632568. Location Framework in Apple iOS before 8.4.1 allows local users to bypass intended restrictions on filesystem modification via a symlink.
Query: vulnerability: The Siemens HomeControl for Room Automation application before 2.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to sp
Matching passage: CVE-2015-3610. CWE: CWE-310. CVSS: 5.400000095367432. The Siemens HomeControl for Room Automation application before 2.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information or modify data via a crafted certificate.
Near-miss passage: CVE-2015-0941. CWE: CWE-310. CVSS: 4.300000190734863. The Inetc plugin for Nullsoft Scriptable Install System (NSIS), as used in CERT/CC Failure Observation Engine (FOE) and other products, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and possibly execute arbitrary code by sending a crafted certificate in a download session for Windows executable files.
Query: CVE similar to CVE-2015-3956
Matching passage: CVE-2015-3956. CWE: CWE-345. CVSS: 9.800000190734863. Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior accept drug libraries, firmware updates, pump commands, and unauthorized configuration changes from unauthenticated devices on the host network. Hospira recommends that customers close Port 20/FTP and Port 23/TELNET on the affected devices. Hospira has also released the Plum 360 Infusion System which is not vulnerable to this issue.
Near-miss passage: CVE-2015-0259. CWE: CWE-345. CVSS: 5.099999904632568. OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for access to consoles via a crafted webpage.
Query: write Sigma for Detection of unusual child processes by different system processes
Matching passage: Sigma rule: Detection of unusual child processes by different system processes. Logsource: windows / process_creation. Rule: title: Abused Debug Privilege by Arbitrary Parent Processes id: d522eca2-2973-4391-a3e0-ef0374321dae status: test description: Detection of unusual child processes by different system processes references: - https://image.slidesharecdn.com/kheirkhabarovoffzonefinal-181117201458/95/hunting-for-privilege-escalation-in-windows-environment-74-638.jpg author: Semanur Guneysu @semanurtg, oscd.community date: 2020-10-28 modified: 2022-11-11 tags: - attack.privilege-escalation - attack.t1548 logsource: product: windows category: process_creation detection: selection_parent: ParentImage|endswith: - \winlogon.exe - \services.exe - \lsass.exe - \csrss.exe - \smss.exe - \wininit.exe - \spoolsv.exe - \searchindexer.exe User|contains: - AUTHORI - AUTORI selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - \cmd.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll - Cmd.Exe filter: CommandLine|contains|all: - ' route ' - ' ADD ' condition: all of selection_* and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects potential abuse of ntdsutil to dump ntds.dit database. Logsource: windows / application. Rule: title: Ntdsutil Abuse id: e6e88853-5f20-4c4a-8d26-cd469fd8d31f status: test description: Detects potential abuse of ntdsutil to dump ntds.dit database references: - https://twitter.com/mgreen27/status/1558223256704122882 - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj574207(v=ws.11) author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-14 tags: - attack.credential-access - attack.t1003.003 logsource: product: windows service: application detection: selection: Provider_Name: ESENT EventID: - 216 - 325 - 326 - 327 Data|contains: ntds.dit condition: selection falsepositives: - Legitimate backup operation/creating shadow copies level: medium
Query: CVE similar to CVE-2015-0806
Matching passage: CVE-2015-0806. CWE: CWE-17. CVSS: 7.5. The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before 37.0 attempts to use memset for a memory region of negative length during interaction with the mozilla::layers::BufferTextureClient::AllocateForSurface function, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors that trigger rendering of 2D graphics content.
Near-miss passage: CVE-2015-2270. CWE: CWE-17. CVSS: 4.300000190734863. lib/moodlelib.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4, when the theme uses the blocks-regions feature, establishes the course state at an incorrect point in the login-validation process, which allows remote attackers to obtain sensitive course information via unspecified vectors.
Query: CVE similar to CVE-2015-5952
Matching passage: CVE-2015-5952. CWE: CWE-22. CVSS: 9.800000190734863. Directory traversal vulnerability in Thomson Reuters for FATCA before 5.2 allows remote attackers to execute arbitrary files via the item parameter.
Near-miss passage: CVE-2015-1503. CWE: CWE-22. CVSS: 7.5. Multiple directory traversal vulnerabilities in IceWarp Mail Server before 11.2 allow remote attackers to read arbitrary files via a (1) .. (dot dot) in the file parameter to a webmail/client/skins/default/css/css.php page or .../. (dot dot dot slash dot) in the (2) script or (3) style parameter to webmail/old/calendar/minimizer/index.php.