alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects execution of "curl.exe" with the "file://" protocol handler in order to read local files.. Logsource: windows / process_creation. Rule: title: Local File Read Using Curl.EXE id: aa6f6ea6-0676-40dd-b510-6e46f02d8867 status: test description: Detects execution of "curl.exe" with the "file://" protocol handler in order to read local files. references: - https://curl.se/docs/manpage.html author: Nasreddine Bencherchali (Nextron Systems) date: 2023-07-27 tags: - attack.execution logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \curl.exe - OriginalFileName: curl.exe selection_cli: CommandLine|contains: file:/// condition: all of selection_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_local_file_read/info.yml
Near-miss passage: Sigma rule: Detects possible malicious execution of JXA in-memory via OSAScript. Logsource: macos / process_creation. Rule: title: JXA In-memory Execution Via OSAScript id: f1408a58-0e94-4165-b80a-da9f96cf6fc3 related: - id: 1bc2e6c5-0885-472b-bed6-be5ea8eace55 type: derived status: test description: Detects possible malicious execution of JXA in-memory via OSAScript references: - https://redcanary.com/blog/applescript/ author: Sohan G (D4rkCiph3r) date: 2023-01-31 tags: - attack.t1059.002 - attack.t1059.007 - attack.execution logsource: product: macos category: process_creation detection: selection_main: CommandLine|contains|all: - osascript - ' -e ' - eval - NSData.dataWithContentsOfURL selection_js: - CommandLine|contains|all: - ' -l ' - JavaScript - CommandLine|contains: .js condition: all of selection_* falsepositives: - Unknown level: high
Query: detection rule: Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .N
Matching passage: Sigma rule: Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .N. Logsource: windows / ps_script. Rule: title: Registry-Free Process Scope COR_PROFILER id: 23590215-4702-4a70-8805-8dc9e58314a2 status: test description: 'Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .NET CLR. The COR_PROFILER is a .NET Framework feature which allows developers to specify an unmanaged (or external of .NET) profiling DLL to be loaded into each .NET process that loads the Common Language Runtime (CLR). These profiliers are designed to monitor, troubleshoot, and debug managed code executed by the .NET CLR. (Citation: Microsoft Profiling Mar 2017) (Citation: Microsoft COR_PROFILER Feb 2013) ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.012/T1574.012.md#atomic-test-3---registry-free-process-scope-cor_profiler author: frack113 date: 2021-12-30 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.012 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - $env:COR_ENABLE_PROFILING - $env:COR_PROFILER - $env:COR_PROFILER_PATH condition: selection falsepositives: - Legitimate administrative script level: medium
Near-miss passage: Sigma rule: Detects network traffic potentially associated with a scraper botnet variant that uses the "Hello-World/1.0" user-agent. Logsource: proxy. Rule: title: Potential Hello-World Scraper Botnet Activity id: 1712bafe-be05-4a0e-89d4-17a3ed151bf5 status: experimental description: 'Detects network traffic potentially associated with a scraper botnet variant that uses the "Hello-World/1.0" user-agent string. ' references: - https://www.greynoise.io/blog/new-scraper-botnet-concentrated-in-taiwan - https://viz.greynoise.io/tags/hello-world-scraper-botnet?days=30 author: Joseph A. M. date: 2025-08-02 tags: - attack.reconnaissance - attack.t1595 logsource: category: proxy detection: selection: c-useragent: Hello-World/1.0 cs-method: GET condition: selection falsepositives: - Legitimate network monitoring or vulnerability scanning tools that may use this generic user agent. - Internal development or testing scripts. Consider filtering by source IP if this is expected from certain systems. level: medium
Query: rule covering Identifies when a VPN Tunnel Modified or Deleted in Google Cloud.
Matching passage: Sigma rule: Identifies when a VPN Tunnel Modified or Deleted in Google Cloud.. Logsource: gcp / gcp.audit. Rule: title: Google Cloud VPN Tunnel Modified or Deleted id: 99980a85-3a61-43d3-ac0f-b68d6b4797b1 status: test description: Identifies when a VPN Tunnel Modified or Deleted in Google Cloud. references: - https://any-api.com/googleapis_com/compute/docs/vpnTunnels author: Austin Songer @austinsonger date: 2021-08-16 modified: 2022-10-09 tags: - attack.impact logsource: product: gcp service: gcp.audit detection: selection: gcp.audit.method_name: - compute.vpnTunnels.insert - compute.vpnTunnels.delete condition: selection falsepositives: - VPN Tunnel being modified or deleted may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - VPN Tunnel modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects the use of the 'setcap' utility to set the 'setgid' capability (cap_setgid) on a binary file. This capability al. Logsource: linux / process_creation. Rule: title: Linux Setgid Capability Set on a Binary via Setcap Utility id: 3a716279-c18c-4488-83be-f9ececbfb9fc status: experimental description: 'Detects the use of the ''setcap'' utility to set the ''setgid'' capability (cap_setgid) on a binary file. This capability allows a non privileged process to make arbitrary manipulations of group IDs (GIDs), including setting its current GID to a value that would otherwise be restricted (i.e. GID 0, the root group). This behavior can be used by adversaries to backdoor a binary in order to escalate privileges again in the future if needed. ' references: - https://man7.org/linux/man-pages/man8/setcap.8.html - https://dfir.ch/posts/linux_capabilities/ - https://juggernaut-sec.com/capabilities/#cap_setgid author: Luc Génaux date: 2026-01-24 tags: - attack.privilege-escalation - attack.persistence - attack.t1548 - attack.t1554 logsource: product: linux category: process_creation detection: selection: Image|endswith: /setcap CommandLine|contains: cap_setgid condition: selection falsepositives: - Unknown level: low
Query: explain CWE-512
Matching passage: CWE-512 Spyware. The product collects personally identifiable information about a human user or the user's activities, but the product accesses this information using other resources besides itself, and it does not require that user's explicit approval or direct input into the product.
Near-miss passage: CWE-693 Protection Mechanism Failure. The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
Query: campaign using Content Injection
Matching passage: T1659 Content Injection. Tactics: initial access, command and control. Description: Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic. Rather than luring victims to malicious payloads hosted on a compromised website (i.e., [Drive-by Target](https://attack.mitre.org/techniques/T1608/004) followed by [Drive-by Compromise](https://attack.mitre.org/techniques/T1189)), adversaries may initially access victims through compromised data-transfer channels where they can manipulate traffic and/or inject their own content. These compromised online network channels may also be used to deliver additional payloads (i.e., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) and other data to already compromised systems.(Citation: ESET MoustachedBouncer) Adversaries may inject content to victim systems in various ways, including: * From the middle, where the adversary is in-between legitimate online client-server communications (**Note:** this is similar but distinct from [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557), which describes AiTM activity solely within an enterprise environment) (Citation: Kaspersky Encyclopedia MiTM) * From the side, where malicious content is injected and races to the client as a fake response to requests of a legitimate online server (Citation: Kaspersky ManOnTheSide) Content injection is often the result of compromised upstream communication channels, for example at the level of an internet service provider (ISP) as is the case with "lawful interception."(Citation: Kaspersky ManOnTheSide)(Citation: ESET MoustachedBouncer)(Citation: EFF China GitHub Attack)
Near-miss passage: T1573.002 Asymmetric Cryptography. Tactics: command and control. Description: Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private. Due to how the keys are generated, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key. This ensures that only the intended recipient can read the encrypted data. Common public key encryption algorithms include RSA and ElGamal. For efficiency, many protocols (including SSL/TLS) use symmetric cryptography once a connection is established, but use asymmetric cryptography to establish or transmit a key. As such, these protocols are classified as [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002).
Query: describe CVE-2015-2813
Matching passage: CVE-2015-2813. CWE: UNKNOWN. CVSS: 5.0. XML external entity (XXE) vulnerability in SAP Mobile Platform allows remote attackers to send requests to intranet servers via crafted XML, aka SAP Security Note 2125358.
Near-miss passage: CVE-2015-2975. CWE: UNKNOWN. CVSS: 5.0. Research Artisan Lite before 1.18 does not ensure that a user has authenticated, which allows remote attackers to perform unspecified actions via unknown vectors.
Query: risk of The SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to bypass authentication and read or write to arbitrary database fields via unspe
Matching passage: CVE-2015-0981. CWE: CWE-264. CVSS: 7.5. The SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to bypass authentication and read or write to arbitrary database fields via unspecified vectors.
Near-miss passage: CVE-2015-4211. CWE: CWE-264. CVSS: 7.199999809265137. Cisco AnyConnect Secure Mobility Client 3.1(60) on Windows does not properly validate pathnames, which allows local users to gain privileges via a crafted INF file, aka Bug ID CSCus65862.
Query: Sigma YAML for windows / ps_script
Matching passage: Sigma rule: Detects Obfuscated use of Clip.exe to execute PowerShell. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation CLIP+ Launcher - PowerShell id: 73e67340-0d25-11eb-adc1-0242ac120002 status: test description: Detects Obfuscated use of Clip.exe to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-13 modified: 2024-04-05 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_4104: ScriptBlockText|re: cmd.{0,5}(?:/c|/r).+clip(?:\.exe)?.{0,4}&&.+clipboard]::\(\s\\"\{\d\}.+-f.+" condition: selection_4104 falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.. Logsource: windows / process_creation. Rule: title: Potential Amazon SSM Agent Hijacking id: d20ee2f4-822c-4827-9e15-41500b1fff10 status: test description: Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report. references: - https://www.mitiga.io/blog/mitiga-security-advisory-abusing-the-ssm-agent-as-a-remote-access-trojan - https://www.bleepingcomputer.com/news/security/amazons-aws-ssm-agent-can-be-used-as-post-exploitation-rat-malware/ - https://www.helpnetsecurity.com/2023/08/02/aws-instances-attackers-access/ author: Muhammad Faisal date: 2023-08-02 tags: - attack.command-and-control - attack.persistence - attack.t1219.002 logsource: category: process_creation product: windows detection: selection: Image|endswith: \amazon-ssm-agent.exe CommandLine|contains|all: - '-register ' - '-code ' - '-id ' - '-region ' condition: selection falsepositives: - Legitimate activity of system administrators level: medium
Query: describe CVE-2015-4305
Matching passage: CVE-2015-4305. CWE: CWE-264. CVSS: 4.0. The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended system-database read restrictions, and discover credentials or SNMP communities for arbitrary tenant domains, via a crafted URL, aka Bug ID CSCus62656.
Near-miss passage: CVE-2015-5849. CWE: CWE-264. CVSS: 6.800000190734863. The filtering implementation in AppleEvents in Apple OS X before 10.11 mishandles attempts to send events to a different user, which allows attackers to bypass intended access restrictions by leveraging a screen-sharing connection.
Query: describe CVE-2015-4541
Matching passage: CVE-2015-4541. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA Archer GRC 5.x before 5.5.3 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-6506. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the cryptography interface in Request Tracker (RT) before 4.2.12 allows remote attackers to inject arbitrary web script or HTML via a crafted public key.
Query: CVE similar to CVE-2015-9058
Matching passage: CVE-2015-9058. CWE: CWE-601. CVSS: 6.099999904632568. Open redirect vulnerability in Proxmox Mail Gateway prior to hotfix 4.0-8-097d26a9 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the destination parameter.
Near-miss passage: CVE-2015-4070. CWE: CWE-601. CVSS: 6.099999904632568. Open redirect vulnerability in the proxyimages function in wowproxy.php in the Wow Moodboard Lite plugin 1.1.1.1 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.
Query: Sigma rule for Windows Defender logs when the history of detected infections is deleted.
Matching passage: Sigma rule: Windows Defender logs when the history of detected infections is deleted.. Logsource: windows / windefend. Rule: title: Windows Defender Malware Detection History Deletion id: 2afe6582-e149-11ea-87d0-0242ac130003 status: test description: Windows Defender logs when the history of detected infections is deleted. references: - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus - https://web.archive.org/web/20160727113019/https://answers.microsoft.com/en-us/protect/forum/mse-protect_scanning/microsoft-antimalware-has-removed-history-of/f15af6c9-01a9-4065-8c6c-3f2bdc7de45e author: Cian Heasley date: 2020-08-13 modified: 2023-11-24 tags: - attack.defense-impairment logsource: product: windows service: windefend detection: selection: EventID: 1013 condition: selection falsepositives: - Deletion of Defender malware detections history for legitimate reasons level: informational
Near-miss passage: Sigma rule: Detects execution of the "userdel" binary. Which is used to delete a user account and related files. This is sometimes a. Logsource: linux / process_creation. Rule: title: User Has Been Deleted Via Userdel id: 08f26069-6f80-474b-8d1f-d971c6fedea0 status: test description: Detects execution of the "userdel" binary. Which is used to delete a user account and related files. This is sometimes abused by threat actors in order to cover their tracks references: - https://linuxize.com/post/how-to-delete-group-in-linux/ - https://www.cyberciti.biz/faq/linux-remove-user-command/ - https://www.cybrary.it/blog/0p3n/linux-commands-used-attackers/ - https://linux.die.net/man/8/userdel author: Tuan Le (NCSGroup) date: 2022-12-26 tags: - attack.impact - attack.t1531 logsource: product: linux category: process_creation detection: selection: Image|endswith: /userdel condition: selection falsepositives: - Legitimate administrator activities level: medium
Query: risk of The default configuration of SGOS in Blue Coat ProxySG before 6.2.16.5, 6.5 before 6.5.7.1, and 6.6 before 6.6.2.1 forwards authentication challenges from upstream origin content s
Matching passage: CVE-2015-4334. CWE: CWE-200. CVSS: 5.0. The default configuration of SGOS in Blue Coat ProxySG before 6.2.16.5, 6.5 before 6.5.7.1, and 6.6 before 6.6.2.1 forwards authentication challenges from upstream origin content servers (OCS) when used in an explicit proxy deployment, which makes it easier for remote attackers to obtain sensitive information via a 407 (aka Proxy Authentication Required) HTTP status code, as demonstrated when using NTLM authentication.
Near-miss passage: CVE-2015-6052. CWE: CWE-200. CVSS: 4.300000190734863. The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, allow remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "VBScript and JScript ASLR Bypass."
Query: Multiple failed authentications followed by Exfiltration Over Web Service
Matching passage: T1567 Exfiltration Over Web Service. Tactics: exfiltration. Description: Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services. Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Near-miss passage: T1567.001 Exfiltration to Code Repository. Tactics: exfiltration. Description: Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel. Code repositories are often accessible via an API (ex: https://api.github.com). Access to these APIs are often over HTTPS, which gives the adversary an additional level of protection. Exfiltration to a code repository can also provide a significant amount of cover to the adversary if it is a popular service already used by hosts within the network.
Query: rule covering Detects file access requests to the Windows Credential History File by an uncommon application. This can be a sign of cr
Matching passage: Sigma rule: Detects file access requests to the Windows Credential History File by an uncommon application. This can be a sign of cr. Logsource: windows / file_access. Rule: title: Access To Windows Credential History File By Uncommon Applications id: 7a2a22ea-a203-4cd3-9abf-20eb1c5c6cd2 status: test description: 'Detects file access requests to the Windows Credential History File by an uncommon application. This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::credhist" function ' references: - https://tools.thehacker.recipes/mimikatz/modules/dpapi/credhist - https://www.passcape.com/windows_password_recovery_dpapi_credhist author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-17 modified: 2024-07-29 tags: - attack.credential-access - attack.t1555.004 logsource: category: file_access product: windows definition: 'Requirements: Microsoft-Windows-Kernel-File ETW provider' detection: selection: FileName|endswith: \Microsoft\Protect\CREDHIST filter_main_system_folders: Image|startswith: - C:\Program Files\ - C:\Program Files (x86)\ - C:\Windows\system32\ - C:\Windows\SysWOW64\ filter_main_explorer: Image: C:\Windows\explorer.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the execution of "Setup16.EXE" and old installation utility with a custom ".lst" file. These ".lst" file can con. Logsource: windows / process_creation. Rule: title: Setup16.EXE Execution With Custom .Lst File id: 99c8be4f-3087-4f9f-9c24-8c7e257b442e status: test description: 'Detects the execution of "Setup16.EXE" and old installation utility with a custom ".lst" file. These ".lst" file can contain references to external program that "Setup16.EXE" will execute. Attackers and adversaries might leverage this as a living of the land utility. ' references: - https://www.hexacorn.com/blog/2024/10/12/the-sweet16-the-oldbin-lolbin-called-setup16-exe/ author: frack113 date: 2024-12-01 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.005 logsource: category: process_creation product: windows detection: selection: ParentImage: C:\Windows\SysWOW64\setup16.exe ParentCommandLine|contains: ' -m ' filter_optional_valid_path: Image|startswith: C:\~MSSETUP.T\ condition: selection and not 1 of filter_optional_* falsepositives: - On modern Windows system, the "Setup16" utility is practically never used, hence false positive should be very rare. level: medium
Query: patch priority for CVE-2015-6621
Matching passage: CVE-2015-6621. CWE: CWE-264. CVSS: 9.300000190734863. SystemUI in Android 5.x before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 23909438.
Near-miss passage: CVE-2015-6620. CWE: CWE-264. CVSS: 9.300000190734863. libstagefright in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bugs 24123723 and 24445127.