alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Detects setting of a new registry database value related to BgInfo configuration. Attackers can for example set this val in logs
Matching passage: Sigma rule: Detects setting of a new registry database value related to BgInfo configuration. Attackers can for example set this val. Logsource: windows / registry_set. Rule: title: New BgInfo.EXE Custom DB Path Registry Configuration id: 53330955-dc52-487f-a3a2-da24dcff99b5 status: test description: Detects setting of a new registry database value related to BgInfo configuration. Attackers can for example set this value to save the results of the commands executed by BgInfo in order to exfiltrate information. references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-16 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Software\Winternals\BGInfo\Database condition: selection falsepositives: - Legitimate use of external DB to save the results level: medium
Near-miss passage: Sigma rule: Detects execution of "curl.exe" with the "-c" flag in order to save cookie data.. Logsource: windows / process_creation. Rule: title: Potential Cookies Session Hijacking id: 5a6e1e16-07de-48d8-8aae-faa766c05e88 status: test description: Detects execution of "curl.exe" with the "-c" flag in order to save cookie data. references: - https://curl.se/docs/manpage.html author: Nasreddine Bencherchali (Nextron Systems) date: 2023-07-27 tags: - attack.execution logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \curl.exe - OriginalFileName: curl.exe selection_cli: - CommandLine|re: \s-c\s - CommandLine|contains: --cookie-jar condition: all of selection_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_cookie_hijacking/info.yml
Query: Sigma rule for Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing.
Matching passage: Sigma rule: Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing.. Logsource: windows / process_creation. Rule: title: SQLite Chromium Profile Data DB Access id: 24c77512-782b-448a-8950-eddb0785fc71 status: test description: Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing. references: - https://github.com/redcanaryco/atomic-red-team/blob/84d9edaaaa2c5511144521b0e4af726d1c7276ce/atomics/T1539/T1539.md#atomic-test-2---steal-chrome-cookies-windows - https://blog.cyble.com/2022/04/21/prynt-stealer-a-new-info-stealer-performing-clipper-and-keylogger-activities/ author: TropChaud date: 2022-12-19 modified: 2023-01-19 tags: - attack.credential-access - attack.t1539 - attack.t1555.003 - attack.collection - attack.t1005 logsource: category: process_creation product: windows detection: selection_sql: - Product: SQLite - Image|endswith: - \sqlite.exe - \sqlite3.exe selection_chromium: CommandLine|contains: - \User Data\ - \Opera Software\ - \ChromiumViewer\ selection_data: CommandLine|contains: - Login Data - Cookies - Web Data - History - Bookmarks condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: It is extremely abnormal for svchost.exe to spawn without any CLI arguments and is normally observed when a malicious pr. Logsource: windows / process_creation. Rule: title: Suspect Svchost Activity id: 16c37b52-b141-42a5-a3ea-bbe098444397 status: test description: It is extremely abnormal for svchost.exe to spawn without any CLI arguments and is normally observed when a malicious process spawns the process and injects code into the process memory space. references: - https://web.archive.org/web/20180718061628/https://securitybytes.io/blue-team-fundamentals-part-two-windows-processes-759fe15965e2 author: David Burkett, @signalblur date: 2019-12-28 modified: 2022-06-27 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: category: process_creation product: windows detection: selection: CommandLine|endswith: svchost.exe Image|endswith: \svchost.exe filter: - ParentImage|endswith: - \rpcnet.exe - \rpcnetp.exe - CommandLine: null condition: selection and not filter falsepositives: - Rpcnet.exe / rpcnetp.exe which is a lojack style software. https://www.blackhat.com/docs/us-14/materials/us-14-Kamlyuk-Kamluk-Computrace-Backdoor-Revisited.pdf level: high
Query: Sigma rule for Ntvdm.exe allows the execution of 16-bit Windows applications on 32-bit Windows operating systems, as well as the execut
Matching passage: Sigma rule: Ntvdm.exe allows the execution of 16-bit Windows applications on 32-bit Windows operating systems, as well as the execut. Logsource: windows / process_creation. Rule: title: Start of NT Virtual DOS Machine id: 16905e21-66ee-42fe-b256-1318ada2d770 status: test description: Ntvdm.exe allows the execution of 16-bit Windows applications on 32-bit Windows operating systems, as well as the execution of both 16-bit and 32-bit DOS applications references: - https://learn.microsoft.com/en-us/windows/compatibility/ntvdm-and-16-bit-app-support - https://support.microsoft.com/fr-fr/topic/an-ms-dos-based-program-that-uses-the-ms-dos-protected-mode-interface-crashes-on-a-computer-that-is-running-windows-7-5dc739ea-987b-b458-15e4-d28d5cca63c7 - https://app.any.run/tasks/93fe92fa-8b2b-4d92-8c09-a841aed2e793/ - https://app.any.run/tasks/214094a7-0abc-4a7b-a564-1b757faed79d/ author: frack113 date: 2022-07-16 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: Image|endswith: - \ntvdm.exe - \csrstub.exe condition: selection falsepositives: - Legitimate use level: medium
Near-miss passage: Sigma rule: Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon parent process or directory. Logsource: windows / file_event. Rule: title: NTDS.DIT Creation By Uncommon Parent Process id: 4e7050dd-e548-483f-b7d6-527ab4fa784d related: - id: 11b1ed55-154d-4e82-8ad7-83739298f720 type: similar status: test description: Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon parent process or directory references: - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration - https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/ - https://pentestlab.blog/tag/ntds-dit/ - https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Gather/Copy-VSS.ps1 author: Florian Roth (Nextron Systems) date: 2022-03-11 modified: 2023-01-05 tags: - attack.credential-access - attack.t1003.003 logsource: product: windows category: file_event definition: 'Requirements: The "ParentImage" field is not available by default on EID 11 of Sysmon logs. To be able to use this rule to the full extent you need to enrich the log with additional ParentImage data' detection: selection_file: TargetFilename|endswith: \ntds.dit selection_process_parent: ParentImage|endswith: - \cscript.exe - \httpd.exe - \nginx.exe - \php-cgi.exe - \powershell.exe - \pwsh.exe - \w3wp.exe - \wscript.exe selection_process_parent_path: ParentImage|contains: - \apache - \tomcat - \AppData\ - \Temp\ - \Public\ - \PerfLogs\ condition: selection_file and 1 of selection_process_* falsepositives: - Unknown level: high
Query: exploit Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecifi
Matching passage: CVE-2015-1953. CWE: CWE-119. CVSS: 7.800000190734863. Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1925, CVE-2015-1929, CVE-2015-1930, CVE-2015-1948, CVE-2015-1954, CVE-2015-1962, CVE-2015-1963, CVE-2015-1964, and CVE-2015-1965.
Near-miss passage: CVE-2015-3662. CWE: CWE-119. CVSS: 6.800000190734863. QT Media Foundation in Apple QuickTime before 7.7.7, as used in OS X before 10.10.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, a different vulnerability than CVE-2015-3661, CVE-2015-3663, CVE-2015-3666, CVE-2015-3667, and CVE-2015-3668.
Query: exploit The kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Serve
Matching passage: CVE-2015-1721. CWE: CWE-476. CVSS: 7.199999809265137. The kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via a crafted application, aka "Win32k Null Pointer Dereference Vulnerability."
Near-miss passage: CVE-2015-4047. CWE: CWE-476. CVSS: 7.800000190734863. racoon/gssapi.c in IPsec-Tools 0.8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) via a series of crafted UDP requests.
Query: Sigma YAML for windows / ps_script
Matching passage: Sigma rule: Detects modification of dMSA link attributes (msDS-ManagedAccountPrecededByLink) via PowerShell scripts. This command li. Logsource: windows / ps_script. Rule: title: DMSA Link Attributes Modified id: 9b111d8e-92e0-4153-88bc-daefc1333aba related: - id: 6c9eb492-e477-4df9-b0f4-571fc9db29cd type: similar status: experimental description: 'Detects modification of dMSA link attributes (msDS-ManagedAccountPrecededByLink) via PowerShell scripts. This command line pattern could be an indicator an attempt to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025. ' references: - https://www.akamai.com/blog/security-research/abusing-bad-successor-for-privilege-escalation-in-active-directory author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-05-24 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078.002 - attack.t1098 logsource: category: ps_script product: windows detection: selection: ScriptBlockText|contains|all: - .Put("msDS-ManagedAccountPrecededByLink - CN= condition: selection falsepositives: - Legitimate administrative tasks modifying these attributes. level: low
Near-miss passage: Sigma rule: Detects the installation of VsCode tunnel (code-tunnel) as a service.. Logsource: windows / process_creation. Rule: title: Visual Studio Code Tunnel Service Installation id: 30bf1789-379d-4fdc-900f-55cd0a90a801 status: test description: Detects the installation of VsCode tunnel (code-tunnel) as a service. references: - https://ipfyx.fr/post/visual-studio-code-tunnel/ - https://badoption.eu/blog/2023/01/31/code_c2.html - https://code.visualstudio.com/docs/remote/tunnels author: Nasreddine Bencherchali (Nextron Systems) date: 2023-10-25 tags: - attack.command-and-control - attack.t1071.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - 'tunnel ' - service - internal-run - tunnel-service.log condition: selection falsepositives: - Legitimate installation of code-tunnel as a service level: medium
Query: patch priority for CVE-2015-8564
Matching passage: CVE-2015-8564. CWE: CWE-20. CVSS: 7.5. Directory traversal vulnerability in Joomla! 3.4.x before 3.4.6 allows remote attackers to have unspecified impact via directory traversal sequences in the XML install file in an extension package archive.
Near-miss passage: CVE-2015-0649. CWE: CWE-20. CVSS: 7.800000190734863. Cisco IOS 12.2, 12.4, 15.0, 15.2, and 15.3 allows remote attackers to cause a denial of service (device reload) via malformed Common Industrial Protocol (CIP) TCP packets, aka Bug ID CSCun63514.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects scheduled task creation using "schtasks" that contain potentially suspicious or uncommon commands. Logsource: windows / process_creation. Rule: title: Suspicious Command Patterns In Scheduled Task Creation id: f2c64357-b1d2-41b7-849f-34d2682c0fad status: test description: Detects scheduled task creation using "schtasks" that contain potentially suspicious or uncommon commands references: - https://app.any.run/tasks/512c1352-6380-4436-b27d-bb62f0c020d6/ - https://twitter.com/RedDrip7/status/1506480588827467785 - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/devil-bait/NCSC-MAR-Devil-Bait.pdf author: Florian Roth (Nextron Systems) date: 2022-02-23 modified: 2024-03-19 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1053.005 logsource: product: windows category: process_creation detection: selection_schtasks: Image|endswith: \schtasks.exe CommandLine|contains: '/Create ' selection_pattern_1: CommandLine|contains: - '/sc minute ' - '/ru system ' selection_pattern_2: CommandLine|contains: - cmd /c - cmd /k - cmd /r - 'cmd.exe /c ' - 'cmd.exe /k ' - 'cmd.exe /r ' selection_uncommon: CommandLine|contains: - ' -decode ' - ' -enc ' - ' -w hidden ' - ' bypass ' - ' IEX' - .DownloadData - .DownloadFile - .DownloadString - '/c start /min ' - FromBase64String - mshta http - mshta.exe http selection_anomaly_1: CommandLine|contains: - :\ProgramData\ - :\Temp\ - :\Tmp\ - :\Users\Public\ - :\Windows\Temp\ - \AppData\ - '%AppData%' - '%Temp%' - '%tmp%' selection_anomaly_2: CommandLine|contains: - cscript - curl - wscript condition: selection_schtasks and ( all of selection_pattern_* or selection_uncommon or all of selection_anomaly_* ) falsepositives: - Software installers that run from temporary folders and also install scheduled tasks are expected to generate some false positives level: high
Near-miss passage: Sigma rule: Detects changes to of the IIS server configuration in order to disable/remove the ETW logging/processing option.. Logsource: windows / iis-configuration. Rule: title: ETW Logging/Processing Option Disabled On IIS Server id: a5b40a90-baf5-4bf7-a6f7-373494881d22 status: test description: Detects changes to of the IIS server configuration in order to disable/remove the ETW logging/processing option. references: - https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/ - https://learn.microsoft.com/en-us/iis/configuration/system.applicationhost/sites/sitedefaults/logfile/ author: frack113, Nasreddine Bencherchali date: 2024-10-06 tags: - attack.persistence - attack.defense-impairment - attack.t1685.001 - attack.t1505.004 logsource: product: windows service: iis-configuration detection: selection: EventID: 29 Configuration|endswith: '@logTargetW3C' OldValue|contains: ETW filter_main_etw_added: NewValue|contains: ETW condition: selection and not 1 of filter_main_* falsepositives: - Legitimate administrator activity level: medium
Query: vulnerability: Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; Java SE Embedded 7u75; and Java SE Embedded 8u33 allows remote attackers to affect confidentiality, integrity, and
Matching passage: CVE-2015-4731. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; Java SE Embedded 7u75; and Java SE Embedded 8u33 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.
Near-miss passage: CVE-2015-8746. CWE: UNKNOWN. CVSS: 7.5. fs/nfs/nfs4proc.c in the NFS client in the Linux kernel before 4.2.2 does not properly initialize memory for migration recovery operations, which allows remote NFS servers to cause a denial of service (NULL pointer dereference and panic) via crafted network traffic.
Query: describe CVE-2015-6540
Matching passage: CVE-2015-6540. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Intellect Design Arena Intellect Core banking software.
Near-miss passage: CVE-2015-5460. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in app/views/events/_menu.html.erb in Snorby 2.6.2 allows remote attackers to inject arbitrary web script or HTML via the title (cls.name variable) when creating a classification.
Query: secure coding against Password in Configuration File
Matching passage: CWE-260 Password in Configuration File. The product stores a password in a configuration file that might be accessible to actors who do not know the password.
Near-miss passage: CWE-611 Improper Restriction of XML External Entity Reference. The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Query: exploit NetApp Data ONTAP before 8.2.4P1, when 7-Mode and HTTP access are enabled, allows remote attackers to obtain sensitive volume information via unspecified vectors.
Matching passage: CVE-2015-7886. CWE: CWE-200. CVSS: 3.700000047683716. NetApp Data ONTAP before 8.2.4P1, when 7-Mode and HTTP access are enabled, allows remote attackers to obtain sensitive volume information via unspecified vectors.
Near-miss passage: CVE-2015-8553. CWE: CWE-200. CVSS: 6.5. Xen allows guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory by not enabling memory and I/O decoding control bits. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0777.
Query: risk of The login page of the server on Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with software before V100R003C00SPC503, XH628 V3 with 
Matching passage: CVE-2015-7841. CWE: CWE-77. CVSS: 9.800000190734863. The login page of the server on Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with software before V100R003C00SPC503, XH628 V3 with software before V100R003C00SPC602, RH1288 V3 with software before V100R003C00SPC602, RH2288A V2 with software before V100R002C00SPC701, RH1288A V2 with software before V100R002C00SPC502, RH8100 V3 with software before V100R003C00SPC110, CH222 V3 with software before V100R001C00SPC161, CH220 V3 with software before V100R001C00SPC161, and CH121 V3 with software before V100R001C00SPC161 allows remote attackers to bypass access restrictions and enter commands via unspecified parameters, as demonstrated by a "user creation command."
Near-miss passage: CVE-2015-5474. CWE: CWE-77. CVSS: 9.300000190734863. BitTorrent and uTorrent allow remote attackers to inject command line parameters and execute arbitrary commands via a crafted URL using the (1) bittorrent or (2) magnet protocol.
Query: weakness Improper Neutralization of Line Delimiters
Matching passage: CWE-144 Improper Neutralization of Line Delimiters. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as line delimiters when they are sent to a downstream component.
Near-miss passage: CWE-1232 Improper Lock Behavior After Power State Transition. Register lock bit protection disables changes to system configuration once the bit is set. Some of the protected registers or lock bits become programmable after power state transitions (e.g., Entry and wake from low power sleep modes) causing the system configuration to be changeable.
Query: patch priority for CVE-2015-4883
Matching passage: CVE-2015-4883. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI, a different vulnerability than CVE-2015-4860.
Near-miss passage: CVE-2015-6388. CWE: UNKNOWN. CVSS: 5.0. Cisco Unified Computing System (UCS) Central software 1.3(0.1) allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted request, aka Bug ID CSCux33575.
Query: describe CVE-2015-7755
Matching passage: CVE-2015-7755. CWE: CWE-287. CVSS: 9.800000190734863. Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before 6.3.0r15b, 6.3.0r16 before 6.3.0r16b, 6.3.0r17 before 6.3.0r17b, 6.3.0r18 before 6.3.0r18b, 6.3.0r19 before 6.3.0r19b, and 6.3.0r20 before 6.3.0r21 allows remote attackers to obtain administrative access by entering an unspecified password during a (1) SSH or (2) TELNET session.
Near-miss passage: CVE-2015-3457. CWE: CWE-287. CVSS: 5.0. Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote attackers to bypass authentication via the forwarded parameter.
Query: exploit The MediaElementAudioSourceNode::process function in modules/webaudio/MediaElementAudioSourceNode.cpp in the Web Audio API implementation in Blink, as used in Google Chrome before 
Matching passage: CVE-2015-1236. CWE: CWE-264. CVSS: 4.300000190734863. The MediaElementAudioSourceNode::process function in modules/webaudio/MediaElementAudioSourceNode.cpp in the Web Audio API implementation in Blink, as used in Google Chrome before 42.0.2311.90, allows remote attackers to bypass the Same Origin Policy and obtain sensitive audio sample values via a crafted web site containing a media element.
Near-miss passage: CVE-2015-8939. CWE: CWE-264. CVSS: 7.800000190734863. drivers/video/msm/mdp4_util.c in the Qualcomm components in Android before 2016-08-05 on Nexus 7 (2013) devices does not validate r stages, g stages, or b stages data, which allows attackers to gain privileges via a crafted application, aka Android internal bug 28398884 and Qualcomm internal bug CR779021.