alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Generic rule for SQL exceptions in Python according to PEP 249
Matching passage: Sigma rule: Generic rule for SQL exceptions in Python according to PEP 249. Logsource: python / application. Rule: title: Python SQL Exceptions id: 19aefed0-ffd4-47dc-a7fc-f8b1425e84f9 status: stable description: Generic rule for SQL exceptions in Python according to PEP 249 references: - https://www.python.org/dev/peps/pep-0249/#exceptions author: Thomas Patzke date: 2017-08-12 modified: 2020-09-01 tags: - attack.initial-access - attack.t1190 logsource: category: application product: python detection: keywords: - DataError - IntegrityError - ProgrammingError - OperationalError condition: keywords falsepositives: - Application bugs level: medium
Near-miss passage: Sigma rule: Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location. Logsource: windows / image_load. Rule: title: Microsoft Office DLL Sideload id: 829a3bdf-34da-4051-9cf4-8ed221a8ae4f status: test description: Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location references: - https://hijacklibs.net/ author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research) date: 2022-08-17 modified: 2023-03-15 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \outllib.dll filter: ImageLoaded|startswith: - C:\Program Files\Microsoft Office\OFFICE - C:\Program Files (x86)\Microsoft Office\OFFICE - C:\Program Files\Microsoft Office\Root\OFFICE - C:\Program Files (x86)\Microsoft Office\Root\OFFICE condition: selection and not filter falsepositives: - Unlikely level: high
Query: risk of CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 rely on a polyalphabetic substitution cipher with hardcoded keys, which makes it easier for remote attackers to de
Matching passage: CVE-2015-7286. CWE: CWE-310. CVSS: 6.400000095367432. CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 rely on a polyalphabetic substitution cipher with hardcoded keys, which makes it easier for remote attackers to defeat a cryptographic protection mechanism by capturing IP or V.22bis PSTN protocol traffic.
Near-miss passage: CVE-2015-8329. CWE: CWE-310. CVSS: 5.0. SAP Manufacturing Integration and Intelligence (aka MII, formerly xMII) uses weak encryption (Base64 and DES), which allows attackers to conduct downgrade attacks and decrypt passwords via unspecified vectors, aka SAP Security Note 2240274.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Execute Hashcat.exe with provided SAM file from registry of Windows and Password list to crack against. Logsource: windows / process_creation. Rule: title: HackTool - Hashcat Password Cracker Execution id: 39b31e81-5f5f-4898-9c0e-2160cfc0f9bf status: test description: Execute Hashcat.exe with provided SAM file from registry of Windows and Password list to crack against references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1110.002/T1110.002.md#atomic-test-1---password-cracking-with-hashcat - https://hashcat.net/wiki/doku.php?id=hashcat author: frack113 date: 2021-12-27 modified: 2023-02-04 tags: - attack.credential-access - attack.t1110.002 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \hashcat.exe selection_cli: CommandLine|contains|all: - '-a ' - '-m 1000 ' - '-r ' condition: 1 of selection_* falsepositives: - Tools that use similar command line flags and values level: high
Near-miss passage: Sigma rule: Detects successful installation of Atera Remote Monitoring & Management (RMM) agent as recently found to be used by Cont. Logsource: windows / application. Rule: title: Atera Agent Installation id: 87261fb2-69d0-42fe-b9de-88c6b5f65a43 status: test description: Detects successful installation of Atera Remote Monitoring & Management (RMM) agent as recently found to be used by Conti operators references: - https://www.advintel.io/post/secret-backdoor-behind-conti-ransomware-operation-introducing-atera-agent author: Bhabesh Raj date: 2021-09-01 modified: 2022-12-25 tags: - attack.command-and-control - attack.t1219.002 logsource: service: application product: windows detection: selection: EventID: 1033 Provider_Name: MsiInstaller Message|contains: AteraAgent condition: selection falsepositives: - Legitimate Atera agent installation level: high
Query: patch priority for CVE-2015-2586
Matching passage: CVE-2015-2586. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Application Express component in Oracle Database Server before 4.2.1 allows remote attackers to affect availability via unknown vectors.
Near-miss passage: CVE-2015-3272. CWE: UNKNOWN. CVSS: 7.400000095367432. Open redirect vulnerability in the clean_param function in lib/moodlelib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving an HTTP Referer header that has a substring match with a local URL.
Query: vulnerability: Cross-site request forgery (CSRF) vulnerability in the All In One WP Security & Firewall plugin before 3.9.0 for WordPress allows remote attackers to hijack the authentication of a
Matching passage: CVE-2015-0895. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the All In One WP Security & Firewall plugin before 3.9.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete logs of 404 (aka Not Found) HTTP status codes.
Near-miss passage: CVE-2015-9432. CWE: CWE-352. CVSS: 6.5. The alpine-photo-tile-for-instagram plugin before 1.2.7.6 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=alpine-photo-tile-for-instagram-settings tab parameter.
Query: patch priority for CVE-2015-0103
Matching passage: CVE-2015-0103. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in the Process Portal in IBM Business Process Manager (BPM) 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 allow remote authenticated users to inject arbitrary web script or HTML via unspecified data fields.
Near-miss passage: CVE-2015-1879. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Google Doc Embedder plugin before 2.5.19 for WordPress allows remote attackers to inject arbitrary web script or HTML via the profile parameter in an edit action in the gde-settings page to wp-admin/options-general.php.
Query: alert when Detects PowerShell module creation where the module Contents are set to "function Get-VMRemoteFXPhysicalVideoAdapter". T
Matching passage: Sigma rule: Detects PowerShell module creation where the module Contents are set to "function Get-VMRemoteFXPhysicalVideoAdapter". T. Logsource: windows / ps_script. Rule: title: Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell ScriptBlock id: cacef8fc-9d3d-41f7-956d-455c6e881bc5 related: - id: a6fc3c46-23b8-4996-9ea2-573f4c4d88c5 type: similar - id: f65e22f9-819e-4f96-9c7b-498364ae7a25 type: similar - id: 38a7625e-b2cb-485d-b83d-aff137d859f4 type: similar status: test description: Detects PowerShell module creation where the module Contents are set to "function Get-VMRemoteFXPhysicalVideoAdapter". This could be a sign of potential abuse of the "RemoteFXvGPUDisablement.exe" binary which is known to be vulnerable to module load-order hijacking. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md - https://github.com/redcanaryco/AtomicTestHarnesses/blob/7e1e4da116801e3d6fcc6bedb207064577e40572/TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.ps1 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-09 tags: - attack.stealth - attack.t1218 logsource: product: windows category: ps_script definition: bade5735-5ab0-4aa7-a642-a11be0e40872 detection: selection: ScriptBlockText|startswith: function Get-VMRemoteFXPhysicalVideoAdapter { condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.. Logsource: linux / auditd. Rule: title: System Shutdown/Reboot - Linux id: 4cb57c2f-1f29-41f8-893d-8bed8e1c1d2f status: test description: Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1529/T1529.md author: Igor Fits, oscd.community date: 2020-10-15 modified: 2022-11-26 tags: - attack.impact - attack.t1529 logsource: product: linux service: auditd detection: execve: type: EXECVE shutdowncmd: - shutdown - reboot - halt - poweroff init: - init - telinit initselection: - 0 - 6 condition: execve and (shutdowncmd or (init and initselection)) falsepositives: - Legitimate administrative activity level: informational
Query: risk of The nsUnicodeToUTF8::GetMaxLength function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corrupt
Matching passage: CVE-2015-4522. CWE: CWE-119. CVSS: 7.5. The nsUnicodeToUTF8::GetMaxLength function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors, related to an "overflow."
Near-miss passage: CVE-2015-9176. CWE: CWE-119. CVSS: 7.5. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, Input_address is registered as a shared buffer and is not properly checked before use in OEMCrypto_Generic_Sign(). This allows addresses to be accessed that reside in secure/CP memory.
Query: rule covering Detects AWS API key creation for a user by another user. Backdoored users can be used to obtain persistence in the AWS e
Matching passage: Sigma rule: Detects AWS API key creation for a user by another user. Backdoored users can be used to obtain persistence in the AWS e. Logsource: aws / cloudtrail. Rule: title: AWS IAM Backdoor Users Keys id: 0a5177f4-6ca9-44c2-aacf-d3f3d8b6e4d2 status: test description: 'Detects AWS API key creation for a user by another user. Backdoored users can be used to obtain persistence in the AWS environment. Also with this alert, you can detect a flow of AWS keys in your org. ' references: - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/iam__backdoor_users_keys/main.py author: faloker date: 2020-02-12 modified: 2022-10-09 tags: - attack.persistence - attack.privilege-escalation - attack.t1098 logsource: product: aws service: cloudtrail detection: selection_source: eventSource: iam.amazonaws.com eventName: CreateAccessKey filter: userIdentity.arn|contains: responseElements.accessKey.userName condition: selection_source and not filter falsepositives: - Adding user keys to their own accounts (the filter cannot cover all possible variants of user naming) - AWS API keys legitimate exchange workflows level: medium
Near-miss passage: Sigma rule: Detects potential DLL sideloading using ClassicExplorer32.dll from the Classic Shell software. Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Via ClassicExplorer32.dll id: caa02837-f659-466f-bca6-48bde2826ab4 status: test description: Detects potential DLL sideloading using ClassicExplorer32.dll from the Classic Shell software references: - https://blogs.blackberry.com/en/2022/12/mustang-panda-uses-the-russian-ukrainian-war-to-attack-europe-and-asia-pacific-targets - https://app.any.run/tasks/6d8cabb0-dcda-44b6-8050-28d6ce281687/ author: frack113 date: 2022-12-13 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection_classicexplorer: ImageLoaded|endswith: \ClassicExplorer32.dll filter_classicexplorer: ImageLoaded|startswith: C:\Program Files\Classic Shell\ condition: selection_classicexplorer and not filter_classicexplorer falsepositives: - Unknown level: medium
Query: detect Detects powershell scripts that adds a Name Resolution Policy Table (NRPT) rule for the specified namespace. This will b in logs
Matching passage: Sigma rule: Detects powershell scripts that adds a Name Resolution Policy Table (NRPT) rule for the specified namespace. This will b. Logsource: windows / ps_script. Rule: title: Powershell Add Name Resolution Policy Table Rule id: 4368354e-1797-463c-bc39-a309effbe8d7 status: test description: 'Detects powershell scripts that adds a Name Resolution Policy Table (NRPT) rule for the specified namespace. This will bypass the default DNS server and uses a specified server for answering the query. ' references: - https://twitter.com/NathanMcNulty/status/1569497348841287681 - https://learn.microsoft.com/en-us/powershell/module/dnsclient/add-dnsclientnrptrule?view=windowsserver2022-ps author: Borna Talebi date: 2021-09-14 modified: 2022-10-09 tags: - attack.impact - attack.t1565 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - Add-DnsClientNrptRule - -Namesp - -NameSe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the use of "ioreg" which will show I/O Kit registry information. This process is used for system information dis. Logsource: macos / process_creation. Rule: title: System Information Discovery Using Ioreg id: 2d5e7a8b-f484-4a24-945d-7f0efd52eab0 status: test description: 'Detects the use of "ioreg" which will show I/O Kit registry information. This process is used for system information discovery. It has been observed in-the-wild by calling this process directly or using bash and grep to look for specific strings. ' references: - https://www.virustotal.com/gui/file/0373d78db6c3c0f6f6dcc409821bf89e1ad8c165d6f95c5c80ecdce2219627d7/behavior - https://www.virustotal.com/gui/file/4ffdc72d1ff1ee8228e31691020fc275afd1baee5a985403a71ca8c7bd36e2e4/behavior - https://www.virustotal.com/gui/file/5907d59ec1303cfb5c0a0f4aaca3efc0830707d86c732ba6b9e842b5730b95dc/behavior - https://www.trendmicro.com/en_ph/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-12-20 modified: 2024-01-02 tags: - attack.discovery - attack.t1082 logsource: product: macos category: process_creation detection: selection_img: - Image|endswith: /ioreg - CommandLine|contains: ioreg selection_cmd1: CommandLine|contains: - -l - -c selection_cmd2: CommandLine|contains: - AppleAHCIDiskDriver - IOPlatformExpertDevice - Oracle - Parallels - USB Vendor Name - VirtualBox - VMware condition: all of selection_* falsepositives: - Legitimate administrative activities level: medium
Query: risk of Cisco Unified Communications Manager 10.0(1.10000.12) allows local users to gain privileges via a command string in an unspecified parameter, aka Bug ID CSCut19546.
Matching passage: CVE-2015-0717. CWE: CWE-20. CVSS: 6.900000095367432. Cisco Unified Communications Manager 10.0(1.10000.12) allows local users to gain privileges via a command string in an unspecified parameter, aka Bug ID CSCut19546.
Near-miss passage: CVE-2015-0658. CWE: CWE-20. CVSS: 7.900000095367432. The DHCP implementation in the PowerOn Auto Provisioning (POAP) feature in Cisco NX-OS does not properly restrict the initialization process, which allows remote attackers to execute arbitrary commands as root by sending crafted response packets on the local network, aka Bug ID CSCur14589.
Query: Sigma YAML for windows / security
Matching passage: Sigma rule: Detects a threat actor creating a file named `iertutil.dll` in the `C:\Program Files\Internet Explorer\` directory over. Logsource: windows / security. Rule: title: DCOM InternetExplorer.Application Iertutil DLL Hijack - Security id: c39f0c81-7348-4965-ab27-2fde35a1b641 status: test description: Detects a threat actor creating a file named `iertutil.dll` in the `C:\Program Files\Internet Explorer\` directory over the network for a DCOM InternetExplorer DLL Hijack scenario. references: - https://threathunterplaybook.com/hunts/windows/201009-RemoteDCOMIErtUtilDLLHijack/notebook.html author: Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR) date: 2020-10-12 modified: 2022-11-26 tags: - attack.lateral-movement - attack.t1021.002 - attack.t1021.003 logsource: product: windows service: security detection: selection: EventID: 5145 RelativeTargetName|endswith: \Internet Explorer\iertutil.dll filter: SubjectUserName|endswith: $ condition: selection and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects tampering of AMSI (Anti-Malware Scan Interface) related registry values via command line tools such as reg.exe o. Logsource: windows / process_creation. Rule: title: Windows AMSI Related Registry Tampering Via CommandLine id: 7dbbcac2-57a0-45ac-b306-ff30a8bd2981 related: - id: aa37cbb0-da36-42cb-a90f-fdf216fc7467 type: similar status: experimental description: 'Detects tampering of AMSI (Anti-Malware Scan Interface) related registry values via command line tools such as reg.exe or PowerShell. AMSI provides a generic interface for applications and services to integrate with antimalware products. Adversaries may disable AMSI to evade detection of malicious scripts and code execution. ' references: - https://github.com/arttoolkit/arttoolkit.github.io/blob/16d6230d009e58fd6f773f5317fd4d14c1f26004/_wadcoms/AMSI-Bypass-Jscript_amsienable.md - https://mostafayahiax.medium.com/hunting-for-amsi-bypassing-methods-9886dda0bf9d - https://www.mdsec.co.uk/2019/02/macros-and-more-with-sharpshooter-v2-0/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-12-25 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_key: CommandLine|contains|all: - \Software\Microsoft\Windows Script\Settings - AmsiEnable selection_reg_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_reg_cmd: CommandLine|contains: add selection_powershell_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_powershell_cmd: CommandLine|contains: - Set-ItemProperty - New-ItemProperty - 'sp ' condition: selection_key and (all of selection_powershell_* or all of selection_reg_*) falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_amsi_registry_tampering/info.yml simulation: - type: atomic-red-team name: AMSI Bypass - Create AMSIEnable Reg Key technique: T1562.001 atomic_guid: 728eca7b-0444-4f6f-ac36-437e3d751dc0
Query: vulnerability: Unspecified vulnerability in Apache Qpid 0.30 and earlier allows remote attackers to bypass access restrictions on qpidd via unknown vectors, related to 0-10 connection handling.
Matching passage: CVE-2015-0223. CWE: CWE-264. CVSS: 5.0. Unspecified vulnerability in Apache Qpid 0.30 and earlier allows remote attackers to bypass access restrictions on qpidd via unknown vectors, related to 0-10 connection handling.
Near-miss passage: CVE-2015-6607. CWE: CWE-264. CVSS: 6.800000190734863. SQLite before 3.8.9, as used in Android before 5.1.1 LMY48T, allows attackers to gain privileges via a crafted application, aka internal bug 20099586.
Query: exploit In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9625, MDM9635M, MSM8909W, SD 210/SD 212
Matching passage: CVE-2015-9157. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9625, MDM9635M, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 600, SD 615/16/SD 415, SD 617, SD 650/52, SD 800, SD 808, and SD 810, in widevine_dash_cmd_handler(), rsp buffers are passed off to widevine commands. These rsp buffers have values in them, such as buffer lengths, that need to be validated to ensure that no buffer overflow/over-reads happen. However, rsp buffers are not always in locked memory, meaning a time-of-check, time-of-use issue can occur where we check that the value is valid, but then a race condition occurs where this memory is swapped out with a different, possibly out of range, value.
Near-miss passage: CVE-2015-8779. CWE: CWE-119. CVSS: 9.800000190734863. Stack-based buffer overflow in the catopen function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long catalog name.
Query: SIEM correlation: stealth activity consistent with MSBuild
Matching passage: T1127.001 MSBuild. Tactics: stealth, execution. Description: Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio. It handles XML formatted project files that define requirements for loading and building various platforms and configurations.(Citation: MSDN MSBuild) Adversaries can abuse MSBuild to proxy execution of malicious code. The inline task capability of MSBuild that was introduced in .NET version 4 allows for C# or Visual Basic code to be inserted into an XML project file.(Citation: MSDN MSBuild)(Citation: Microsoft MSBuild Inline Tasks 2017) MSBuild will compile and execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is used this way it can execute arbitrary code and bypass application control defenses that are configured to allow MSBuild.exe execution.(Citation: LOLBAS Msbuild)
Near-miss passage: T1127.003 JamPlus. Tactics: stealth, execution. Description: Adversaries may use `JamPlus` to proxy the execution of a malicious script. `JamPlus` is a build utility tool for code and data build systems. It works with several popular compilers and can be used for generating workspaces in code editors such as Visual Studio.(Citation: JamPlus manual) Adversaries may abuse the `JamPlus` build utility to execute malicious scripts via a `.jam` file, which describes the build process and required dependencies. Because the malicious script is executed from a reputable developer tool, it may subvert application control security systems such as Smart App Control.(Citation: Cyble)(Citation: Elastic Security Labs)