alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Detects attempts to disable windows recovery environment using Reagentc. ReAgentc.exe is a command-line tool in Windows
Matching passage: Sigma rule: Detects attempts to disable windows recovery environment using Reagentc. ReAgentc.exe is a command-line tool in Windows. Logsource: windows / process_creation. Rule: title: Windows Recovery Environment Disabled Via Reagentc id: db1c21e4-cd66-4b4e-85ca-590f0780529c status: experimental description: 'Detects attempts to disable windows recovery environment using Reagentc. ReAgentc.exe is a command-line tool in Windows used to manage the Windows Recovery Environment (WinRE). It allows users to enable, disable, and configure WinRE, which is used for troubleshooting and repairing common boot issues. ' references: - https://www.elastic.co/security-labs/maas-appeal-an-infostealer-rises-from-the-ashes - https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/reagentc-command-line-options?view=windows-11 author: Daniel Koifman (KoifSec), Michael Vilshin date: 2025-07-31 tags: - attack.impact - attack.t1490 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \reagentc.exe - OriginalFileName: reagentc.exe selection_cli: CommandLine|contains|windash: /disable condition: all of selection_* falsepositives: - Legitimate administrative activity level: medium
Near-miss passage: Sigma rule: Detects instances where an SMB service on an OpenCanary node has had a file open request.. Logsource: opencanary / application. Rule: title: OpenCanary - SMB File Open Request id: 22777c9e-873a-4b49-855f-6072ab861a52 status: test description: Detects instances where an SMB service on an OpenCanary node has had a file open request. references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.lateral-movement - attack.collection - attack.t1021 - attack.t1005 logsource: category: application product: opencanary detection: selection: logtype: 5000 condition: selection falsepositives: - Unlikely level: high
Query: vulnerability: Directory traversal vulnerability in the min_get_slash_argument function in lib/configonlylib.php in Moodle through 2.5.9, 2.6.x before 2.6.8, 2.7.x before 2.7.5, and 2.8.x before 
Matching passage: CVE-2015-1493. CWE: CWE-22. CVSS: 6.800000190734863. Directory traversal vulnerability in the min_get_slash_argument function in lib/configonlylib.php in Moodle through 2.5.9, 2.6.x before 2.6.8, 2.7.x before 2.7.5, and 2.8.x before 2.8.3 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the file parameter, as demonstrated by reading PHP scripts.
Near-miss passage: CVE-2015-8309. CWE: CWE-22. CVSS: 4.300000190734863. Directory traversal vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to read arbitrary files via the "value" parameter to "download."
Query: Sigma rule for Detects when an user assumed another user account.
Matching passage: Sigma rule: Detects when an user assumed another user account.. Logsource: onelogin / onelogin.events. Rule: title: OneLogin User Assumed Another User id: 62fff148-278d-497e-8ecd-ad6083231a35 status: test description: Detects when an user assumed another user account. references: - https://developers.onelogin.com/api-docs/1/events/event-resource author: Austin Songer @austinsonger date: 2021-10-12 modified: 2022-12-25 tags: - attack.impact logsource: product: onelogin service: onelogin.events detection: selection: event_type_id: 3 condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detec. Logsource: linux / process_creation. Rule: title: Scheduled Cron Task/Job - Linux id: 6b14bac8-3e3a-4324-8109-42f0546a347f status: test description: Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.003/T1053.003.md author: Alejandro Ortuno, oscd.community date: 2020-10-06 modified: 2022-11-27 tags: - attack.execution - attack.persistence - attack.privilege-escalation - attack.t1053.003 logsource: category: process_creation product: linux detection: selection: Image|endswith: crontab CommandLine|contains: /tmp/ condition: selection falsepositives: - Legitimate administration activities level: medium
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Once established within a system or network, an adversary may use automated techniques for collecting internal data.. Logsource: windows / process_creation. Rule: title: Automated Collection Command Prompt id: f576a613-2392-4067-9d1a-9345fb58d8d1 status: test description: Once established within a system or network, an adversary may use automated techniques for collecting internal data. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1119/T1119.md - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md author: frack113 date: 2021-07-28 modified: 2022-11-11 tags: - attack.collection - attack.t1119 - attack.credential-access - attack.t1552.001 logsource: category: process_creation product: windows detection: selection_ext: CommandLine|contains: - .doc - .docx - .xls - .xlsx - .ppt - .pptx - .rtf - .pdf - .txt selection_other_dir: CommandLine|contains|all: - 'dir ' - ' /b ' - ' /s ' selection_other_findstr: OriginalFileName: FINDSTR.EXE CommandLine|contains: - ' /e ' - ' /si ' condition: selection_ext and 1 of selection_other_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the execution of the Restic backup tool, which can be used for data exfiltration. Threat actors may leverage Res. Logsource: windows / process_creation. Rule: title: PUA - Restic Backup Tool Execution id: 6ddff2e8-ea1a-45d0-8938-93dfc1d67ae7 status: experimental description: 'Detects the execution of the Restic backup tool, which can be used for data exfiltration. Threat actors may leverage Restic to back up and exfiltrate sensitive data to remote storage locations, including cloud services. If not legitimately used in the enterprise environment, its presence may indicate malicious activity. ' references: - https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware/#exfiltration - https://restic.net/ - https://restic.readthedocs.io/en/stable/030_preparing_a_new_repo.html author: Nounou Mbeiri, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-10-17 tags: - attack.exfiltration - attack.t1048 - attack.t1567.002 logsource: product: windows category: process_creation detection: selection_specific: - CommandLine|contains|all: - --password-file - init - ' -r ' - CommandLine|contains|all: - --use-fs-snapshot - backup - ' -r ' selection_restic: CommandLine|contains: - 'sftp:' - rest:http - s3:s3. - s3.http - 'azure:' - ' gs:' - 'rclone:' - 'swift:' - ' b2:' CommandLine|contains|all: - ' init ' - ' -r ' condition: 1 of selection_* falsepositives: - Legitimate use of Restic for backup purposes within the organization. level: high
Query: risk of Cross-site scripting (XSS) vulnerability in Atlassian Confluence before 5.8.17 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to rest/prototype/1/
Matching passage: CVE-2015-8398. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Atlassian Confluence before 5.8.17 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to rest/prototype/1/session/check.
Near-miss passage: CVE-2015-0177. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.5.0 before CF05 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Query: rule covering Exports the target Registry key and hides it in the specified alternate data stream.
Matching passage: Sigma rule: Exports the target Registry key and hides it in the specified alternate data stream.. Logsource: windows / create_stream_hash. Rule: title: Exports Registry Key To an Alternate Data Stream id: 0d7a9363-af70-4e7b-a3b7-1a176b7fbe84 status: test description: Exports the target Registry key and hides it in the specified alternate data stream. references: - https://lolbas-project.github.io/lolbas/Binaries/Regedit/ - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f author: Oddvar Moe, Sander Wiebing, oscd.community date: 2020-10-07 modified: 2021-11-27 tags: - attack.stealth - attack.t1564.004 logsource: product: windows category: create_stream_hash detection: selection: Image|endswith: \regedit.exe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects SILENTTRINITY stager dll loading activity. Logsource: windows / image_load. Rule: title: HackTool - SILENTTRINITY Stager DLL Load id: 75c505b1-711d-4f68-a357-8c3fe37dbf2d related: - id: 03552375-cc2c-4883-bbe4-7958d5a980be type: derived status: test description: Detects SILENTTRINITY stager dll loading activity references: - https://github.com/byt3bl33d3r/SILENTTRINITY author: Aleksey Potapov, oscd.community date: 2019-10-22 modified: 2023-02-17 tags: - attack.command-and-control - attack.t1071 logsource: category: image_load product: windows detection: selection: Description|contains: st2stager condition: selection falsepositives: - Unlikely level: high
Query: Sigma rule for Detects unusual parent or children of the wab.exe (Windows Contacts) and Wabmig.exe (Microsoft Address Book Import Tool)
Matching passage: Sigma rule: Detects unusual parent or children of the wab.exe (Windows Contacts) and Wabmig.exe (Microsoft Address Book Import Tool). Logsource: windows / process_creation. Rule: title: Wab/Wabmig Unusual Parent Or Child Processes id: 63d1ccc0-2a43-4f4b-9289-361b308991ff status: test description: Detects unusual parent or children of the wab.exe (Windows Contacts) and Wabmig.exe (Microsoft Address Book Import Tool) processes as seen being used with bumblebee activity references: - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime - https://thedfirreport.com/2022/09/26/bumblebee-round-two/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-12 modified: 2022-09-27 tags: - attack.execution - attack.stealth logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \WmiPrvSE.exe - \svchost.exe - \dllhost.exe Image|endswith: - \wab.exe - \wabmig.exe selection_child: ParentImage|endswith: - \wab.exe - \wabmig.exe condition: 1 of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive. Attackers can leverage the "wbadmin". Logsource: windows / process_creation. Rule: title: Sensitive File Recovery From Backup Via Wbadmin.EXE id: 84972c80-251c-4c3a-9079-4f00aad93938 related: - id: 6fe4aa1e-0531-4510-8be2-782154b73b48 type: derived status: test description: 'Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive. Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information. ' references: - https://github.com/LOLBAS-Project/LOLBAS/blob/2cc01b01132b5c304027a658c698ae09dd6a92bf/yml/OSBinaries/Wbadmin.yml - https://lolbas-project.github.io/lolbas/Binaries/Wbadmin/ - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-backup author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2024-05-10 tags: - attack.credential-access - attack.t1003.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \wbadmin.exe - OriginalFileName: WBADMIN.EXE selection_backup: CommandLine|contains|all: - ' recovery' - recoveryTarget - itemtype:File CommandLine|contains: - \config\SAM - \config\SECURITY - \config\SYSTEM - \Windows\NTDS\NTDS.dit condition: all of selection_* falsepositives: - Unknown level: high
Query: rule covering Alerts on trust record modification within the registry, indicating usage of macros
Matching passage: Sigma rule: Alerts on trust record modification within the registry, indicating usage of macros. Logsource: windows / registry_event. Rule: title: Windows Registry Trust Record Modification id: 295a59c1-7b79-4b47-a930-df12c15fc9c2 related: - id: a166f74e-bf44-409d-b9ba-ea4b2dd8b3cd type: similar status: test description: Alerts on trust record modification within the registry, indicating usage of macros references: - https://outflank.nl/blog/2018/01/16/hunting-for-evil-detect-macros-being-executed/ - http://az4n6.blogspot.com/2016/02/more-on-trust-records-macros-and.html - https://twitter.com/inversecos/status/1494174785621819397 author: Antonlovesdnb, Trent Liffick (@tliffick) date: 2020-02-19 modified: 2023-06-21 tags: - attack.initial-access - attack.t1566.001 logsource: category: registry_event product: windows detection: selection: TargetObject|contains: \Security\Trusted Documents\TrustRecords condition: selection falsepositives: - This will alert on legitimate macro usage as well, additional tuning is required level: medium
Near-miss passage: Sigma rule: Detects command line parameters or strings often used by crypto miners. Logsource: linux / process_creation. Rule: title: Linux Crypto Mining Indicators id: 9069ea3c-b213-4c52-be13-86506a227ab1 status: test description: Detects command line parameters or strings often used by crypto miners references: - https://www.poolwatch.io/coin/monero author: Florian Roth (Nextron Systems) date: 2021-10-26 modified: 2022-12-25 tags: - attack.impact - attack.t1496 logsource: product: linux category: process_creation detection: selection: CommandLine|contains: - ' --cpu-priority=' - --donate-level=0 - ' -o pool.' - ' --nicehash' - ' --algo=rx/0 ' - stratum+tcp:// - stratum+udp:// - sh -c /sbin/modprobe msr allow_writes=on - LS1kb25hdGUtbGV2ZWw9 - 0tZG9uYXRlLWxldmVsP - tLWRvbmF0ZS1sZXZlbD - c3RyYXR1bSt0Y3A6Ly - N0cmF0dW0rdGNwOi8v - zdHJhdHVtK3RjcDovL - c3RyYXR1bSt1ZHA6Ly - N0cmF0dW0rdWRwOi8v - zdHJhdHVtK3VkcDovL condition: selection falsepositives: - Legitimate use of crypto miners level: high
Query: CVE similar to CVE-2015-8362
Matching passage: CVE-2015-8362. CWE: CWE-255. CVSS: 9.800000190734863. The setUpSubtleUserAccount function in /bin/bw on Harman AMX devices before 2015-10-12 has a hardcoded password for the BlackWidow account, which makes it easier for remote attackers to obtain access via a (1) SSH or (2) HTTP session, a different vulnerability than CVE-2016-1984.
Near-miss passage: CVE-2015-1320. CWE: CWE-255. CVSS: 9.800000190734863. The SeaMicro provisioning of Ubuntu MAAS logs credentials, including username and password, for the management interface. This issue affects Ubuntu MAAS versions prior to 1.9.2.
Query: alert when Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-d
Matching passage: Sigma rule: Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-d. Logsource: windows / process_creation. Rule: title: Potential Mpclient.DLL Sideloading Via Defender Binaries id: 7002aa10-b8d4-47ae-b5ba-51ab07e228b9 related: - id: 418dc89a-9808-4b87-b1d7-e5ae0cb6effc type: similar status: test description: Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory. references: - https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool author: Bhabesh Raj date: 2022-08-01 modified: 2023-08-04 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: product: windows category: process_creation detection: selection: Image|endswith: - \MpCmdRun.exe - \NisSrv.exe filter_main_known_locations: Image|startswith: - C:\Program Files (x86)\Windows Defender\ - C:\Program Files\Microsoft Security Client\ - C:\Program Files\Windows Defender\ - C:\ProgramData\Microsoft\Windows Defender\Platform\ - C:\Windows\WinSxS\ condition: selection and not 1 of filter_main_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects command lines that indicate unwanted modifications to registry keys that disable important Internet Explorer sec. Logsource: windows / process_creation. Rule: title: Disabled IE Security Features id: fb50eb7a-5ab1-43ae-bcc9-091818cb8424 status: test description: Detects command lines that indicate unwanted modifications to registry keys that disable important Internet Explorer security features references: - https://unit42.paloaltonetworks.com/operation-ke3chang-resurfaces-with-new-tidepool-malware/ author: Florian Roth (Nextron Systems) date: 2020-06-19 modified: 2021-11-27 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection1: CommandLine|contains|all: - ' -name IEHarden ' - ' -value 0 ' selection2: CommandLine|contains|all: - ' -name DEPOff ' - ' -value 1 ' selection3: CommandLine|contains|all: - ' -name DisableFirstRunCustomize ' - ' -value 2 ' condition: 1 of selection* falsepositives: - Unknown level: high
Query: vulnerability: Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before
Matching passage: CVE-2015-3115. CWE: CWE-284. CVSS: 5.0. Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2014-0578, CVE-2015-3116, CVE-2015-3125, and CVE-2015-5116.
Near-miss passage: CVE-2015-3672. CWE: CWE-284. CVSS: 7.199999809265137. Admin Framework in Apple OS X before 10.10.4 does not properly handle authentication errors, which allows local users to obtain admin privileges via unspecified vectors.
Query: describe CVE-2015-4931
Matching passage: CVE-2015-4931. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12.1 allows remote attackers to execute arbitrary code via a crafted packet, a different vulnerability than CVE-2015-4932, CVE-2015-4933, CVE-2015-4934, and CVE-2015-4935.
Near-miss passage: CVE-2015-8382. CWE: CWE-119. CVSS: 6.400000095367432. The match function in pcre_exec.c in PCRE before 8.37 mishandles the /(?:((abcd))|(((?:(?:(?:(?:abc|(?:abcdef))))b)abcdefghi)abc)|((*ACCEPT)))/ pattern and related patterns involving (*ACCEPT), which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (partially initialized memory and application crash) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-2547.
Query: explain CWE-243
Matching passage: CWE-243 Creation of chroot Jail Without Changing Working Directory. The product uses the chroot() system call to create a jail, but does not change the working directory afterward. This does not prevent access to files outside of the jail.
Near-miss passage: CWE-555 J2EE Misconfiguration: Plaintext Password in Configuration File. The J2EE application stores a plaintext password in a configuration file.
Query: EDR alert: possible Mutual Exclusion (T1480.002)
Matching passage: T1480.002 Mutual Exclusion. Tactics: stealth. Description: Adversaries may constrain execution or actions based on the presence of a mutex associated with malware. A mutex is a locking mechanism used to synchronize access to a resource. Only one thread or process can acquire a mutex at a given time.(Citation: Microsoft Mutexes) While local mutexes only exist within a given process, allowing multiple threads to synchronize access to a resource, system mutexes can be used to synchronize the activities of multiple processes.(Citation: Microsoft Mutexes) By creating a unique system mutex associated with a particular malware, adversaries can verify whether or not a system has already been compromised.(Citation: Sans Mutexes 2012) In Linux environments, malware may instead attempt to acquire a lock on a mutex file. If the malware is able to acquire the lock, it continues to execute; if it fails, it exits to avoid creating a second instance of itself.(Citation: Intezer RedXOR 2021)(Citation: Deep Instinct BPFDoor 2023) Mutex names may be hard-coded or dynamically generated using a predictable algorithm.(Citation: ICS Mutexes 2015)
Near-miss passage: T1480 Execution Guardrails. Tactics: stealth. Description: Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target. Guardrails ensure that a payload only executes against an intended target and reduces collateral damage from an adversary’s campaign.(Citation: FireEye Kevin Mandia Guardrails) Values an adversary can provide about a target system or environment to use as guardrails may include specific network share names, attached physical devices, files, joined Active Directory (AD) domains, and local/external IP addresses.(Citation: FireEye Outlook Dec 2019) Guardrails can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within. This use of guardrails is distinct from typical [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497). While use of [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) may involve checking for known sandbox values and continuing with execution only if there is no match, the use of guardrails will involve checking for an expected target-specific value and only continuing with execution if there is such a match. Adversaries may identify and block certain user-agents to evade defenses and narrow the scope of their attack to victims and platforms on which it will be most effective. A user-agent self-identifies data such as a user's software application, operating system, vendor, and version. Adversaries may check user-agents for operating system identification and then only serve malware for the exploitable software while ignoring all other operating systems.(Citation: Trellix-Qakbot)