alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Detects usage of system utilities (only grep for now) to discover security software discovery
Matching passage: Sigma rule: Detects usage of system utilities (only grep for now) to discover security software discovery. Logsource: macos / process_creation. Rule: title: Security Software Discovery - MacOs id: 0ed75b9c-c73b-424d-9e7d-496cd565fbe0 status: test description: Detects usage of system utilities (only grep for now) to discover security software discovery references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518.001/T1518.001.md author: Daniil Yugoslavskiy, oscd.community date: 2020-10-19 modified: 2022-11-27 tags: - attack.discovery - attack.t1518.001 logsource: category: process_creation product: macos detection: image: Image: /usr/bin/grep selection_cli_1: CommandLine|contains: - nessusd - santad - CbDefense - falcond - td-agent - packetbeat - filebeat - auditbeat - osqueryd - BlockBlock - LuLu selection_cli_2: CommandLine|contains|all: - Little - Snitch condition: image and 1 of selection_cli_* falsepositives: - Legitimate activities level: medium
Near-miss passage: Sigma rule: Detects source code enumeration that use GET requests by keyword searches in URL strings. Logsource: webserver. Rule: title: Source Code Enumeration Detection by Keyword id: 953d460b-f810-420a-97a2-cfca4c98e602 status: test description: Detects source code enumeration that use GET requests by keyword searches in URL strings references: - https://pentester.land/tutorials/2018/10/25/source-code-disclosure-via-exposed-git-folder.html - https://medium.com/@logicbomb_1/bugbounty-how-i-was-able-to-download-the-source-code-of-indias-largest-telecom-service-52cf5c5640a1 author: James Ahearn date: 2019-06-08 modified: 2022-10-05 tags: - attack.discovery - attack.t1083 logsource: category: webserver detection: keywords: - .git/ condition: keywords falsepositives: - Unknown level: medium
Query: alert when Detects when a Microsoft Cloud App Security reported a user has deleted a unusual a large volume of files.
Matching passage: Sigma rule: Detects when a Microsoft Cloud App Security reported a user has deleted a unusual a large volume of files.. Logsource: m365 / threat_management. Rule: title: Microsoft 365 - Unusual Volume of File Deletion id: 78a34b67-3c39-4886-8fb4-61c46dc18ecd status: test description: Detects when a Microsoft Cloud App Security reported a user has deleted a unusual a large volume of files. references: - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference author: austinsonger date: 2021-08-19 modified: 2022-10-09 tags: - attack.impact - attack.t1485 logsource: service: threat_management product: m365 detection: selection: eventSource: SecurityComplianceCenter eventName: Unusual volume of file deletion status: success condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the Setting of Windows Defender Exclusions. Logsource: windows / windefend. Rule: title: Windows Defender Exclusions Added id: 1321dc4e-a1fe-481d-a016-52c45f0c8b4f status: stable description: Detects the Setting of Windows Defender Exclusions references: - https://twitter.com/_nullbind/status/1204923340810543109 author: Christian Burkard (Nextron Systems) date: 2021-07-06 modified: 2022-12-06 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: windefend detection: selection: EventID: 5007 NewValue|contains: \Microsoft\Windows Defender\Exclusions condition: selection falsepositives: - Administrator actions level: medium
Query: rule covering Detects path traversal exploitation attempts
Matching passage: Sigma rule: Detects path traversal exploitation attempts. Logsource: webserver. Rule: title: Path Traversal Exploitation Attempts id: 7745c2ea-24a5-4290-b680-04359cb84b35 status: test description: Detects path traversal exploitation attempts references: - https://github.com/projectdiscovery/nuclei-templates - https://book.hacktricks.xyz/pentesting-web/file-inclusion author: Subhash Popuri (@pbssubhash), Florian Roth (Nextron Systems), Thurein Oo, Nasreddine Bencherchali (Nextron Systems) date: 2021-09-25 modified: 2023-08-31 tags: - attack.initial-access - attack.t1190 logsource: category: webserver detection: selection: cs-uri-query|contains: - ../../../../../lib/password - ../../../../windows/ - ../../../etc/ - ..%252f..%252f..%252fetc%252f - ..%c0%af..%c0%af..%c0%afetc%c0%af - '%252e%252e%252fetc%252f' condition: selection falsepositives: - Expected to be continuously seen on systems exposed to the Internet - Internal vulnerability scanners level: medium
Near-miss passage: Sigma rule: Detects usage of HollowReaper, a process hollowing shellcode launcher used for stealth payload execution through process. Logsource: windows / process_creation. Rule: title: HackTool - HollowReaper Execution id: 85d23b42-9a9d-4f8f-b3d7-d2733c1d58f5 status: experimental description: 'Detects usage of HollowReaper, a process hollowing shellcode launcher used for stealth payload execution through process hollowing. It replaces the memory of a legitimate process with custom shellcode, allowing the attacker to execute payloads under the guise of trusted binaries. ' references: - https://github.com/vari-sh/RedTeamGrimoire/tree/b5e7635d34db6e1f0398d8847e8f293186e947c5/HollowReaper author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-07-01 tags: - attack.privilege-escalation - attack.stealth - attack.t1055.012 logsource: category: process_creation product: windows detection: selection: Image|endswith: \HollowReaper.exe condition: selection falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-2035
Matching passage: CVE-2015-2035. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote administrators to execute arbitrary SQL commands via the user parameter in the history page to admin.php.
Near-miss passage: CVE-2015-1441. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in Piwigo before 2.5.6, 2.6.x before 2.6.5, and 2.7.x before 2.7.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Query: vulnerability: Aruba AirWave before 8.0.7 allows bypass of a CSRF protection mechanism.
Matching passage: CVE-2015-1391. CWE: CWE-352. CVSS: 8.800000190734863. Aruba AirWave before 8.0.7 allows bypass of a CSRF protection mechanism.
Near-miss passage: CVE-2015-5412. CWE: CWE-352. CVSS: 6.0. Cross-site request forgery (CSRF) vulnerability in HP Version Control Repository Manager (VCRM) before 7.5.0 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.
Query: CVE similar to CVE-2015-8678
Matching passage: CVE-2015-8678. CWE: CWE-20. CVSS: 5.5. The ION driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230 and Mate S smartphones with software CRR-TL00 before CRR-TL00C01B160SP01, CRR-UL00 before CRR-UL00C00B160, and CRR-CL00 before CRR-CL00C92B161 allows remote attackers to cause a denial of service (crash) via a crafted application.
Near-miss passage: CVE-2015-8946. CWE: CWE-20. CVSS: 3.299999952316284. ecryptfs-setup-swap in eCryptfs before 111 does not prevent the unencrypted swap partition from activating during boot when using GPT partitioning and certain versions of systemd, which allows local users to obtain sensitive information via unspecified vectors.
Query: CVE similar to CVE-2015-6162
Matching passage: CVE-2015-6162. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6152.
Near-miss passage: CVE-2015-3166. CWE: CWE-119. CVSS: 9.800000190734863. The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 does not properly handle system-call errors, which allows attackers to obtain sensitive information or have other unspecified impact via unknown vectors, as demonstrated by an out-of-memory error.
Query: detect Detects BGP failures which may be indicative of brute force attacks to manipulate routing. in logs
Matching passage: Sigma rule: Detects BGP failures which may be indicative of brute force attacks to manipulate routing.. Logsource: huawei / bgp. Rule: title: Huawei BGP Authentication Failures id: a557ffe6-ac54-43d2-ae69-158027082350 status: test description: Detects BGP failures which may be indicative of brute force attacks to manipulate routing. references: - https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-convery-franz-v3.pdf author: Tim Brown date: 2023-01-09 modified: 2023-01-23 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation - attack.credential-access - attack.collection - attack.stealth - attack.t1078 - attack.t1110 - attack.t1557 logsource: product: huawei service: bgp definition: 'Requirements: huawei bgp logs need to be enabled and ingested' detection: keywords_bgp_huawei: '|all': - :179 - BGP_AUTH_FAILED condition: keywords_bgp_huawei falsepositives: - Unlikely. Except due to misconfigurations level: low
Near-miss passage: Sigma rule: Detects potential mimikatz-like tools accessing LSASS from non system account. Logsource: windows / security. Rule: title: LSASS Access From Non System Account id: 962fe167-e48d-4fd6-9974-11e5b9a5d6d1 status: test description: Detects potential mimikatz-like tools accessing LSASS from non system account references: - https://threathunterplaybook.com/hunts/windows/170105-LSASSMemoryReadAccess/notebook.html author: Roberto Rodriguez @Cyb3rWard0g date: 2019-06-20 modified: 2023-12-11 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows service: security detection: selection: EventID: - 4663 - 4656 AccessMask: - '0x100000' - '0x1010' - '0x1400' - '0x1410' - '0x1418' - '0x1438' - '0x143a' - '0x1f0fff' - '0x1f1fff' - '0x1f2fff' - '0x1f3fff' - '0x40' - 143a - 1f0fff - 1f1fff - 1f2fff - 1f3fff ObjectType: Process ObjectName|endswith: \lsass.exe filter_main_service_account: SubjectUserName|endswith: $ filter_main_generic: ProcessName|contains: - :\Program Files\ - :\Program Files (x86)\ filter_main_wmiprvse: ProcessName: C:\Windows\System32\wbem\WmiPrvSE.exe AccessMask: '0x1410' filter_optional_steam: ProcessName|contains: \SteamLibrary\steamapps\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Query: CVE similar to CVE-2015-0536
Matching passage: CVE-2015-0536. CWE: UNKNOWN. CVSS: 7.5. EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.8 and 4.1.x before 4.1.3 and RSA BSAFE SSL-C 2.8.9 and earlier, when client authentication and an ephemeral Diffie-Hellman ciphersuite are enabled, allow remote attackers to cause a denial of service (daemon crash) via a ClientKeyExchange message with a length of zero, a similar issue to CVE-2015-1787.
Near-miss passage: CVE-2015-0356. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion."
Query: risk of Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explore
Matching passage: CVE-2015-6147. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6149.
Near-miss passage: CVE-2015-5785. CWE: CWE-119. CVSS: 6.800000190734863. Apple QuickTime before 7.7.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted file, a different vulnerability than CVE-2015-5786.
Query: risk of Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library (aka rxspencer) alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5 and other pro
Matching passage: CVE-2015-2305. CWE: CWE-190. CVSS: 6.800000190734863. Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library (aka rxspencer) alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5 and other products, might allow context-dependent attackers to execute arbitrary code via a large regular expression that leads to a heap-based buffer overflow.
Near-miss passage: CVE-2015-5297. CWE: CWE-190. CVSS: 9.800000190734863. An integer overflow issue has been reported in the general_composite_rect() function in pixman prior to version 0.32.8. An attacker could exploit this issue to cause an application using pixman to crash or, potentially, execute arbitrary code.
Query: write Sigma for Detects process execution related errors in NodeJS. If the exceptions are caused due to user input then they may suggest
Matching passage: Sigma rule: Detects process execution related errors in NodeJS. If the exceptions are caused due to user input then they may suggest. Logsource: nodejs / application. Rule: title: Potential RCE Exploitation Attempt In NodeJS id: 97661d9d-2beb-4630-b423-68985291a8af status: test description: Detects process execution related errors in NodeJS. If the exceptions are caused due to user input then they may suggest an RCE vulnerability. references: - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs author: Moti Harmats date: 2023-02-11 tags: - attack.initial-access - attack.t1190 logsource: category: application product: nodejs definition: 'Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)' detection: keywords: - node:child_process condition: keywords falsepositives: - Puppeteer invocation exceptions often contain child_process related errors, that doesn't necessarily mean that the app is vulnerable. level: high
Near-miss passage: Sigma rule: Detects java process spawning suspicious children. Logsource: linux / process_creation. Rule: title: Suspicious Java Children Processes id: d292e0af-9a18-420c-9525-ec0ac3936892 status: test description: Detects java process spawning suspicious children references: - https://www.tecmint.com/different-types-of-linux-shells/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-03 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: linux detection: selection: ParentImage|endswith: /java CommandLine|contains: - /bin/sh - bash - dash - ksh - zsh - csh - fish - curl - wget - python condition: selection falsepositives: - Unknown level: high
Query: detection rule: Adversaries can use curl to download payloads remotely and execute them. Curl is included by default in Windows 10 build
Matching passage: Sigma rule: Adversaries can use curl to download payloads remotely and execute them. Curl is included by default in Windows 10 build. Logsource: windows / process_creation. Rule: title: Curl Download And Execute Combination id: 21dd6d38-2b18-4453-9404-a0fe4a0cc288 status: test description: Adversaries can use curl to download payloads remotely and execute them. Curl is included by default in Windows 10 build 17063 and later. references: - https://medium.com/@reegun/curl-exe-is-the-new-rundll32-exe-lolbin-3f79c5f35983 author: Sreeman, Nasreddine Bencherchali (Nextron Systems) date: 2020-01-13 modified: 2024-03-05 tags: - attack.stealth - attack.t1218 - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|windash: ' -c ' CommandLine|contains|all: - 'curl ' - http - -o - '&' condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects potentially suspicious child processes of "GoogleUpdate.exe". Logsource: windows / process_creation. Rule: title: Potentially Suspicious GoogleUpdate Child Process id: 84b1ecf9-6eff-4004-bafb-bae5c0e251b2 related: - id: bdbab15a-3826-48fa-a1b7-723cd8f32fcc type: derived status: test description: Detects potentially suspicious child processes of "GoogleUpdate.exe" references: - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/goofy-guineapig/NCSC-MAR-Goofy-Guineapig.pdf author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-15 modified: 2023-05-22 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \GoogleUpdate.exe filter_main_known_legit: - Image|contains: \Google - Image|endswith: - \setup.exe - chrome_updater.exe - chrome_installer.exe filter_main_image_null: Image: null condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: hunt for Resource Forking activity
Matching passage: T1564.009 Resource Forking. Tactics: stealth. Description: Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.(Citation: macOS Hierarchical File System Overview) Usage of a resource fork is identifiable when displaying a file’s extended attributes, using <code>ls -l@</code> or <code>xattr -l</code> commands. Resource forks have been deprecated and replaced with the application bundle structure. Non-localized resources are placed at the top level directory of an application bundle, while localized resources are placed in the <code>/Resources</code> folder.(Citation: Resource and Data Forks)(Citation: ELC Extended Attributes) Adversaries can use resource forks to hide malicious data that may otherwise be stored directly in files. Adversaries can execute content with an attached resource fork, at a specified offset, that is moved to an executable location then invoked. Resource fork content may also be obfuscated/encrypted until execution.(Citation: sentinellabs resource named fork 2020)(Citation: tau bundlore erika noerenberg 2020)
Near-miss passage: T1564.005 Hidden File System. Tactics: stealth. Description: Adversaries may use a hidden file system to conceal malicious activity from users and security tools. File systems provide a structure to store and access data from physical storage. Typically, a user engages with a file system through applications that allow them to access files and directories, which are an abstraction from their physical location (ex: disk sector). Standard file systems include FAT, NTFS, ext4, and APFS. File systems can also contain other structures, such as the Volume Boot Record (VBR) and Master File Table (MFT) in NTFS.(Citation: MalwareTech VFS Nov 2014) Adversaries may use their own abstracted file system, separate from the standard file system present on the infected system. In doing so, adversaries can hide the presence of malicious components and file input/output from security tools. Hidden file systems, sometimes referred to as virtual file systems, can be implemented in numerous ways. One implementation would be to store a file system in reserved disk space unused by disk structures or standard file system partitions.(Citation: MalwareTech VFS Nov 2014)(Citation: FireEye Bootkits) Another implementation could be for an adversary to drop their own portable partition image as a file on top of the standard file system.(Citation: ESET ComRAT May 2020) Adversaries may also fragment files across the existing file system structure in non-standard ways.(Citation: Kaspersky Equation QA)
Query: exploit The cache handler in MyBB (aka MyBulletinBoard) before 1.8.4 does not properly check the encoding of input to the var_export function, which allows attackers to have an unspecified
Matching passage: CVE-2015-2352. CWE: UNKNOWN. CVSS: 7.5. The cache handler in MyBB (aka MyBulletinBoard) before 1.8.4 does not properly check the encoding of input to the var_export function, which allows attackers to have an unspecified impact via unknown vectors.
Near-miss passage: CVE-2015-2167. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in the 3PI Manager in Ericsson Drutt Mobile Service Delivery Platform (MSDP) 4, 5, and 6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter to jsp/start-3pi-manager.jsp.
Query: common weakness: Path Equivalence: '/./' (Single Dot Directory)
Matching passage: CWE-55 Path Equivalence: '/./' (Single Dot Directory). The product accepts path input in the form of single dot directory exploit ('/./') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
Near-miss passage: CWE-116 Improper Encoding or Escaping of Output. The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Query: describe CVE-2015-0771
Matching passage: CVE-2015-0771. CWE: CWE-399. CVSS: 6.300000190734863. The IKE implementation in the WS-IPSEC-3 service module in Cisco IOS 12.2 on Catalyst 6500 devices allows remote authenticated users to cause a denial of service (device reload) by sending a crafted message during IPsec tunnel setup, aka Bug ID CSCur70505.
Near-miss passage: CVE-2015-0041. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0017, CVE-2015-0020, CVE-2015-0022, CVE-2015-0026, CVE-2015-0030, CVE-2015-0031, and CVE-2015-0036.
Query: risk of EasyCTF before 1.4 allows remote authenticated users to write executable content to files via unspecified vectors.
Matching passage: CVE-2015-0912. CWE: UNKNOWN. CVSS: 6.5. EasyCTF before 1.4 allows remote authenticated users to write executable content to files via unspecified vectors.
Near-miss passage: CVE-2015-5569. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 improperly implement the Flash broker API, which has unspecified impact and attack vectors.