alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations. in logs
Matching passage: Sigma rule: Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations.. Logsource: windows / process_creation. Rule: title: Mstsc.EXE Execution From Uncommon Parent id: ff3b6b39-e765-42f9-bb2c-ea6761e0e0f6 status: test description: Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations. references: - https://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/ - https://web.archive.org/web/20230726144748/https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-18 tags: - attack.lateral-movement logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \brave.exe - \CCleanerBrowser.exe - \chrome.exe - \chromium.exe - \firefox.exe - \iexplore.exe - \microsoftedge.exe - \msedge.exe - \opera.exe - \vivaldi.exe - \whale.exe - \outlook.exe selection_img: - Image|endswith: \mstsc.exe - OriginalFileName: mstsc.exe condition: all of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects installation or execution of services. Logsource: windows / system. Rule: title: HackTool Service Registration or Execution id: d26ce60c-2151-403c-9a42-49420d87b5e4 status: test description: Detects installation or execution of services references: - Internal Research author: Florian Roth (Nextron Systems) date: 2022-03-21 modified: 2023-08-07 tags: - attack.execution - attack.t1569.002 - attack.s0029 logsource: product: windows service: system detection: selection_eid: Provider_Name: Service Control Manager EventID: - 7045 - 7036 selection_service_name: ServiceName|contains: - cachedump - DumpSvc - gsecdump - pwdump - UACBypassedService - WCE SERVICE - WCESERVICE - winexesvc selection_service_image: ImagePath|contains: bypass condition: selection_eid and 1 of selection_service_* falsepositives: - Unknown level: high
Query: describe CVE-2015-4747
Matching passage: CVE-2015-4747. CWE: UNKNOWN. CVSS: 6.800000190734863. Unspecified vulnerability in the Oracle Event Processing component in Oracle Fusion Middleware 11.1.1.7 and 12.1.3.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CEP system.
Near-miss passage: CVE-2015-4801. CWE: UNKNOWN. CVSS: 2.0999999046325684. Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect confidentiality via unknown vectors related to Solaris Kernel Zones.
Query: Outbound C2 pattern associated with Clear Persistence
Matching passage: T1070.009 Clear Persistence. Tactics: stealth. Description: Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity. This may involve various actions, such as removing services, deleting executables, [Modify Registry](https://attack.mitre.org/techniques/T1112), [Plist File Modification](https://attack.mitre.org/techniques/T1647), or other methods of cleanup to prevent defenders from collecting evidence of their persistent presence.(Citation: Cylance Dust Storm) Adversaries may also delete accounts previously created to maintain persistence (i.e. [Create Account](https://attack.mitre.org/techniques/T1136)).(Citation: Talos - Cisco Attack 2022) In some instances, artifacts of persistence may also be removed once an adversary’s persistence is executed in order to prevent errors with the new instance of the malware.(Citation: NCC Group Team9 June 2020)
Near-miss passage: T1070.008 Clear Mailbox Data. Tactics: stealth. Description: Adversaries may modify mail and mail application data to remove evidence of their activity. Email applications allow users and other programs to export and delete mailbox data via command line tools or use of APIs. Mail application data can be emails, email metadata, or logs generated by the application or operating system, such as export requests. Adversaries may manipulate emails and mailbox data to remove logs, artifacts, and metadata, such as evidence of [Phishing](https://attack.mitre.org/techniques/T1566)/[Internal Spearphishing](https://attack.mitre.org/techniques/T1534), [Email Collection](https://attack.mitre.org/techniques/T1114), [Mail Protocols](https://attack.mitre.org/techniques/T1071/003) for command and control, or email-based exfiltration such as [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048). For example, to remove evidence on Exchange servers adversaries have used the <code>ExchangePowerShell</code> [PowerShell](https://attack.mitre.org/techniques/T1059/001) module, including <code>Remove-MailboxExportRequest</code> to remove evidence of mailbox exports.(Citation: Volexity SolarWinds)(Citation: ExchangePowerShell Module) On Linux and macOS, adversaries may also delete emails through a command line utility called <code>mail</code> or use [AppleScript](https://attack.mitre.org/techniques/T1059/002) to interact with APIs on macOS.(Citation: Cybereason Cobalt Kitty 2017)(Citation: mailx man page) Adversaries may also remove emails and metadata/headers indicative of spam or suspicious activity (for example, through the use of organization-wide transport rules) to reduce the likelihood of malicious emails being detected by security products.(Citation: Microsoft OAuth Spam 2022)
Query: alert when Detects attempts to delete the RunMRU registry key, which stores the history of commands executed via the run dialog. In
Matching passage: Sigma rule: Detects attempts to delete the RunMRU registry key, which stores the history of commands executed via the run dialog. In. Logsource: windows / registry_delete. Rule: title: RunMRU Registry Key Deletion - Registry id: 3a9b8c1e-5b2e-4f7a-9d1c-2a7f3b6e1c55 related: - id: c11aecef-9c37-45a6-9c07-bc0782f963fd type: similar status: experimental description: 'Detects attempts to delete the RunMRU registry key, which stores the history of commands executed via the run dialog. In the clickfix techniques, the phishing lures instruct users to open a run dialog through (Win + R) and execute malicious commands. Adversaries may delete this key to cover their tracks after executing commands. ' references: - https://www.zscaler.com/blogs/security-research/coldriver-updates-arsenal-baitswitch-and-simplefix author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-09-25 tags: - attack.stealth - attack.t1070.003 logsource: category: registry_delete product: windows detection: selection: TargetObject|endswith: \Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/registry/registry_delete/registry_delete_runmru/info.yml
Near-miss passage: Sigma rule: Detects when an attacker create a similar folder structure to windows system folders such as (Windows, Program Files...). Logsource: windows / file_event. Rule: title: DLL Search Order Hijackig Via Additional Space in Path id: b6f91281-20aa-446a-b986-38a92813a18f status: test description: 'Detects when an attacker create a similar folder structure to windows system folders such as (Windows, Program Files...) but with a space in order to trick DLL load search order and perform a "DLL Search Order Hijacking" attack ' references: - https://twitter.com/cyb3rops/status/1552932770464292864 - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2022-07-30 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: file_event product: windows detection: selection: TargetFilename|startswith: - C:\Windows \ - C:\Program Files \ - C:\Program Files (x86) \ TargetFilename|endswith: .dll condition: selection falsepositives: - Unknown level: high
Query: write Sigma for Detects suspicious requests to Telegram API without the usual Telegram User-Agent
Matching passage: Sigma rule: Detects suspicious requests to Telegram API without the usual Telegram User-Agent. Logsource: proxy. Rule: title: Telegram API Access id: b494b165-6634-483d-8c47-2026a6c52372 status: test description: Detects suspicious requests to Telegram API without the usual Telegram User-Agent references: - https://researchcenter.paloaltonetworks.com/2018/03/unit42-telerat-another-android-trojan-leveraging-telegrams-bot-api-to-target-iranian-users/ - https://blog.malwarebytes.com/threat-analysis/2016/11/telecrypt-the-ransomware-abusing-telegram-api-defeated/ - https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/ author: Florian Roth (Nextron Systems) date: 2018-06-05 modified: 2023-05-18 tags: - attack.command-and-control - attack.t1071.001 - attack.t1102.002 logsource: category: proxy detection: selection: cs-host: api.telegram.org filter: c-useragent|contains: - Telegram - Bot condition: selection and not filter falsepositives: - Legitimate use of Telegram bots in the company level: medium
Near-miss passage: Sigma rule: Detects calls to PowerShell with Invoke-WebRequest cmdlet using direct IP access. Logsource: windows / process_creation. Rule: title: Suspicious Invoke-WebRequest Execution With DirectIP id: 1edff897-9146-48d2-9066-52e8d8f80a2f status: test description: Detects calls to PowerShell with Invoke-WebRequest cmdlet using direct IP access references: - https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-21 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell_ise.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - powershell_ise.EXE - PowerShell.EXE - pwsh.dll selection_commands: CommandLine|contains: - 'curl ' - Invoke-RestMethod - Invoke-WebRequest - ' irm ' - 'iwr ' - 'wget ' selection_ip: CommandLine|contains: - ://1 - ://2 - ://3 - ://4 - ://5 - ://6 - ://7 - ://8 - ://9 condition: all of selection_* falsepositives: - Unknown level: medium
Query: detect Detects SQL error messages that indicate probing for an injection attack in logs
Matching passage: Sigma rule: Detects SQL error messages that indicate probing for an injection attack. Logsource: sql / application. Rule: title: Suspicious SQL Error Messages id: 8a670c6d-7189-4b1c-8017-a417ca84a086 status: test description: Detects SQL error messages that indicate probing for an injection attack references: - http://www.sqlinjection.net/errors author: Bjoern Kimminich date: 2017-11-27 modified: 2023-02-12 tags: - attack.initial-access - attack.t1190 logsource: category: application product: sql definition: 'Requirements: application error logs must be collected (with LOG_LEVEL ERROR and above)' detection: keywords: - quoted string not properly terminated - You have an error in your SQL syntax - Unclosed quotation mark - 'near "*": syntax error' - SELECTs to the left and right of UNION do not have the same number of result columns condition: keywords falsepositives: - A syntax error in MySQL also occurs in non-dynamic (safe) queries if there is an empty in() clause, that may often be the case. level: high
Near-miss passage: Sigma rule: Detects the usage of tooling to sniff network traffic. An adversary may place a network interface into promiscuous mode. Logsource: macos / process_creation. Rule: title: Network Sniffing - MacOs id: adc9bcc4-c39c-4f6b-a711-1884017bf043 status: test description: 'Detects the usage of tooling to sniff network traffic. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1040/T1040.md author: Alejandro Ortuno, oscd.community date: 2020-10-14 modified: 2022-11-26 tags: - attack.discovery - attack.credential-access - attack.t1040 logsource: category: process_creation product: macos detection: selection: Image|endswith: - /tcpdump - /tshark condition: selection falsepositives: - Legitimate administration activities level: informational
Query: exploit A path traversal vulnerability was identified in the Cloud Foundry component Cloud Controller that affects cf-release versions prior to v208 and Pivotal Cloud Foundry Elastic Runti
Matching passage: CVE-2015-1834. CWE: CWE-22. CVSS: 6.5. A path traversal vulnerability was identified in the Cloud Foundry component Cloud Controller that affects cf-release versions prior to v208 and Pivotal Cloud Foundry Elastic Runtime versions prior to 1.4.2. Path traversal is the 'outbreak' of a given directory structure through relative file paths in the user input. It aims at accessing files and directories that are stored outside the web root folder, for disallowed reading or even executing arbitrary system commands. An attacker could use a certain parameter of the file path for instance to inject '../' sequences in order to navigate through the file system. In this particular case a remote authenticated attacker can exploit the identified vulnerability in order to upload arbitrary files to the server running a Cloud Controller instance - outside the isolated application container.
Near-miss passage: CVE-2015-7780. CWE: CWE-22. CVSS: 6.5. Directory traversal vulnerability in ManageEngine Firewall Analyzer before 8.0.
Query: risk of The SPDY/2 codec in Facebook Proxygen before 2015-11-09 truncates a certain field to two bytes, which allows hijacking and injection attacks.
Matching passage: CVE-2015-7264. CWE: CWE-74. CVSS: 9.800000190734863. The SPDY/2 codec in Facebook Proxygen before 2015-11-09 truncates a certain field to two bytes, which allows hijacking and injection attacks.
Near-miss passage: CVE-2015-5377. CWE: CWE-74. CVSS: 9.800000190734863. Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the transport protocol. NOTE: ZDI appears to claim that CVE-2015-3253 and CVE-2015-5377 are the same vulnerability
Query: Sigma rule for Executes SCT script using scrobj.dll from a command in entered into a specially prepared INF file.
Matching passage: Sigma rule: Executes SCT script using scrobj.dll from a command in entered into a specially prepared INF file.. Logsource: windows / process_creation. Rule: title: InfDefaultInstall.exe .inf Execution id: ce7cf472-6fcc-490a-9481-3786840b5d9b status: test description: Executes SCT script using scrobj.dll from a command in entered into a specially prepared INF file. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md#atomic-test-4---infdefaultinstallexe-inf-execution - https://lolbas-project.github.io/lolbas/Binaries/Infdefaultinstall/ author: frack113 date: 2021-07-13 modified: 2022-10-09 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - 'InfDefaultInstall.exe ' - '.inf' condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of Netcat. Adversaries may use a non-application layer protocol for communication between host and C2. Logsource: windows / process_creation. Rule: title: PUA - Netcat Suspicious Execution id: e31033fc-33f0-4020-9a16-faf9b31cbf08 status: test description: Detects execution of Netcat. Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network references: - https://nmap.org/ncat/ - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1095/T1095.md - https://www.revshells.com/ author: frack113, Florian Roth (Nextron Systems) date: 2021-07-21 modified: 2023-02-08 tags: - attack.command-and-control - attack.t1095 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: - \nc.exe - \ncat.exe - \netcat.exe selection_cmdline: CommandLine|contains: - ' -lvp ' - ' -lvnp' - ' -l -v -p ' - ' -lv -p ' - ' -l --proxy-type http ' - ' -vnl --exec ' - ' -vnl -e ' - ' --lua-exec ' - ' --sh-exec ' condition: 1 of selection_* falsepositives: - Legitimate ncat use level: high
Query: risk of Google Chrome before 42.0.2311.90 does not always ask the user before proceeding with CONTENT_SETTINGS_TYPE_FULLSCREEN and CONTENT_SETTINGS_TYPE_MOUSELOCK changes, which allows use
Matching passage: CVE-2015-3336. CWE: CWE-264. CVSS: 4.300000190734863. Google Chrome before 42.0.2311.90 does not always ask the user before proceeding with CONTENT_SETTINGS_TYPE_FULLSCREEN and CONTENT_SETTINGS_TYPE_MOUSELOCK changes, which allows user-assisted remote attackers to cause a denial of service (UI disruption) by constructing a crafted HTML document containing JavaScript code with requestFullScreen and requestPointerLock calls, and arranging for the user to access this document with a file: URL.
Near-miss passage: CVE-2015-5682. CWE: CWE-264. CVSS: 7.5. upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to create arbitrary directories via vectors related to the targetDir variable.
Query: risk of Gummi 0.6.5 allows local users to write to arbitrary files via a symlink attack on a temporary dot file that uses the name of an existing file and a (1) .aux, (2) .log, (3) .out, (
Matching passage: CVE-2015-7758. CWE: CWE-59. CVSS: 3.299999952316284. Gummi 0.6.5 allows local users to write to arbitrary files via a symlink attack on a temporary dot file that uses the name of an existing file and a (1) .aux, (2) .log, (3) .out, (4) .pdf, or (5) .toc extension for the file name, as demonstrated by .thesis.tex.aux.
Near-miss passage: CVE-2015-7724. CWE: CWE-59. CVSS: 7.800000190734863. AMD fglrx-driver before 15.9 allows local users to gain privileges via a symlink attack. NOTE: This vulnerability exists due to an incomplete fix for CVE-2015-7723.
Query: detection rule: Detects usage of certain functions and keywords that are used to manipulate security descriptors in order to potentially
Matching passage: Sigma rule: Detects usage of certain functions and keywords that are used to manipulate security descriptors in order to potentially. Logsource: windows / ps_script. Rule: title: Potential Persistence Via Security Descriptors - ScriptBlock id: 2f77047c-e6e9-4c11-b088-a3de399524cd status: test description: Detects usage of certain functions and keywords that are used to manipulate security descriptors in order to potentially set a backdoor. As seen used in the DAMP project. references: - https://github.com/HarmJ0y/DAMP author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-05 tags: - attack.persistence - attack.privilege-escalation - attack.defense-impairment logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - win32_Trustee - win32_Ace - .AccessMask - .AceType - .SetSecurityDescriptor ScriptBlockText|contains: - \Lsa\JD - \Lsa\Skew1 - \Lsa\Data - \Lsa\GBG condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects Obfuscated use of Environment Variables to execute PowerShell. Logsource: windows / process_creation. Rule: title: Invoke-Obfuscation VAR+ Launcher id: 27aec9c9-dbb0-4939-8422-1742242471d0 status: test description: Detects Obfuscated use of Environment Variables to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-15 modified: 2024-04-15 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: CommandLine|re: cmd.{0,5}(?:/c|/r)(?:\s|)\"set\s[a-zA-Z]{3,6}.*(?:\{\d\}){1,}\\\"\s+?\-f(?:.*\)){1,}.*\" condition: selection falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-0807
Matching passage: CVE-2015-0807. CWE: CWE-352. CVSS: 6.800000190734863. The navigator.sendBeacon implementation in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 processes HTTP 30x status codes for redirects after a preflight request has occurred, which allows remote attackers to bypass intended CORS access-control checks and conduct cross-site request forgery (CSRF) attacks via a crafted web site, a similar issue to CVE-2014-8638.
Near-miss passage: CVE-2015-3624. CWE: CWE-352. CVSS: 5.800000190734863. Cross-site request forgery (CSRF) vulnerability in Test/WorkArea/DmsMenu/menuActions/MenuActions.aspx in Ektron Content Management System (CMS) before 9.10 SP1 (Build 9.1.0.184.1.120) allows remote attackers to hijack the authentication of content administrators for requests that delete content via a delete action.
Query: CVE similar to CVE-2015-2080
Matching passage: CVE-2015-2080. CWE: CWE-200. CVSS: 7.5. The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.
Near-miss passage: CVE-2015-0583. CWE: CWE-200. CVSS: 5.0. Cisco WebEx Meeting Center does not properly restrict the content of URLs, which allows remote attackers to obtain sensitive information via vectors related to file: URIs, aka Bug ID CSCus18281.
Query: patch priority for CVE-2015-3084
Matching passage: CVE-2015-3084. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-3077 and CVE-2015-3086.
Near-miss passage: CVE-2015-8630. CWE: UNKNOWN. CVSS: 7.5. The (1) kadm5_create_principal_3 and (2) kadm5_modify_principal functions in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.4 and 1.14.x before 1.14.1 allow remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by specifying KADM5_POLICY with a NULL policy name.
Query: describe CVE-2015-6370
Matching passage: CVE-2015-6370. CWE: CWE-78. CVSS: 7.199999809265137. The Management I/O (MIO) component in Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices allows local users to execute arbitrary OS commands as root via crafted CLI input, aka Bug ID CSCux10578.
Near-miss passage: CVE-2015-6554. CWE: CWE-78. CVSS: 7.5. Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP3 allows remote attackers to execute arbitrary OS commands via crafted data.