alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Detects remote thread creation in "KeePass.exe" which could indicates potential password dumping activity
Matching passage: Sigma rule: Detects remote thread creation in "KeePass.exe" which could indicates potential password dumping activity. Logsource: windows / create_remote_thread. Rule: title: Remote Thread Created In KeePass.EXE id: 77564cc2-7382-438b-a7f6-395c2ae53b9a status: test description: Detects remote thread creation in "KeePass.exe" which could indicates potential password dumping activity references: - https://www.cisa.gov/uscert/ncas/alerts/aa20-259a - https://github.com/denandz/KeeFarce - https://github.com/GhostPack/KeeThief author: Timon Hackenjos date: 2022-04-22 modified: 2023-05-05 tags: - attack.credential-access - attack.t1555.005 logsource: product: windows category: create_remote_thread detection: selection: TargetImage|endswith: \KeePass.exe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the enumeration of other remote systems.. Logsource: macos / process_creation. Rule: title: Macos Remote System Discovery id: 10227522-8429-47e6-a301-f2b2d014e7ad status: test description: Detects the enumeration of other remote systems. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md author: Alejandro Ortuno, oscd.community date: 2020-10-22 modified: 2021-11-27 tags: - attack.discovery - attack.t1018 logsource: category: process_creation product: macos detection: selection_1: Image|endswith: /arp CommandLine|contains: -a selection_2: Image|endswith: /ping CommandLine|contains: - ' 10.' - ' 192.168.' - ' 172.16.' - ' 172.17.' - ' 172.18.' - ' 172.19.' - ' 172.20.' - ' 172.21.' - ' 172.22.' - ' 172.23.' - ' 172.24.' - ' 172.25.' - ' 172.26.' - ' 172.27.' - ' 172.28.' - ' 172.29.' - ' 172.30.' - ' 172.31.' - ' 127.' - ' 169.254.' condition: 1 of selection* falsepositives: - Legitimate administration activities level: informational
Query: exploit Cross-site scripting (XSS) vulnerability in guide-park.com BBS X102 1.03 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Matching passage: CVE-2015-2985. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in guide-park.com BBS X102 1.03 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-3447. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in macIpSpoofView.html in Dell SonicWall SonicOS 7.5.0.12 and 6.x allow remote attackers to inject arbitrary web script or HTML via the (1) searchSpoof or (2) searchSpoofIpDet parameter.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects a Powershell process that contains download commands in its command line string. Logsource: windows / process_creation. Rule: title: PowerShell Download Pattern id: 3b6ab547-8ec2-4991-b9d2-2b06702a48d7 related: - id: e6c54d94-498c-4562-a37c-b469d8e9a275 type: derived - id: 8f70ac5f-1f6f-4f8e-b454-db19561216c5 type: obsolete status: test description: Detects a Powershell process that contains download commands in its command line string references: - https://blog.redteam.pl/2020/06/black-kingdom-ransomware.html - https://lab52.io/blog/winter-vivern-all-summer/ - https://hatching.io/blog/powershell-analysis/ author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro date: 2019-01-16 modified: 2025-10-20 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell_ise.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell_ISE.EXE - PowerShell.EXE - pwsh.dll selection_cli: CommandLine|contains|all: - new-object - net.webclient). - download CommandLine|contains: - string( - file( condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage. Logsource: windows / network_connection. Rule: title: Uncommon Outbound Kerberos Connection id: e54979bd-c5f9-4d6c-967b-a04b19ac4c74 related: - id: eca91c7c-9214-47b9-b4c5-cb1d7e4f2350 type: similar status: test description: 'Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation. ' references: - https://github.com/GhostPack/Rubeus author: Ilyas Ochkov, oscd.community date: 2019-10-24 modified: 2024-03-15 tags: - attack.credential-access - attack.t1558 - attack.lateral-movement - attack.t1550.003 logsource: category: network_connection product: windows detection: selection: DestinationPort: 88 Initiated: 'true' filter_main_lsass: Image: C:\Windows\System32\lsass.exe filter_optional_chrome: Image: - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe - C:\Program Files\Google\Chrome\Application\chrome.exe filter_optional_firefox: Image: - C:\Program Files (x86)\Mozilla Firefox\firefox.exe - C:\Program Files\Mozilla Firefox\firefox.exe filter_optional_tomcat: Image|endswith: \tomcat\bin\tomcat8.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Web Browsers and third party application might generate similar activity. An initial baseline is required. level: medium
Query: Sigma rule for Detects process creation events that use the Sysnative folder (common for CobaltStrike spawns)
Matching passage: Sigma rule: Detects process creation events that use the Sysnative folder (common for CobaltStrike spawns). Logsource: windows / process_creation. Rule: title: Process Creation Using Sysnative Folder id: 3c1b5fb0-c72f-45ba-abd1-4d4c353144ab status: test description: Detects process creation events that use the Sysnative folder (common for CobaltStrike spawns) references: - https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/ author: Max Altgelt (Nextron Systems) date: 2022-08-23 modified: 2025-10-08 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: category: process_creation product: windows detection: selection: - CommandLine|contains: :\Windows\Sysnative\ - Image|contains: :\Windows\Sysnative\ filter_main_ngen: Image|contains: - C:\Windows\Microsoft.NET\Framework64\v - C:\Windows\Microsoft.NET\Framework\v - C:\Windows\Microsoft.NET\FrameworkArm\v - C:\Windows\Microsoft.NET\FrameworkArm64\v Image|endswith: \ngen.exe CommandLine|contains: install filter_optional_xampp: CommandLine|contains|all: - '"C:\Windows\sysnative\cmd.exe"' - \xampp\ - \catalina_start.bat condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Compress target file into a cab file stored in the Alternate Data Stream (ADS) of the target file.. Logsource: windows / process_creation. Rule: title: Suspicious Diantz Alternate Data Stream Execution id: 6b369ced-4b1d-48f1-b427-fdc0de0790bd status: test description: Compress target file into a cab file stored in the Alternate Data Stream (ADS) of the target file. references: - https://lolbas-project.github.io/lolbas/Binaries/Diantz/ author: frack113 date: 2021-11-26 modified: 2022-12-31 tags: - attack.stealth - attack.t1564.004 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - diantz.exe - .cab CommandLine|re: :[^\\] condition: selection falsepositives: - Very Possible level: medium
Query: CVE similar to CVE-2015-7237
Matching passage: CVE-2015-7237. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in the remote log viewing functionality in McAfee Agent (MA) 5.x before 5.0.2 allows remote attackers to obtain sensitive information via unspecified vectors.
Near-miss passage: CVE-2015-9275. CWE: CWE-22. CVSS: 5.300000190734863. ARC 5.21q allows directory traversal via a full pathname in an archive file.
Query: risk of The Task Scheduler in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly co
Matching passage: CVE-2015-0084. CWE: CWE-254. CVSS: 2.0999999046325684. The Task Scheduler in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly constrain impersonation levels, which allows local users to bypass intended restrictions on launching executable files via a crafted task, aka "Task Scheduler Security Feature Bypass Vulnerability."
Near-miss passage: CVE-2015-1158. CWE: CWE-254. CVSS: 10.0. The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-host-name attributes, which allows remote attackers to trigger data corruption for reference-counted strings via a crafted (1) IPP_CREATE_JOB or (2) IPP_PRINT_JOB request, as demonstrated by replacing the configuration file and consequently executing arbitrary code.
Query: rule covering Detects the deletion of S3 buckets in AWS CloudTrail logs. Monitoring the deletion of S3 buckets is critical for securit
Matching passage: Sigma rule: Detects the deletion of S3 buckets in AWS CloudTrail logs. Monitoring the deletion of S3 buckets is critical for securit. Logsource: aws / cloudtrail. Rule: title: AWS Bucket Deleted id: 39c9f26d-6e3b-4dbb-9c7a-4154b0281112 status: experimental description: 'Detects the deletion of S3 buckets in AWS CloudTrail logs. Monitoring the deletion of S3 buckets is critical for security and data integrity, as it may indicate potential data loss or unauthorized access attempts. ' references: - https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucket.html - https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/delete-bucket.html author: Ivan Saakov, Nasreddine Bencherchali date: 2025-10-19 tags: - attack.stealth logsource: product: aws service: cloudtrail detection: selection_event_name: eventName: DeleteBucket selection_status_success: errorCode: Success selection_status_null: errorCode: null condition: selection_event_name and 1 of selection_status_* falsepositives: - During maintenance operations or testing, authorized administrators may delete S3 buckets as part of routine data management or cleanup activities. level: medium
Near-miss passage: Sigma rule: Detects a typical pattern of a CobaltStrike BOF which inject into other processes. Logsource: windows / process_access. Rule: title: HackTool - CobaltStrike BOF Injection Pattern id: 09706624-b7f6-455d-9d02-adee024cee1d status: test description: Detects a typical pattern of a CobaltStrike BOF which inject into other processes references: - https://github.com/boku7/injectAmsiBypass - https://github.com/boku7/spawn author: Christian Burkard (Nextron Systems) date: 2021-08-04 modified: 2023-11-28 tags: - attack.execution - attack.defense-impairment - attack.t1106 - attack.t1685 logsource: category: process_access product: windows detection: selection: CallTrace|re: ^C:\\Windows\\SYSTEM32\\ntdll\.dll\+[a-z0-9]{4,6}\|C:\\Windows\\System32\\KERNELBASE\.dll\+[a-z0-9]{4,6}\|UNKNOWN\([A-Z0-9]{16}\)$ GrantedAccess: - '0x1028' - '0x1fffff' condition: selection falsepositives: - Unknown level: high
Query: Persistence mechanism resembling Junk Data
Matching passage: T1001.001 Junk Data. Tactics: command and control. Description: Adversaries may add junk data to protocols used for command and control to make detection more difficult.(Citation: FireEye SUNBURST Backdoor December 2020) By adding random or meaningless data to the protocols used for command and control, adversaries can prevent trivial methods for decoding, deciphering, or otherwise analyzing the traffic. Examples may include appending/prepending data with junk characters or writing junk characters between significant characters.
Near-miss passage: T1001.003 Protocol or Service Impersonation. Tactics: command and control. Description: Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic. Adversaries may impersonate a fake SSL/TLS handshake to make it look like subsequent traffic is SSL/TLS encrypted, potentially interfering with some security tooling, or to make the traffic look like it is related with a trusted entity. Adversaries may also leverage legitimate protocols to impersonate expected web traffic or trusted services. For example, adversaries may manipulate HTTP headers, URI endpoints, SSL certificates, and transmitted data to disguise C2 communications or mimic legitimate services such as Gmail, Google Drive, and Yahoo Messenger.(Citation: ESET Okrum July 2019)(Citation: Malleable-C2-U42)
Query: common weakness: Invokable Control Element in Multi-Thread Context with non-Final Static Storable or Member Element
Matching passage: CWE-1058 Invokable Control Element in Multi-Thread Context with non-Final Static Storable or Member Element. The code contains a function or method that operates in a multi-threaded environment but owns an unsafe non-final static storable or member data element.
Near-miss passage: CWE-475 Undefined Behavior for Input to API. The behavior of this function is undefined unless its control parameter is set to a specific value.
Query: vulnerability: SQL injection vulnerability in modules/module.ab-testing.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to execute arbitrary SQL comma
Matching passage: CVE-2015-4064. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in modules/module.ab-testing.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the post parameter in an edit delete-variation action to wp-admin/post.php.
Near-miss passage: CVE-2015-1513. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in SIPhone Enterprise PBX allows remote attackers to execute arbitrary SQL commands via the Username.
Query: risk of Unspecified vulnerability in Oracle Sun Solaris 10 and 11.2 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to rmformat.
Matching passage: CVE-2015-2631. CWE: UNKNOWN. CVSS: 7.199999809265137. Unspecified vulnerability in Oracle Sun Solaris 10 and 11.2 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to rmformat.
Near-miss passage: CVE-2015-0884. CWE: UNKNOWN. CVSS: 6.900000095367432. Unquoted Windows search path vulnerability in Toshiba Bluetooth Stack for Windows before 9.10.32(T) and Service Station before 2.2.14 allows local users to gain privileges via a Trojan horse application with a name composed of an initial substring of a path that contains a space character.
Query: Sigma YAML for github / audit
Matching passage: Sigma rule: Detects when changes are made to the SSH certificate configuration of the organization.. Logsource: github / audit. Rule: title: Github SSH Certificate Configuration Changed id: 2f575940-d85e-4ddc-af13-17dad6f1a0ef status: test description: Detects when changes are made to the SSH certificate configuration of the organization. references: - https://docs.github.com/en/enterprise-cloud@latest/organizations/managing-git-access-to-your-organizations-repositories/about-ssh-certificate-authorities - https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#ssh_certificate_authority author: Romain Gaillard (@romain-gaillard) date: 2024-07-29 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation - attack.stealth - attack.t1078.004 logsource: product: github service: audit definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming' detection: selection: action: - ssh_certificate_authority.create - ssh_certificate_requirement.disable condition: selection falsepositives: - Allowed administrative activities. level: medium
Near-miss passage: Sigma rule: Detects suspicious PowerShell download patterns that are often used in malicious scripts, stagers or downloaders (make s. Logsource: windows / process_creation. Rule: title: Suspicious PowerShell Download and Execute Pattern id: e6c54d94-498c-4562-a37c-b469d8e9a275 related: - id: 3b6ab547-8ec2-4991-b9d2-2b06702a48d7 type: derived status: test description: Detects suspicious PowerShell download patterns that are often used in malicious scripts, stagers or downloaders (make sure that your backend applies the strings case-insensitive) references: - https://gist.github.com/jivoi/c354eaaf3019352ce32522f916c03d70 - https://www.trendmicro.com/en_us/research/22/j/lv-ransomware-exploits-proxyshell-in-attack.html author: Florian Roth (Nextron Systems) date: 2022-02-28 modified: 2022-03-01 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - IEX ((New-Object Net.WebClient).DownloadString - IEX (New-Object Net.WebClient).DownloadString - IEX((New-Object Net.WebClient).DownloadString - IEX(New-Object Net.WebClient).DownloadString - ' -command (New-Object System.Net.WebClient).DownloadFile(' - ' -c (New-Object System.Net.WebClient).DownloadFile(' condition: selection falsepositives: - Software installers that pull packages from remote systems and execute them level: high
Query: Multiple failed authentications followed by System Script Proxy Execution
Matching passage: T1216 System Script Proxy Execution. Tactics: stealth. Description: Adversaries may use trusted scripts, often signed with certificates, to proxy the execution of malicious files. Several Microsoft signed scripts that have been downloaded from Microsoft or are default on Windows installations can be used to proxy execution of other files.(Citation: LOLBAS Project) This behavior may be abused by adversaries to execute malicious files that could bypass application control and signature validation on systems.(Citation: GitHub Ultimate AppLocker Bypass List)
Near-miss passage: T1216.001 PubPrn. Tactics: stealth. Description: Adversaries may use PubPrn to proxy execution of malicious remote files. PubPrn.vbs is a [Visual Basic](https://attack.mitre.org/techniques/T1059/005) script that publishes a printer to Active Directory Domain Services. The script may be signed by Microsoft and is commonly executed through the [Windows Command Shell](https://attack.mitre.org/techniques/T1059/003) via <code>Cscript.exe</code>. For example, the following code publishes a printer within the specified domain: <code>cscript pubprn Printer1 LDAP://CN=Container1,DC=Domain1,DC=Com</code>.(Citation: pubprn) Adversaries may abuse PubPrn to execute malicious payloads hosted on remote sites.(Citation: Enigma0x3 PubPrn Bypass) To do so, adversaries may set the second <code>script:</code> parameter to reference a scriptlet file (.sct) hosted on a remote site. An example command is <code>pubprn.vbs 127.0.0.1 script:https://mydomain.com/folder/file.sct</code>. This behavior may bypass signature validation restrictions and application control solutions that do not account for abuse of this script. In later versions of Windows (10+), <code>PubPrn.vbs</code> has been updated to prevent proxying execution from a remote site. This is done by limiting the protocol specified in the second parameter to <code>LDAP://</code>, vice the <code>script:</code> moniker which could be used to reference remote code via HTTP(S).
Query: exploit Heap-based buffer overflow in the verify_vbr_checksum function in exfatfsck in exfat-utils before 1.2.1 allows remote attackers to cause a denial of service (infinite loop) or poss
Matching passage: CVE-2015-8026. CWE: CWE-119. CVSS: 7.800000190734863. Heap-based buffer overflow in the verify_vbr_checksum function in exfatfsck in exfat-utils before 1.2.1 allows remote attackers to cause a denial of service (infinite loop) or possibly execute arbitrary code via a crafted filesystem.
Near-miss passage: CVE-2015-2520. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel for Mac 2011 and 2016, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Query: CVE similar to CVE-2015-6297
Matching passage: CVE-2015-6297. CWE: CWE-399. CVSS: 5.0. The DHCPv6 server in Cisco IOS on ASR 9000 devices with software 5.2.0 Base allows remote attackers to cause a denial of service (process reset) via crafted packets, aka Bug ID CSCun36525.
Near-miss passage: CVE-2015-0022. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0017, CVE-2015-0020, CVE-2015-0026, CVE-2015-0030, CVE-2015-0031, CVE-2015-0036, and CVE-2015-0041.
Query: CVE similar to CVE-2015-6948
Matching passage: CVE-2015-6948. CWE: CWE-119. CVSS: 6.800000190734863. Heap-based buffer overflow in the Microsoft Word document conversion feature in Corel WordPerfect allows remote attackers to execute arbitrary code via a crafted document.
Near-miss passage: CVE-2015-9070. CWE: CWE-119. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer over-read vulnerability exists in a TrustZone syscall.