alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Detects potential DLL sideloading of "goopdate.dll", a DLL used by googleupdate.exe
Matching passage: Sigma rule: Detects potential DLL sideloading of "goopdate.dll", a DLL used by googleupdate.exe. Logsource: windows / image_load. Rule: title: Potential Goopdate.DLL Sideloading id: b6188d2f-b3c4-4d2c-a17d-9706e0851af0 status: test description: Detects potential DLL sideloading of "goopdate.dll", a DLL used by googleupdate.exe references: - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/goofy-guineapig/NCSC-MAR-Goofy-Guineapig.pdf author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2023-05-15 modified: 2025-10-07 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \goopdate.dll filter_main_generic: ImageLoaded|startswith: - C:\Program Files (x86)\ - C:\Program Files\ filter_optional_dropbox_installer_temp: Image|contains|all: - \AppData\Local\Temp\GUM - .tmp\Dropbox ImageLoaded|contains|all: - \AppData\Local\Temp\GUM - .tmp\goopdate.dll filter_optional_googleupdate_temp: Image|contains: - \AppData\Local\Temp\GUM - :\Windows\SystemTemp\GUM Image|endswith: .tmp\GoogleUpdate.exe ImageLoaded|contains: - \AppData\Local\Temp\GUM - :\Windows\SystemTemp\GUM condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - False positives are expected from Google Chrome installations running from user locations (AppData) and other custom locations. Apply additional filters accordingly. - Other third party chromium browsers located in AppData level: medium
Near-miss passage: Sigma rule: Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing.. Logsource: windows / process_creation. Rule: title: SQLite Chromium Profile Data DB Access id: 24c77512-782b-448a-8950-eddb0785fc71 status: test description: Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing. references: - https://github.com/redcanaryco/atomic-red-team/blob/84d9edaaaa2c5511144521b0e4af726d1c7276ce/atomics/T1539/T1539.md#atomic-test-2---steal-chrome-cookies-windows - https://blog.cyble.com/2022/04/21/prynt-stealer-a-new-info-stealer-performing-clipper-and-keylogger-activities/ author: TropChaud date: 2022-12-19 modified: 2023-01-19 tags: - attack.credential-access - attack.t1539 - attack.t1555.003 - attack.collection - attack.t1005 logsource: category: process_creation product: windows detection: selection_sql: - Product: SQLite - Image|endswith: - \sqlite.exe - \sqlite3.exe selection_chromium: CommandLine|contains: - \User Data\ - \Opera Software\ - \ChromiumViewer\ selection_data: CommandLine|contains: - Login Data - Cookies - Web Data - History - Bookmarks condition: all of selection_* falsepositives: - Unknown level: high
Query: exploit The olevmedia-shortcodes plugin before 1.1.9 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=omsc_popup id parameter.
Matching passage: CVE-2015-9421. CWE: CWE-352. CVSS: 6.5. The olevmedia-shortcodes plugin before 1.1.9 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=omsc_popup id parameter.
Near-miss passage: CVE-2015-9434. CWE: CWE-352. CVSS: 6.5. The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=kwlogos&page=kwlogos_settings tab or tab_flags_order parameter.
Query: describe CVE-2015-1252
Matching passage: CVE-2015-1252. CWE: CWE-119. CVSS: 7.5. common/partial_circular_buffer.cc in Google Chrome before 43.0.2357.65 does not properly handle wraps, which allows remote attackers to bypass a sandbox protection mechanism or cause a denial of service (out-of-bounds write) via vectors that trigger a write operation with a large amount of data, related to the PartialCircularBuffer::Write and PartialCircularBuffer::DoWrite functions.
Near-miss passage: CVE-2015-7086. CWE: CWE-119. CVSS: 6.599999904632568. Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7087, CVE-2015-7088, CVE-2015-7089, CVE-2015-7090, CVE-2015-7091, CVE-2015-7092, and CVE-2015-7117.
Query: exploit The rule-update feature in Cisco FireSIGHT Management Center (MC) 5.2 through 5.4.0.1 does not verify the X.509 certificate of the support.sourcefire.com SSL server, which allows m
Matching passage: CVE-2015-6357. CWE: CWE-20. CVSS: 6.800000190734863. The rule-update feature in Cisco FireSIGHT Management Center (MC) 5.2 through 5.4.0.1 does not verify the X.509 certificate of the support.sourcefire.com SSL server, which allows man-in-the-middle attackers to spoof this server and provide an invalid package, and consequently execute arbitrary code, via a crafted certificate, aka Bug ID CSCuw06444.
Near-miss passage: CVE-2015-0759. CWE: CWE-20. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Cisco Headend Digital Broadband Delivery System allows remote attackers to hijack the authentication of arbitrary users.
Query: Sigma YAML for windows / dns_query
Matching passage: Sigma rule: Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration. Logsource: windows / dns_query. Rule: title: DNS Query To Ufile.io id: 1cbbeaaf-3c8c-4e4c-9d72-49485b6a176b related: - id: 090ffaad-c01a-4879-850c-6d57da98452d type: similar status: test description: Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration references: - https://thedfirreport.com/2021/12/13/diavol-ransomware/ author: yatinwad, TheDFIRReport date: 2022-06-23 modified: 2023-09-18 tags: - attack.exfiltration - attack.t1567.002 logsource: product: windows category: dns_query detection: selection: QueryName|contains: ufile.io condition: selection falsepositives: - DNS queries for "ufile" are not malicious by nature necessarily. Investigate the source to determine the necessary actions to take level: low
Near-miss passage: Sigma rule: Detects specific techniques often seen used inside of PowerShell scripts to obfscuate Alias creation. Logsource: windows / ps_script. Rule: title: Potential PowerShell Obfuscation Using Character Join id: e8314f79-564d-4f79-bc13-fbc0bf2660d8 related: - id: 96cd126d-f970-49c4-848a-da3a09f55c55 type: derived status: test description: Detects specific techniques often seen used inside of PowerShell scripts to obfscuate Alias creation references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-09 tags: - attack.execution - attack.stealth - attack.t1027 - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - -Alias - ' -Value (-join(' condition: selection falsepositives: - Unknown level: low
Query: Sigma rule for Detects disabling security tools
Matching passage: Sigma rule: Detects disabling security tools. Logsource: linux / syslog. Rule: title: Disabling Security Tools - Builtin id: 49f5dfc1-f92e-4d34-96fa-feba3f6acf36 related: - id: e3a8a052-111f-4606-9aee-f28ebeb76776 type: derived status: test description: Detects disabling security tools references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md author: Ömer Günal, Alejandro Ortuno, oscd.community date: 2020-06-17 modified: 2022-11-26 tags: - attack.defense-impairment - attack.t1686 logsource: product: linux service: syslog detection: keywords: - stopping iptables - stopping ip6tables - stopping firewalld - stopping cbdaemon - stopping falcon-sensor condition: keywords falsepositives: - Legitimate administration activities level: medium
Near-miss passage: Sigma rule: Detects the presence of the "u202+E" character, which causes a terminal, browser, or operating system to render text in. Logsource: windows / process_creation. Rule: title: Potential Defense Evasion Via Right-to-Left Override id: ad691d92-15f2-4181-9aa4-723c74f9ddc3 related: - id: e0552b19-5a83-4222-b141-b36184bb8d79 type: derived - id: 584bca0f-3608-4402-80fd-4075ff6072e3 type: derived status: test description: 'Detects the presence of the "u202+E" character, which causes a terminal, browser, or operating system to render text in a right-to-left sequence. This character is used as an obfuscation and masquerading techniques by adversaries to trick users into opening malicious files. ' references: - https://redcanary.com/blog/right-to-left-override/ - https://www.malwarebytes.com/blog/news/2014/01/the-rtlo-method - https://unicode-explorer.com/c/202E - https://tria.ge/241015-l98snsyeje/behavioral2 - https://unprotect.it/technique/right-to-left-override-rlo-extension-spoofing/ author: Micah Babinski, @micahbabinski, Swachchhanda Shrawan Poudel (Nextron Systems), Luc Génaux date: 2023-02-15 modified: 2026-03-20 tags: - attack.stealth - attack.t1036.002 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - \u202e - '[U+202E]' - ‮ condition: selection falsepositives: - Commandlines that contains scriptures such as arabic or hebrew might make use of this character level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_susp_right_to_left_override/info.yml
Query: risk of The archive_string_append function in archive_string.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted cab files, related to "
Matching passage: CVE-2015-8918. CWE: CWE-119. CVSS: 7.5. The archive_string_append function in archive_string.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted cab files, related to "overlapping memcpy."
Near-miss passage: CVE-2015-3111. CWE: CWE-119. CVSS: 10.0. Heap-based buffer overflow in Adobe Photoshop CC before 16.0 (aka 2015.0.0) and Adobe Bridge CC before 6.11 allows attackers to execute arbitrary code via unspecified vectors.
Query: risk of A vulnerability was found in NREL api-umbrella-web 0.7.1. It has been classified as problematic. This affects an unknown part of the component Admin Data Table Handler. The manipul
Matching passage: CVE-2015-10080. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability was found in NREL api-umbrella-web 0.7.1. It has been classified as problematic. This affects an unknown part of the component Admin Data Table Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 0.8.0 is able to address this issue. The patch is named f53a9fb87e10c457f0f3dd4f2af24d3b2f21b3ca. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-221487.
Near-miss passage: CVE-2015-9297. CWE: CWE-79. CVSS: 6.099999904632568. The events-manager plugin before 5.6 for WordPress has XSS.
Query: detect Detects instances of svchost.exe running with an unusual or uncommon command line parameter by excluding known legitimat in logs
Matching passage: Sigma rule: Detects instances of svchost.exe running with an unusual or uncommon command line parameter by excluding known legitimat. Logsource: windows / process_creation. Rule: title: Uncommon Svchost Command Line Parameter id: f17211f1-1f24-4d0c-829f-31e28dc93cdd status: experimental description: 'Detects instances of svchost.exe running with an unusual or uncommon command line parameter by excluding known legitimate or common patterns. This could point at a file masquerading as svchost, a process injection, or hollowing of a legitimate svchost instance. ' references: - https://cardinalops.com/blog/the-art-of-anomaly-hunting-patterns-detection/ - https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware - https://cloud.google.com/blog/topics/threat-intelligence/apt41-initiates-global-intrusion-campaign-using-multiple-exploits/ - https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf author: Liran Ravich date: 2025-11-14 modified: 2026-03-23 tags: - attack.privilege-escalation - attack.stealth - attack.t1036.005 - attack.t1055 - attack.t1055.012 logsource: category: process_creation product: windows detection: selection: Image|endswith: \svchost.exe filter_main_flags: CommandLine|re: -k\s\w{1,64}(?:\s?(?:-p|-s))? filter_main_empty: CommandLine: '' filter_main_null: CommandLine: null filter_optional_defender: ParentImage|endswith: \MsMpEng.exe CommandLine|contains: svchost.exe filter_optional_mrt: ParentImage|endswith: \MRT.exe CommandLine: svchost.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects User Agent strings that end with an equal sign, which can be a sign of base64 encoding.. Logsource: proxy. Rule: title: Potential Base64 Encoded User-Agent id: 894a8613-cf12-48b3-8e57-9085f54aa0c3 related: - id: d443095b-a221-4957-a2c4-cd1756c9b747 type: derived status: test description: Detects User Agent strings that end with an equal sign, which can be a sign of base64 encoding. references: - https://blogs.jpcert.or.jp/en/2022/07/yamabot.html - https://deviceatlas.com/blog/list-of-user-agent-strings#desktop author: Florian Roth (Nextron Systems), Brian Ingram (update) date: 2022-07-08 modified: 2023-05-04 tags: - attack.command-and-control - attack.t1071.001 logsource: category: proxy detection: selection: c-useragent|endswith: '=' condition: selection falsepositives: - Unknown level: medium
Query: containment actions for Persistence mechanism resembling Indicator Removal from Tools
Matching passage: Playbook for T1027.005 Indicator Removal from Tools. 1) Validate alert telemetry against T1027.005. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed. They can modify the tool by removing the indicator and using the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems. A good example of this is when malware is detected with a file signature
Near-miss passage: Playbook for T1027.016 Junk Code Insertion. Different response path focused on stealth.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Foundation 2013 SP1 and SharePoint Server 2013 SP1 allows remote attackers to inject arbitrary web script or HTML v
Matching passage: CVE-2015-1653. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Foundation 2013 SP1 and SharePoint Server 2013 SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted request, aka "Microsoft SharePoint XSS Vulnerability."
Near-miss passage: CVE-2015-9362. CWE: CWE-79. CVSS: 6.099999904632568. The Post Connector plugin before 1.0.4 for WordPress has XSS via add_query_arg() and remove_query_arg().
Query: patch priority for CVE-2015-6603
Matching passage: CVE-2015-6603. CWE: CWE-119. CVSS: 10.0. libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23227354.
Near-miss passage: CVE-2015-8241. CWE: CWE-119. CVSS: 6.400000095367432. The xmlNextChar function in libxml2 2.9.2 does not properly check the state, which allows context-dependent attackers to cause a denial of service (heap-based buffer over-read and application crash) or obtain sensitive information via crafted XML data.
Query: patch priority for CVE-2015-5803
Matching passage: CVE-2015-5803. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Near-miss passage: CVE-2015-1727. CWE: CWE-119. CVSS: 7.199999809265137. Buffer overflow in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Win32k Pool Buffer Overflow Vulnerability."
Query: common weakness: Path Traversal: '/absolute/pathname/here'
Matching passage: CWE-37 Path Traversal: '/absolute/pathname/here'. The product accepts input in the form of a slash absolute path ('/absolute/pathname/here') without appropriate validation, which can allow an attacker to traverse the file system to unintended locations or access arbitrary files.
Near-miss passage: CWE-640 Weak Password Recovery Mechanism for Forgotten Password. The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
Query: risk of Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Ex
Matching passage: CVE-2015-1744. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1735, CVE-2015-1740, CVE-2015-1745, and CVE-2015-1766.
Near-miss passage: CVE-2015-0283. CWE: CWE-399. CVSS: 7.800000190734863. The slapi-nis plug-in before 0.54.2 does not properly reallocate memory when processing user accounts, which allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a request for a (1) group with a large number of members or (2) user that belongs to a large number of groups.
Query: rule covering Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to
Matching passage: Sigma rule: Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to. Logsource: windows / registry_set. Rule: title: Outlook EnableUnsafeClientMailRules Setting Enabled - Registry id: 6763c6c8-bd01-4687-bc8d-4fa52cf8ba08 related: - id: c3cefdf4-6703-4e1c-bad8-bf422fc5015a type: similar - id: 55f0a3a1-846e-40eb-8273-677371b8d912 type: similar status: test description: Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to run applications or execute macros references: - https://support.microsoft.com/en-us/topic/how-to-control-the-rule-actions-to-start-an-application-or-run-a-macro-in-outlook-2016-and-outlook-2013-e4964b72-173c-959d-5d7b-ead562979048 - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=44 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-08 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Outlook\Security\EnableUnsafeClientMailRules Details: DWORD (0x00000001) condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious child processes of the Veeam service process. This could indicate potential RCE or SQL Injection.. Logsource: windows / process_creation. Rule: title: Suspicious Child Process Of Veeam Dabatase id: d55b793d-f847-4eea-b59a-5ab09908ac90 related: - id: 869b9ca7-9ea2-4a5a-8325-e80e62f75445 type: similar status: test description: Detects suspicious child processes of the Veeam service process. This could indicate potential RCE or SQL Injection. references: - https://labs.withsecure.com/publications/fin7-target-veeam-servers author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-04 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \sqlservr.exe ParentCommandLine|contains: VEEAMSQL selection_child_1: Image|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe - \wsl.exe - \wt.exe CommandLine|contains: - '-ex ' - bypass - cscript - DownloadString - http:// - https:// - mshta - regsvr32 - rundll32 - wscript - 'copy ' selection_child_2: Image|endswith: - \net.exe - \net1.exe - \netstat.exe - \nltest.exe - \ping.exe - \tasklist.exe - \whoami.exe condition: selection_parent and 1 of selection_child_* level: critical
Query: describe CVE-2015-0703
Matching passage: CVE-2015-0703. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the administrative web interface in Cisco Unified MeetingPlace 8.6(1.9) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCus95857.
Near-miss passage: CVE-2015-3660. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the PDF functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL in embedded PDF content.
Query: risk of Huawei MBB (Mobile Broadband) product E3272s with software versions earlier than E3272s-153TCPU-V200R002B491D09SP00C00 has a Denial of Service (DoS) vulnerability. An attacker coul
Matching passage: CVE-2015-7847. CWE: CWE-20. CVSS: 5.5. Huawei MBB (Mobile Broadband) product E3272s with software versions earlier than E3272s-153TCPU-V200R002B491D09SP00C00 has a Denial of Service (DoS) vulnerability. An attacker could send a malicious packet to the Common Gateway Interface (CGI) of a target device and make it fail while setting the port attribute, which causes a DoS attack.
Near-miss passage: CVE-2015-8552. CWE: CWE-20. CVSS: 4.400000095367432. The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain, allows local guest administrators to generate a continuous stream of WARN messages and cause a denial of service (disk consumption) by leveraging a system with access to a passed-through MSI or MSI-X capable physical PCI device and XEN_PCI_OP_enable_msi operations, aka "Linux pciback missing sanity checks."
Query: vulnerability: Microsoft Office Compatibility Pack SP3 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Matching passage: CVE-2015-1759. CWE: CWE-19. CVSS: 9.300000190734863. Microsoft Office Compatibility Pack SP3 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-1270. CWE: CWE-19. CVSS: 6.800000190734863. The ucnv_io_getConverterName function in common/ucnv_io.cpp in International Components for Unicode (ICU), as used in Google Chrome before 44.0.2403.89, mishandles converter names with initial x- substrings, which allows remote attackers to cause a denial of service (read of uninitialized memory) or possibly have unspecified other impact via a crafted file.