alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Detects the creation of scheduled tasks that involve system processes, which may indicate malicious actors masquerading in logs
Matching passage: Sigma rule: Detects the creation of scheduled tasks that involve system processes, which may indicate malicious actors masquerading. Logsource: windows / process_creation. Rule: title: Scheduled Task Creation Masquerading as System Processes id: 9f8573c9-22b4-40e3-89c1-72bc2b8d49ab status: experimental description: Detects the creation of scheduled tasks that involve system processes, which may indicate malicious actors masquerading as or abusing these processes to execute payloads or maintain persistence. references: - https://tria.ge/241015-l98snsyeje/behavioral2 author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-02-05 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.stealth - attack.t1053.005 - attack.t1036.004 - attack.t1036.005 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \schtasks.exe - OriginalFileName: schtasks.exe selection_cli: CommandLine|contains|windash: ' /create ' CommandLine|contains: - ' audiodg' - ' conhost' - ' dwm.exe' - ' explorer' - ' lsass' - ' lsm' - ' mmc' - ' msiexec' - ' regsvr32' - ' rundll32' - ' services' - ' spoolsv' - ' svchost' - ' taskeng' - ' taskhost' - ' wininit' - ' winlogon' condition: all of selection_* falsepositives: - Legitimate system administration tasks scheduling trusted system processes. level: high
Near-miss passage: Sigma rule: Detects when an attacker tries to change User Account Control (UAC) elevation request destination via the "PromptOnSecur. Logsource: windows / registry_set. Rule: title: UAC Secure Desktop Prompt Disabled id: 0d7ceeef-3539-4392-8953-3dc664912714 related: - id: c5f6a85d-b647-40f7-bbad-c10b66bab038 type: similar - id: 48437c39-9e5f-47fb-af95-3d663c3f2919 type: similar status: test description: 'Detects when an attacker tries to change User Account Control (UAC) elevation request destination via the "PromptOnSecureDesktop" value. The "PromptOnSecureDesktop" setting specifically determines whether UAC prompts are displayed on the secure desktop. The secure desktop is a separate desktop environment that''s isolated from other processes running on the system. It''s designed to prevent malicious software from intercepting or tampering with UAC prompts. When "PromptOnSecureDesktop" is set to 0, UAC prompts are displayed on the user''s current desktop instead of the secure desktop. This reduces the level of security because it potentially exposes the prompts to manipulation by malicious software. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/7e11e9b79583545f208a6dc3fa062f2ed443d999/atomics/T1548.002/T1548.002.md author: frack113 date: 2024-05-10 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop Details: DWORD (0x00000000) condition: selection falsepositives: - Unknown level: medium
Query: risk of CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP he
Matching passage: CVE-2015-3154. CWE: CWE-74. CVSS: 6.099999904632568. CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.
Near-miss passage: CVE-2015-0169. CWE: CWE-74. CVSS: 4.0. IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows remote authenticated users to inject arguments via unspecified vectors.
Query: exploit The mod_l2_entry function in arch/x86/mm.c in Xen 3.4 through 4.6.x does not properly validate level 2 page table entries, which allows local PV guest administrators to gain privil
Matching passage: CVE-2015-7835. CWE: CWE-20. CVSS: 7.199999809265137. The mod_l2_entry function in arch/x86/mm.c in Xen 3.4 through 4.6.x does not properly validate level 2 page table entries, which allows local PV guest administrators to gain privileges via a crafted superpage mapping.
Near-miss passage: CVE-2015-5765. CWE: CWE-20. CVSS: 4.300000190734863. The user interface in Safari in Apple iOS before 9 allows remote attackers to spoof URLs via unspecified vectors, a different vulnerability than CVE-2015-5764 and CVE-2015-5767.
Query: patch priority for CVE-2015-6918
Matching passage: CVE-2015-6918. CWE: CWE-200. CVSS: 6.300000190734863. salt before 2015.5.5 leaks git usernames and passwords to the log.
Near-miss passage: CVE-2015-4515. CWE: CWE-200. CVSS: 4.300000190734863. Mozilla Firefox before 42.0, when NTLM v1 is enabled for HTTP authentication, allows remote attackers to obtain sensitive hostname information by constructing a crafted web site that sends an NTLM request and reads the Workstation field of an NTLM type 3 message.
Query: Sigma rule for Detects the execution of WMIC to query information on a remote system
Matching passage: Sigma rule: Detects the execution of WMIC to query information on a remote system. Logsource: windows / process_creation. Rule: title: WMIC Remote Command Execution id: 7773b877-5abb-4a3e-b9c9-fd0369b59b00 related: - id: e42af9df-d90b-4306-b7fb-05c863847ebd type: obsolete - id: 09af397b-c5eb-4811-b2bb-08b3de464ebf type: obsolete status: test description: Detects the execution of WMIC to query information on a remote system references: - https://securelist.com/moonbounce-the-dark-side-of-uefi-firmware/105468/ - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-02-14 modified: 2025-10-22 tags: - attack.execution - attack.t1047 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \WMIC.exe - OriginalFileName: wmic.exe selection_cli: CommandLine|contains|windash: '/node:' filter_main_localhost: CommandLine|contains: - localhost - 127.0.0.1 condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: medium simulation: - type: atomic-red-team name: WMI Execute Remote Process technique: T1047 atomic_guid: 9c8ef159-c666-472f-9874-90c8d60d136b regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_remote_execution/info.yml
Near-miss passage: Sigma rule: Detects the modification of an existing service in order to execute an arbitrary payload when the service is started or. Logsource: windows / process_creation. Rule: title: Potential Persistence Attempt Via Existing Service Tampering id: 38879043-7e1e-47a9-8d46-6bec88e201df status: test description: Detects the modification of an existing service in order to execute an arbitrary payload when the service is started or killed as a potential method for persistence. references: - https://pentestlab.blog/2020/01/22/persistence-modify-existing-service/ author: Sreeman date: 2020-09-29 modified: 2023-02-04 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1543.003 - attack.t1574.011 logsource: category: process_creation product: windows detection: selection_sc: - CommandLine|contains|all: - 'sc ' - 'config ' - binpath= - CommandLine|contains|all: - 'sc ' - failure - command= selection_reg_img: - CommandLine|contains|all: - 'reg ' - 'add ' - FailureCommand - CommandLine|contains|all: - 'reg ' - 'add ' - ImagePath selection_reg_ext: CommandLine|contains: - .sh - .exe - .dll - .bin$ - .bat - .cmd - .js - .msh$ - .reg$ - .scr - .ps - .vb - .jar - .pl condition: selection_sc or all of selection_reg_* falsepositives: - Unknown level: medium
Query: exploit McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 uses the same secret key across different customers' installations, which allows attackers to obtain the adminis
Matching passage: CVE-2015-0922. CWE: CWE-200. CVSS: 5.0. McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 uses the same secret key across different customers' installations, which allows attackers to obtain the administrator password by leveraging knowledge of the encrypted password.
Near-miss passage: CVE-2015-7946. CWE: CWE-200. CVSS: 4.599999904632568. Information Exposure vulnerability in Unity8 as used on the Ubuntu phone and possibly also in Unity8 shipped elsewhere. This allows an attacker to enable the MTP service by opening the emergency dialer. Fixed in 8.11+16.04.20160111.1-0ubuntu1 and 8.11+15.04.20160122-0ubuntu1.
Query: write Sigma for Detects an office suit application (Word, Excel, PowerPoint, Outlook) communicating to target systems over uncommon port
Matching passage: Sigma rule: Detects an office suit application (Word, Excel, PowerPoint, Outlook) communicating to target systems over uncommon port. Logsource: windows / network_connection. Rule: title: Office Application Initiated Network Connection Over Uncommon Ports id: 3b5ba899-9842-4bc2-acc2-12308498bf42 status: test description: Detects an office suit application (Word, Excel, PowerPoint, Outlook) communicating to target systems over uncommon ports. references: - https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2023-07-12 modified: 2025-10-17 tags: - attack.command-and-control - attack.stealth logsource: category: network_connection product: windows detection: selection: Initiated: 'true' Image|endswith: - \excel.exe - \outlook.exe - \powerpnt.exe - \winword.exe - \wordview.exe filter_main_common_ports: DestinationPort: - 53 - 80 - 139 - 389 - 443 - 445 - 3268 filter_main_outlook_ports: Image|contains: :\Program Files\Microsoft Office\ Image|endswith: \OUTLOOK.EXE DestinationPort: - 143 - 465 - 587 - 993 - 995 condition: selection and not 1 of filter_main_* falsepositives: - Other ports can be used, apply additional filters accordingly level: medium
Near-miss passage: Sigma rule: Detects the pattern of UAC Bypass using ICMLuaUtil Elevated COM interface. Logsource: windows / process_creation. Rule: title: UAC Bypass via ICMLuaUtil id: 49f2f17b-b4c8-4172-a68b-d5bf95d05130 status: test description: Detects the pattern of UAC Bypass using ICMLuaUtil Elevated COM interface references: - https://www.elastic.co/guide/en/security/current/uac-bypass-via-icmluautil-elevated-com-interface.html author: Florian Roth (Nextron Systems), Elastic (idea) date: 2022-09-13 modified: 2022-09-27 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \dllhost.exe ParentCommandLine|contains: - /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7} - /Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937} filter: - Image|endswith: \WerFault.exe - OriginalFileName: WerFault.exe condition: selection and not filter falsepositives: - Unknown level: high
Query: detect Detects the presence of an LSASS dump file in the "CrashDumps" folder. This could be a sign of LSASS credential dumping. in logs
Matching passage: Sigma rule: Detects the presence of an LSASS dump file in the "CrashDumps" folder. This could be a sign of LSASS credential dumping.. Logsource: windows / file_event. Rule: title: LSASS Process Dump Artefact In CrashDumps Folder id: 6902955a-01b7-432c-b32a-6f5f81d8f625 status: test description: Detects the presence of an LSASS dump file in the "CrashDumps" folder. This could be a sign of LSASS credential dumping. Techniques such as the LSASS Shtinkering have been seen abusing the Windows Error Reporting to dump said process. references: - https://github.com/deepinstinct/Lsass-Shtinkering - https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf author: '@pbssubhash' date: 2022-12-08 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows category: file_event detection: selection: TargetFilename|startswith: C:\Windows\System32\config\systemprofile\AppData\Local\CrashDumps\ TargetFilename|contains: lsass.exe. TargetFilename|endswith: .dmp condition: selection falsepositives: - Rare legitimate dump of the process by the operating system due to a crash of lsass level: high
Near-miss passage: Sigma rule: Detects remote thread creation by PowerShell processes into "lsass.exe". Logsource: windows / create_remote_thread. Rule: title: Potential Credential Dumping Attempt Via PowerShell Remote Thread id: fb656378-f909-47c1-8747-278bf09f4f4f related: - id: 3f07b9d1-2082-4c56-9277-613a621983cc type: obsolete - id: 0f920ebe-7aea-4c54-b202-9aa0c609cfe5 type: similar status: test description: Detects remote thread creation by PowerShell processes into "lsass.exe" references: - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse author: oscd.community, Natalia Shornikova date: 2020-10-06 modified: 2022-12-18 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows category: create_remote_thread detection: selection: SourceImage|endswith: - \powershell.exe - \pwsh.exe TargetImage|endswith: \lsass.exe condition: selection falsepositives: - Unknown level: high
Query: vulnerability: Cross-site request forgery (CSRF) vulnerability on Janitza UMG 508, 509, 511, 604, and 605 devices allows remote attackers to hijack the authentication of arbitrary users.
Matching passage: CVE-2015-3967. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability on Janitza UMG 508, 509, 511, 604, and 605 devices allows remote attackers to hijack the authentication of arbitrary users.
Near-miss passage: CVE-2015-7407. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in Lotus Mashups in IBM Mashup Center 3.0.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Query: detect Path Interception by Search Order Hijacking
Matching passage: T1574.008 Path Interception by Search Order Hijacking. Tactics: stealth, execution. Description: Adversaries may execute their own malicious payloads by hijacking the search order used to load other programs. Because some programs do not call other programs using the full path, adversaries may place their own file in the directory where the calling program is located, causing the operating system to launch their malicious software at the request of the calling program. Search order hijacking occurs when an adversary abuses the order in which Windows searches for programs that are not given a path. Unlike [DLL](https://attack.mitre.org/techniques/T1574/001) search order hijacking, the search order differs depending on the method that is used to execute the program. (Citation: Microsoft CreateProcess) (Citation: Windows NT Command Shell) (Citation: Microsoft WinExec) However, it is common for Windows to search in the directory of the initiating program before searching through the Windows system directory. An adversary who finds a program vulnerable to search order hijacking (i.e., a program that does not specify the path to an executable) may take advantage of this vulnerability by creating a program named after the improperly specified program and placing it within the initiating program's directory. For example, "example.exe" runs "cmd.exe" with the command-line argument <code>net user</code>. An adversary may place a program called "net.exe" within the same directory as example.exe, "net.exe" will be run instead of the Windows system utility net. In addition, if an adversary places a program called "net.com" in the same directory as "net.exe", then <code>cmd.exe /C net user</code> will execute "net.com" instead of "net.exe" due to the order of executable extensions defined under PATHEXT. (Citation: Microsoft Environment Property) Search order hijacking is also a common practice for hijacking DLL loads and is covered in [DLL](https://attack.mitre.org/techniques/T1574/001).
Near-miss passage: T1574 Hijack Execution Flow. Tactics: stealth, execution. Description: Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution. There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. How the operating system locates libraries to be used by a program can also be intercepted. Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.
Query: patch priority for CVE-2015-10056
Matching passage: CVE-2015-10056. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability was found in 2071174A vinylmap. It has been classified as critical. Affected is the function contact of the file recordstoreapp/views.py. The manipulation leads to sql injection. The name of the patch is b07b79a1e92cc62574ba0492cce000ef4a7bd25f. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218400.
Near-miss passage: CVE-2015-1479. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in reports/CreateReportTable.jsp in ZOHO ManageEngine ServiceDesk Plus (SDP) before 9.0 build 9031 allows remote authenticated users to execute arbitrary SQL commands via the site parameter.
Query: CVE similar to CVE-2015-6541
Matching passage: CVE-2015-6541. CWE: CWE-352. CVSS: 8.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the Mail interface in Zimbra Collaboration Server (ZCS) before 8.5 allow remote attackers to hijack the authentication of arbitrary users for requests that change account preferences via a SOAP request to service/soap/BatchRequest.
Near-miss passage: CVE-2015-3355. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the Batch Jobs module before 7.x-1.2 for Drupal allow remote attackers to hijack the authentication of certain users for requests that (1) delete a batch job record or (2) execute a task via unspecified vectors.
Query: CVE similar to CVE-2015-10078
Matching passage: CVE-2015-10078. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability, which was classified as problematic, has been found in atwellpub Resend Welcome Email Plugin 1.0.1 on WordPress. This issue affects the function send_welcome_email_url of the file resend-welcome-email.php. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 1.0.2 is able to address this issue. The identifier of the patch is b14c1f66d307783f0ae74f88088a85999107695c. It is recommended to upgrade the affected component. The identifier VDB-220637 was assigned to this vulnerability.
Near-miss passage: CVE-2015-4366. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Mover module 6.x-1.0 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
Query: weakness Double Free
Matching passage: CWE-415 Double Free. The product calls free() twice on the same memory address.
Near-miss passage: CWE-114 Process Control. Executing commands or loading libraries from an untrusted source or in an untrusted environment can cause an application to execute malicious commands (and payloads) on behalf of an attacker.
Query: describe CVE-2015-2203
Matching passage: CVE-2015-2203. CWE: CWE-200. CVSS: 6.5. Evergreen 2.5.9, 2.6.7, and 2.7.4 allows remote authenticated users with STAFF_LOGIN permission to obtain sensitive settings history information by leveraging listing of open-ils.pcrud as a controller in the IDL.
Near-miss passage: CVE-2015-4981. CWE: CWE-200. CVSS: 2.0999999046325684. IBM General Parallel File System (GPFS) 3.5.x before 3.5.0.27 and 4.1.x before 4.1.1.2 and Spectrum Scale 4.1.1.x before 4.1.1.2 allow local users to obtain sensitive information from system memory via unspecified vectors.
Query: vulnerability: Foreman before 1.9.0 allows remote authenticated users with the edit_users permission to edit administrator users and change their passwords via unspecified vectors.
Matching passage: CVE-2015-3235. CWE: CWE-264. CVSS: 6.0. Foreman before 1.9.0 allows remote authenticated users with the edit_users permission to edit administrator users and change their passwords via unspecified vectors.
Near-miss passage: CVE-2015-5498. CWE: CWE-264. CVSS: 5.0. The Shipwire API module 7.x-1.x before 7.x-1.03 for Drupal does not check the view permission for the shipments overview (admin/shipwire/shipments), which allows remote attackers to obtain sensitive information via a request to the page.