alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Identifies when an organization doesn't have the proper license for PIM and is out of compliance.
Matching passage: Sigma rule: Identifies when an organization doesn't have the proper license for PIM and is out of compliance.. Logsource: azure / pim. Rule: title: Invalid PIM License id: 58af08eb-f9e1-43c8-9805-3ad9b0482bd8 status: test description: Identifies when an organization doesn't have the proper license for PIM and is out of compliance. references: - https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#the-organization-doesnt-have-microsoft-entra-premium-p2-or-microsoft-entra-id-governance author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-14 tags: - attack.initial-access - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation logsource: product: azure service: pim detection: selection: riskEventType: invalidLicenseAlertIncident condition: selection falsepositives: - Investigate if licenses have expired. level: high
Near-miss passage: Sigma rule: Detects potential tampering with Windows Defender settings such as adding exclusion using wmic. Logsource: windows / process_creation. Rule: title: Potential Windows Defender Tampering Via Wmic.EXE id: 51cbac1e-eee3-4a90-b1b7-358efb81fa0a status: test description: Detects potential tampering with Windows Defender settings such as adding exclusion using wmic references: - https://github.com/redcanaryco/atomic-red-team/blob/5c1e6f1b4fafd01c8d1ece85f510160fc1275fbf/atomics/T1562.001/T1562.001.md - https://www.bleepingcomputer.com/news/security/gootkit-malware-bypasses-windows-defender-by-setting-path-exclusions/ - https://www.bleepingcomputer.com/news/security/iobit-forums-hacked-to-spread-ransomware-to-its-members/ author: frack113 date: 2022-12-11 modified: 2023-02-14 tags: - attack.execution - attack.defense-impairment - attack.t1047 - attack.t1685 logsource: product: windows category: process_creation detection: selection_img: - OriginalFileName: wmic.exe - Image|endswith: \WMIC.exe selection_cli: CommandLine|contains: /Namespace:\\\\root\\Microsoft\\Windows\\Defender condition: all of selection_* falsepositives: - Unknown level: high simulation: - type: atomic-red-team name: WMIC Tamper with Windows Defender Evade Scanning Folder technique: T1562.001 atomic_guid: 59d386fc-3a4b-41b8-850d-9e3eee24dfe4 regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_namespace_defender/info.yml
Query: vulnerability: HP Matrix Operating Environment before 7.5.0 allows remote attackers to obtain sensitive information or modify data via unspecified vectors, a different vulnerability than CVE-2015
Matching passage: CVE-2015-5428. CWE: UNKNOWN. CVSS: 7.5. HP Matrix Operating Environment before 7.5.0 allows remote attackers to obtain sensitive information or modify data via unspecified vectors, a different vulnerability than CVE-2015-5427 and CVE-2015-5429.
Near-miss passage: CVE-2015-4134. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in goto.php in phpwind 8.7 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.
Query: vulnerability: Memory leak in the __archive_read_get_extract function in archive_read_extract2.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service via a tar file.
Matching passage: CVE-2015-8929. CWE: CWE-119. CVSS: 5.5. Memory leak in the __archive_read_get_extract function in archive_read_extract2.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service via a tar file.
Near-miss passage: CVE-2015-8242. CWE: CWE-119. CVSS: 5.800000190734863. The xmlSAX2TextNode function in SAX2.c in the push interface in the HTML parser in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service (stack-based buffer over-read and application crash) or obtain sensitive information via crafted XML data.
Query: Sigma YAML for windows / ps_script
Matching passage: Sigma rule: Detects writing data into NTFS alternate data streams from powershell. Needs Script Block Logging.. Logsource: windows / ps_script. Rule: title: NTFS Alternate Data Stream id: 8c521530-5169-495d-a199-0a3a881ad24e status: test description: Detects writing data into NTFS alternate data streams from powershell. Needs Script Block Logging. references: - https://web.archive.org/web/20220614030603/http://www.powertheshell.com/ntfsstreams/ - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.004/T1564.004.md author: Sami Ruohonen date: 2018-07-24 modified: 2022-12-25 tags: - attack.stealth - attack.t1564.004 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_content: ScriptBlockText|contains: - set-content - add-content selection_stream: ScriptBlockText|contains: -stream condition: all of selection* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the modification of NTFS symbolic link behavior using fsutil, which could be used to enable remote to local or r. Logsource: windows / process_creation. Rule: title: Potentially Suspicious NTFS Symlink Behavior Modification id: c0b2768a-dd06-4671-8339-b16ca8d1f27f status: test description: 'Detects the modification of NTFS symbolic link behavior using fsutil, which could be used to enable remote to local or remote to remote symlinks for potential attacks. ' references: - https://www.cybereason.com/blog/cybereason-vs.-blackcat-ransomware - https://learn.microsoft.com/fr-fr/windows-server/administration/windows-commands/fsutil-behavior - https://thedfirreport.com/2025/06/30/hide-your-rdp-password-spray-leads-to-ransomhub-deployment/ author: frack113, The DFIR Report date: 2022-03-02 modified: 2025-11-13 tags: - attack.execution - attack.defense-impairment - attack.t1059 - attack.t1222.001 logsource: category: process_creation product: windows detection: selection_img_proxy: - Image|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - Cmd.Exe - PowerShell.EXE - pwsh.dll selection_fsutil_cli: CommandLine|contains|all: - fsutil - behavior - set - SymlinkEvaluation selection_symlink_params: CommandLine|contains: - R2L:1 - R2R:1 - L2L:1 condition: all of selection_* falsepositives: - Legitimate usage, investigate the parent process and context to determine if benign. level: medium
Query: Sigma rule for Detects the execution of the LOLBIN PrintBrm.exe, which can be used to create or extract ZIP files. PrintBrm.exe should
Matching passage: Sigma rule: Detects the execution of the LOLBIN PrintBrm.exe, which can be used to create or extract ZIP files. PrintBrm.exe should. Logsource: windows / process_creation. Rule: title: PrintBrm ZIP Creation of Extraction id: cafeeba3-01da-4ab4-b6c4-a31b1d9730c7 status: test description: Detects the execution of the LOLBIN PrintBrm.exe, which can be used to create or extract ZIP files. PrintBrm.exe should not be run on a normal workstation. references: - https://lolbas-project.github.io/lolbas/Binaries/PrintBrm/ author: frack113 date: 2022-05-02 tags: - attack.command-and-control - attack.stealth - attack.t1105 - attack.t1564.004 logsource: product: windows category: process_creation detection: selection: Image|endswith: \PrintBrm.exe CommandLine|contains|all: - ' -f' - .zip condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects using SettingSyncHost.exe to run hijacked binary. Logsource: windows / process_creation. Rule: title: Using SettingSyncHost.exe as LOLBin id: b2ddd389-f676-4ac4-845a-e00781a48e5f status: test description: Detects using SettingSyncHost.exe to run hijacked binary references: - https://www.hexacorn.com/blog/2020/02/02/settingsynchost-exe-as-a-lolbin author: Anton Kutepov, oscd.community date: 2020-02-05 modified: 2021-11-27 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.008 logsource: category: process_creation product: windows detection: system_utility: Image|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ parent_is_settingsynchost: ParentCommandLine|contains|all: - cmd.exe /c - RoamDiag.cmd - -outputpath condition: not system_utility and parent_is_settingsynchost falsepositives: - Unknown level: high
Query: describe CVE-2015-0929
Matching passage: CVE-2015-0929. CWE: CWE-284. CVSS: 10.0. time.htm in the web interface on SerVision HVG Video Gateway devices with firmware before 2.2.26a78 allows remote attackers to bypass authentication and obtain administrative access by leveraging a cookie received in an HTTP response.
Near-miss passage: CVE-2015-6478. CWE: CWE-284. CVSS: 6.800000190734863. Unitronics VisiLogic OPLC IDE before 9.8.02 does not properly restrict access to ActiveX controls, which allows remote attackers to have an unspecified impact via a crafted web site.
Query: exploit The Hostmaster (Aegir) module 6.x-2.x before 6.x-2.4 and 7.x-3.x before 7.x-3.0-beta2 for Drupal allows remote attackers to execute arbitrary PHP code via a crafted file in the dir
Matching passage: CVE-2015-5501. CWE: CWE-254. CVSS: 7.5. The Hostmaster (Aegir) module 6.x-2.x before 6.x-2.4 and 7.x-3.x before 7.x-3.0-beta2 for Drupal allows remote attackers to execute arbitrary PHP code via a crafted file in the directory used to write Apache vhost files for hosted sites in a multi-site environment.
Near-miss passage: CVE-2015-2114. CWE: CWE-254. CVSS: 6.800000190734863. HP Support Solution Framework before 11.51.0049 allows remote attackers to download an arbitrary program onto a client machine and execute this program via unspecified vectors.
Query: exploit The microblog-poster plugin before 1.6.2 for WordPress has SQL Injection via the wp-admin/options-general.php?page=microblogposter.php account_id parameter.
Matching passage: CVE-2015-9449. CWE: CWE-89. CVSS: 7.199999809265137. The microblog-poster plugin before 1.6.2 for WordPress has SQL Injection via the wp-admin/options-general.php?page=microblogposter.php account_id parameter.
Near-miss passage: CVE-2015-9330. CWE: CWE-89. CVSS: 9.800000190734863. The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection.
Query: describe CVE-2015-0336
Matching passage: CVE-2015-0336. CWE: UNKNOWN. CVSS: 9.300000190734863. Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-0334.
Near-miss passage: CVE-2015-0254. CWE: UNKNOWN. CVSS: 7.5. Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) <x:parse> or (2) <x:transform> JSTL XML tag.
Query: Sigma rule for Detects DLL sideloading of VMGuestLib.dll by the WmiApSrv service.
Matching passage: Sigma rule: Detects DLL sideloading of VMGuestLib.dll by the WmiApSrv service.. Logsource: windows / image_load. Rule: title: VMGuestLib DLL Sideload id: 70e8e9b4-6a93-4cb7-8cde-da69502e7aff status: test description: Detects DLL sideloading of VMGuestLib.dll by the WmiApSrv service. references: - https://decoded.avast.io/martinchlumecky/png-steganography/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-01 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|contains|all: - \VMware\VMware Tools\vmStatsProvider\win32 - \vmGuestLib.dll Image|endswith: \Windows\System32\wbem\WmiApSrv.exe filter: Signed: 'true' condition: selection and not filter falsepositives: - FP could occur if the legitimate version of vmGuestLib already exists on the system level: medium
Near-miss passage: Sigma rule: Detects DLLs loading from a spoofed Windows directory path with an extra space (e.g "C:\Windows \System32") which can by. Logsource: windows / image_load. Rule: title: Trusted Path Bypass via Windows Directory Spoofing id: 0cbe38c0-270c-41d9-ab79-6e5a9a669290 related: - id: 4ac47ed3-44c2-4b1f-9d51-bf46e8914126 type: similar status: experimental description: 'Detects DLLs loading from a spoofed Windows directory path with an extra space (e.g "C:\Windows \System32") which can bypass Windows trusted path verification. This technique tricks Windows into treating the path as trusted, allowing malicious DLLs to load with high integrity privileges bypassing UAC. ' references: - https://x.com/Wietze/status/1933495426952421843 author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-06-17 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.007 - attack.t1548.002 logsource: category: image_load product: windows detection: selection: ImageLoaded|contains: - :\Windows \System32\ - :\Windows \SysWOW64\ condition: selection falsepositives: - Unlikely level: high
Query: mitigate Publish/Subscribe Protocols
Matching passage: T1071.005 Publish/Subscribe Protocols. Tactics: command and control. Description: Adversaries may communicate using publish/subscribe (pub/sub) application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as <code>MQTT</code>, <code>XMPP</code>, <code>AMQP</code>, and <code>STOMP</code> use a publish/subscribe design, with message distribution managed by a centralized broker.(Citation: wailing crab sub/pub)(Citation: Mandiant APT1 Appendix) Publishers categorize their messages by topics, while subscribers receive messages according to their subscribed topics.(Citation: wailing crab sub/pub) An adversary may abuse publish/subscribe protocols to communicate with systems under their control from behind a message broker while also mimicking normal, expected traffic.
Near-miss passage: T1071.002 File Transfer Protocols. Tactics: command and control. Description: Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as SMB(Citation: US-CERT TA18-074A), FTP(Citation: ESET Machete July 2019), FTPS, and TFTP that transfer files may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the transferred files. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.
Query: risk of The Safari Extensions implementation in Apple Safari before 9 does not require user confirmation before replacing an installed extension, which has unspecified impact and attack ve
Matching passage: CVE-2015-5780. CWE: CWE-20. CVSS: 10.0. The Safari Extensions implementation in Apple Safari before 9 does not require user confirmation before replacing an installed extension, which has unspecified impact and attack vectors.
Near-miss passage: CVE-2015-7855. CWE: CWE-20. CVSS: 6.5. The decodenetnum function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (assertion failure) via a 6 or mode 7 packet containing a long data value.
Query: write Sigma for Detects usage of findstr with the "EVERYONE" or "BUILTIN" keywords. This was seen being used in combination with "icacls
Matching passage: Sigma rule: Detects usage of findstr with the "EVERYONE" or "BUILTIN" keywords. This was seen being used in combination with "icacls. Logsource: windows / process_creation. Rule: title: Permission Misconfiguration Reconnaissance Via Findstr.EXE id: 47e4bab7-c626-47dc-967b-255608c9a920 status: test description: 'Detects usage of findstr with the "EVERYONE" or "BUILTIN" keywords. This was seen being used in combination with "icacls" and other utilities to spot misconfigured files or folders permissions. ' references: - https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-12 modified: 2023-11-11 tags: - attack.credential-access - attack.t1552.006 logsource: category: process_creation product: windows detection: selection_findstr_img: - Image|endswith: - \find.exe - \findstr.exe - OriginalFileName: - FIND.EXE - FINDSTR.EXE selection_findstr_cli: CommandLine|contains: - '"Everyone"' - '''Everyone''' - '"BUILTIN\\"' - '''BUILTIN\''' selection_special: CommandLine|contains|all: - 'icacls ' - 'findstr ' - Everyone condition: all of selection_findstr_* or selection_special falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_findstr_recon_everyone/info.yml
Near-miss passage: Sigma rule: Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters. Logsource: windows / process_creation. Rule: title: PUA - Seatbelt Execution id: 38646daa-e78f-4ace-9de0-55547b2d30da status: test description: Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters references: - https://github.com/GhostPack/Seatbelt - https://www.bluetangle.dev/2022/08/fastening-seatbelt-on-threat-hunting.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-18 modified: 2023-02-04 tags: - attack.discovery - attack.t1526 - attack.t1087 - attack.t1083 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \Seatbelt.exe - OriginalFileName: Seatbelt.exe - Description: Seatbelt - CommandLine|contains: - ' DpapiMasterKeys' - ' InterestingProcesses' - ' InterestingFiles' - ' CertificateThumbprints' - ' ChromiumBookmarks' - ' ChromiumHistory' - ' ChromiumPresence' - ' CloudCredentials' - ' CredEnum' - ' CredGuard' - ' FirefoxHistory' - ' ProcessCreationEvents' selection_group_list: CommandLine|contains: - ' -group=misc' - ' -group=remote' - ' -group=chromium' - ' -group=slack' - ' -group=system' - ' -group=user' - ' -group=all' selection_group_output: CommandLine|contains: ' -outputfile=' condition: selection_img or all of selection_group_* falsepositives: - Unlikely level: high
Query: exploit MongoDB before 2.4.13 and 2.6.x before 2.6.8 allows remote attackers to cause a denial of service via a crafted UTF-8 string in a BSON request.
Matching passage: CVE-2015-1609. CWE: CWE-20. CVSS: 5.0. MongoDB before 2.4.13 and 2.6.x before 2.6.8 allows remote attackers to cause a denial of service via a crafted UTF-8 string in a BSON request.
Near-miss passage: CVE-2015-5194. CWE: CWE-20. CVSS: 7.5. The log_config_command function in ntp_parser.y in ntpd in NTP before 4.2.7p42 allows remote attackers to cause a denial of service (ntpd crash) via crafted logconfig commands.
Query: write Sigma for The Devtoolslauncher.exe executes other binary
Matching passage: Sigma rule: The Devtoolslauncher.exe executes other binary. Logsource: windows / process_creation. Rule: title: Devtoolslauncher.exe Executes Specified Binary id: cc268ac1-42d9-40fd-9ed3-8c4e1a5b87e6 status: test description: The Devtoolslauncher.exe executes other binary references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Devtoolslauncher/ - https://twitter.com/_felamos/status/1179811992841797632 author: Beyu Denis, oscd.community (rule), @_felamos (idea) date: 2019-10-12 modified: 2021-11-27 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: Image|endswith: \devtoolslauncher.exe CommandLine|contains: LaunchForDeploy condition: selection falsepositives: - Legitimate use of devtoolslauncher.exe by legitimate user level: high
Near-miss passage: Sigma rule: Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.. Logsource: rpc_firewall / application. Rule: title: SharpHound Recon Account Discovery id: 65f77b1e-8e79-45bf-bb67-5988a8ce45a5 status: test description: Detects remote RPC calls useb by SharpHound to map remote connections and local group membership. references: - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-wkst/55118c55-2122-4ef9-8664-0c1ff9e168f3 - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-WKST.md - https://github.com/zeronetworks/rpcfirewall - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/ author: Sagie Dulce, Dekel Paz date: 2022-01-01 tags: - attack.t1087 - attack.discovery logsource: product: rpc_firewall category: application definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:6bffd098-a112-3610-9833-46c3f87e345a opnum:2' detection: selection: EventLog: RPCFW EventID: 3 InterfaceUuid: 6bffd098-a112-3610-9833-46c3f87e345a OpNum: 2 condition: selection falsepositives: - Unknown level: high
Query: exploit Multiple cross-site scripting (XSS) vulnerabilities in TestLink before 1.9.14 allow remote attackers to inject arbitrary web script or HTML via the (1) selected_end_date or (2) sel
Matching passage: CVE-2015-7391. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in TestLink before 1.9.14 allow remote attackers to inject arbitrary web script or HTML via the (1) selected_end_date or (2) selected_start_date parameter to lib/results/tcCreatedPerUserOnTestProject.php; the (3) containerType parameter to lib/testcases/containerEdit.php; the (4) filter_tc_id or (5) filter_testcase_name parameter to lib/testcases/listTestCases.php; the (6) useRecursion parameter to lib/testcases/tcImport.php; the (7) targetTestCase or (8) created_by parameter to lib/testcases/tcSearch.php; or the (9) HTTP Referer header to third_party/user_contribution/fakeRemoteExecServer/client4fakeXMLRPCTestRunner.php.
Near-miss passage: CVE-2015-6731. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the SemanticForms extension for MediaWiki allow remote attackers to inject arbitrary web script or HTML via a (1) section_*, (2) template_*, (3) label_*, or (4) new_template parameter to Special:CreateForm or (5) target or (6) alt_form parameter to Special:FormEdit.