alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection rule: Detects events in which someone prints the contents of history files to the commandline or redirects it to a file for re
Matching passage: Sigma rule: Detects events in which someone prints the contents of history files to the commandline or redirects it to a file for re. Logsource: linux / process_creation. Rule: title: Print History File Contents id: d7821ff1-4527-4e33-9f84-d0d57fa2fb66 status: test description: Detects events in which someone prints the contents of history files to the commandline or redirects it to a file for reconnaissance references: - https://github.com/sleventyeleven/linuxprivchecker/ - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md author: Florian Roth (Nextron Systems) date: 2022-06-20 modified: 2022-09-15 tags: - attack.reconnaissance - attack.t1592.004 logsource: category: process_creation product: linux detection: selection: Image|endswith: - /cat - /head - /tail - /more selection_history: - CommandLine|contains: - /.bash_history - /.zsh_history - CommandLine|endswith: - _history - .history - zhistory condition: all of selection* falsepositives: - Legitimate administration activities level: medium
Near-miss passage: Sigma rule: Detects potential DLL sideloading of vcruntime140.dll, a common C++ runtime library. Threat actors have been observed us. Logsource: windows / image_load. Rule: title: Potential Vcruntime140 DLL Sideloading id: d7a63acb-1284-49bc-bfea-7771146c8b1c status: experimental description: 'Detects potential DLL sideloading of vcruntime140.dll, a common C++ runtime library. Threat actors have been observed using DLL sideloading techniques to load malicious payloads under the guise of legitimate applications such as SqlWriter, SqlDumper etc. Notably, APT29 has been documented leveraging WinELOADER to sideload vcruntime140.dll for executing malicious code. ' references: - https://www.mandiant.com/resources/blog/apt29-wineloader-german-political-parties - https://www.zscaler.com/blogs/security-research/european-diplomats-targeted-spikedwine-wineloader - https://www.nextron-systems.com/2023/09/15/detecting-janelarat-with-yara-and-thor/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-01-12 modified: 2026-05-18 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \vcruntime140.dll filter_main_legitimate_path: ImageLoaded|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Program Files\ - C:\Program Files (x86)\ filter_main_legitimate_signer: Signed: true SignatureStatus: Valid Description|endswith: C Runtime Library filter_optional_onedrive: Image|startswith: C:\Users\ Image|contains: \AppData\Local\Microsoft\OneDrive\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/image_load/image_load_side_load_vcruntime140/info.yml
Query: secure coding against Source Code File with Excessive Number of Lines of Code
Matching passage: CWE-1080 Source Code File with Excessive Number of Lines of Code. A source code file has too many lines of code.
Near-miss passage: CWE-1392 Use of Default Credentials. The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.
Query: describe CVE-2015-8264
Matching passage: CVE-2015-8264. CWE: CWE-426. CVSS: 7.800000190734863. Untrusted search path vulnerability in F-Secure Online Scanner allows remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse DLL that is located in the same folder as F-SecureOnlineScanner.exe.
Near-miss passage: CVE-2015-3987. CWE: CWE-426. CVSS: 7.199999809265137. Multiple unquoted Windows search path vulnerabilities in the (1) Client Management and (2) Gateway in McAfee ePO Deep Command 2.1 and 2.2 before HF 1058831 allow local users to gain privileges via unspecified vectors.
Query: CVE similar to CVE-2015-3284
Matching passage: CVE-2015-3284. CWE: CWE-200. CVSS: 2.0999999046325684. pioctls in OpenAFS 1.6.x before 1.6.13 allows local users to read kernel memory via crafted commands.
Near-miss passage: CVE-2015-7929. CWE: CWE-200. CVSS: 4.300000190734863. eWON devices with firmware through 10.1s0 support unspecified GET requests, which might allow remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history.
Query: vulnerability: The passthrough FTP feature on Cisco Web Security Appliance (WSA) devices with software 8.0.7-142 and 8.5.1-021 allows remote attackers to cause a denial of service (CPU consumptio
Matching passage: CVE-2015-6386. CWE: CWE-399. CVSS: 5.0. The passthrough FTP feature on Cisco Web Security Appliance (WSA) devices with software 8.0.7-142 and 8.5.1-021 allows remote attackers to cause a denial of service (CPU consumption) via FTP sessions in which the control connection is ended after data transfer, aka Bug ID CSCut94150.
Near-miss passage: CVE-2015-6431. CWE: CWE-399. CVSS: 6.5. Cisco IOS XE 16.1.1 allows remote attackers to cause a denial of service (device reload) via a packet with the 00-00-00-00-00-00 source MAC address, aka Bug ID CSCux48405.
Query: describe CVE-2015-5483
Matching passage: CVE-2015-5483. CWE: CWE-352. CVSS: 8.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the Private Only plugin 3.5.1 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) add users, (2) delete posts, or (3) modify PHP files via unspecified vectors, or (4) conduct cross-site scripting (XSS) attacks via the po_logo parameter in the privateonly.php page to wp-admin/options-general.php.
Near-miss passage: CVE-2015-6373. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCux10611.
Query: playbook for alert: Persistence mechanism resembling vSphere Installation Bundles
Matching passage: Playbook for T1505.006 vSphere Installation Bundles. 1) Validate alert telemetry against T1505.006. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: persistence. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may abuse vSphere Installation Bundles (VIBs) to establish persistent access to ESXi hypervisors. VIBs are collections of files used for software distribution and virtual system management in VMware environments. Since ESXi uses an in-memory filesystem where changes made to most files are stored in RAM rather than in persistent storage, these modifications are lost after a reboot. Howe
Near-miss passage: Playbook for T1505.004 IIS Components. Different response path focused on persistence.
Query: describe CVE-2015-6023
Matching passage: CVE-2015-6023. CWE: CWE-284. CVSS: 7.300000190734863. ping.cgi in NetCommWireless HSPA 3G10WVE wireless routers with firmware before 3G10WVE-L101-S306ETS-C01_R05 allows remote attackers to bypass intended access restrictions via a direct request. NOTE: this issue can be combined with CVE-2015-6024 to execute arbitrary commands.
Near-miss passage: CVE-2015-0694. CWE: CWE-284. CVSS: 5.0. Cisco ASR 9000 devices with software 5.3.0.BASE do not recognize that certain ACL entries have a single-host constraint, which allows remote attackers to bypass intended network-resource access restrictions by using an address that was not supposed to have been allowed, aka Bug ID CSCur28806.
Query: hunt for Local Groups activity
Matching passage: T1069.001 Local Groups. Tactics: discovery. Description: Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group. Commands such as <code>net localgroup</code> of the [Net](https://attack.mitre.org/software/S0039) utility, <code>dscl . -list /Groups</code> on macOS, and <code>groups</code> on Linux can list local groups.
Near-miss passage: T1069 Permission Groups Discovery. Tactics: discovery. Description: Adversaries may attempt to discover group and permission settings. This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions. Adversaries may attempt to discover group permission settings in many different ways. This data may provide the adversary with information about the compromised environment that can be used in follow-on activity and targeting.(Citation: CrowdStrike BloodHound April 2018)
Query: alert when Detects DCShadow via create new SPN
Matching passage: Sigma rule: Detects DCShadow via create new SPN. Logsource: windows / security. Rule: title: Possible DC Shadow Attack id: 32e19d25-4aed-4860-a55a-be99cb0bf7ed related: - id: 611eab06-a145-4dfa-a295-3ccc5c20f59a type: derived status: test description: Detects DCShadow via create new SPN references: - https://twitter.com/gentilkiwi/status/1003236624925413376 - https://gist.github.com/gentilkiwi/dcc132457408cf11ad2061340dcb53c2 - https://web.archive.org/web/20180203014709/https://blog.alsid.eu/dcshadow-explained-4510f52fc19d?gi=c426ac876c48 author: Ilyas Ochkov, oscd.community, Chakib Gzenayi (@Chak092), Hosni Mribah date: 2019-10-25 modified: 2022-10-17 tags: - attack.credential-access - attack.defense-impairment - attack.t1207 logsource: product: windows service: security definition: The "Audit Directory Service Changes" logging policy must be configured in order to receive events. Audit events are generated only for objects with configured system access control lists (SACLs). Audit events are generated only for objects with configured system access control lists (SACLs) and only when accessed in a manner that matches their SACL settings. This policy covers the following events ids - 5136, 5137, 5138, 5139, 5141. Note that the default policy does not cover User objects. For that a custom AuditRule need to be setup (See https://github.com/OTRF/Set-AuditRule) detection: selection1: EventID: 4742 ServicePrincipalNames|contains: GC/ selection2: EventID: 5136 AttributeLDAPDisplayName: servicePrincipalName AttributeValue|startswith: GC/ condition: 1 of selection* falsepositives: - Valid on domain controllers; exclude known DCs level: medium
Near-miss passage: Sigma rule: Once established within a system or network, an adversary may use automated techniques for collecting internal data.. Logsource: windows / process_creation. Rule: title: Automated Collection Command Prompt id: f576a613-2392-4067-9d1a-9345fb58d8d1 status: test description: Once established within a system or network, an adversary may use automated techniques for collecting internal data. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1119/T1119.md - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md author: frack113 date: 2021-07-28 modified: 2022-11-11 tags: - attack.collection - attack.t1119 - attack.credential-access - attack.t1552.001 logsource: category: process_creation product: windows detection: selection_ext: CommandLine|contains: - .doc - .docx - .xls - .xlsx - .ppt - .pptx - .rtf - .pdf - .txt selection_other_dir: CommandLine|contains|all: - 'dir ' - ' /b ' - ' /s ' selection_other_findstr: OriginalFileName: FINDSTR.EXE CommandLine|contains: - ' /e ' - ' /si ' condition: selection_ext and 1 of selection_other_* falsepositives: - Unknown level: medium
Query: Sigma YAML for windows / ps_script
Matching passage: Sigma rule: Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line i. Logsource: windows / ps_script. Rule: title: Powershell MsXml COM Object id: 78aa1347-1517-4454-9982-b338d6df8343 status: test description: 'Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.001/T1059.001.md#atomic-test-7---powershell-msxml-com-object---with-prompt - https://learn.microsoft.com/en-us/previous-versions/windows/desktop/ms766431(v=vs.85) - https://www.trendmicro.com/en_id/research/22/e/uncovering-a-kingminer-botnet-attack-using-trend-micro-managed-x.html author: frack113, MatilJ date: 2022-01-19 modified: 2022-05-19 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - New-Object - -ComObject - MsXml2. - XmlHttp condition: selection falsepositives: - Legitimate administrative script level: medium
Near-miss passage: Sigma rule: Detects when an account is disabled or blocked for sign in but tried to log in. Logsource: azure / signinlogs. Rule: title: Account Disabled or Blocked for Sign in Attempts id: 4afac85c-224a-4dd7-b1af-8da40e1c60bd status: test description: Detects when an account is disabled or blocked for sign in but tried to log in references: - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-privileged-accounts author: Yochana Henderson, '@Yochana-H' date: 2022-06-17 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078.004 logsource: product: azure service: signinlogs detection: selection: ResultType: 50057 ResultDescription: Failure condition: selection falsepositives: - Account disabled or blocked in error - Automation account has been blocked or disabled level: medium
Query: rule covering Detects locked workstation session events that occur automatically after a standard period of inactivity.
Matching passage: Sigma rule: Detects locked workstation session events that occur automatically after a standard period of inactivity.. Logsource: windows / security. Rule: title: Locked Workstation id: 411742ad-89b0-49cb-a7b0-3971b5c1e0a4 status: stable description: Detects locked workstation session events that occur automatically after a standard period of inactivity. references: - https://www.cisecurity.org/controls/cis-controls-list/ - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4800 author: Alexandr Yampolskyi, SOC Prime date: 2019-03-26 modified: 2023-12-11 tags: - attack.impact logsource: product: windows service: security detection: selection: EventID: 4800 condition: selection falsepositives: - Likely level: informational
Near-miss passage: Sigma rule: Detects common NTLM brute force device names. Logsource: windows / ntlm. Rule: title: NTLM Brute Force id: 9c8acf1a-cbf9-4db6-b63c-74baabe03e59 status: test description: Detects common NTLM brute force device names references: - https://www.varonis.com/blog/investigate-ntlm-brute-force author: Jerry Shockley '@jsh0x' date: 2022-02-02 tags: - attack.credential-access - attack.t1110 logsource: product: windows service: ntlm definition: Requires events from Microsoft-Windows-NTLM/Operational detection: selection: EventID: 8004 devicename: WorkstationName: - Rdesktop - Remmina - Freerdp - Windows7 - Windows8 - Windows2012 - Windows2016 - Windows2019 condition: selection and devicename falsepositives: - Systems with names equal to the spoofed ones used by the brute force tools level: medium
Query: exploit Piriform CCleaner 3.26.0.1988 through 5.02.5101 writes the filenames to disk when overwriting files, which allows local users to obtain sensitive information by searching unallocat
Matching passage: CVE-2015-3999. CWE: CWE-200. CVSS: 2.0999999046325684. Piriform CCleaner 3.26.0.1988 through 5.02.5101 writes the filenames to disk when overwriting files, which allows local users to obtain sensitive information by searching unallocated disk space.
Near-miss passage: CVE-2015-7412. CWE: CWE-200. CVSS: 2.5999999046325684. The GatewayScript modules on IBM DataPower Gateways with software 7.2.0.x before 7.2.0.1, when the GatewayScript decryption API or a JWE decrypt action is enabled, do not require signed ciphertext data, which makes it easier for remote attackers to obtain plaintext data via a padding-oracle attack.
Query: patch priority for CVE-2015-0482
Matching passage: CVE-2015-0482. CWE: UNKNOWN. CVSS: 6.0. Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 12.1.2.0 and 12.1.3.0 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to WLS-WebServices.
Near-miss passage: CVE-2015-0356. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion."
Query: exploit The add-on installation feature in Mozilla Firefox before 40.0.3 and Firefox ESR 38.x before 38.2.1 allows remote attackers to bypass an intended user-confirmation requirement by c
Matching passage: CVE-2015-4498. CWE: CWE-254. CVSS: 7.5. The add-on installation feature in Mozilla Firefox before 40.0.3 and Firefox ESR 38.x before 38.2.1 allows remote attackers to bypass an intended user-confirmation requirement by constructing a crafted data: URL and triggering navigation to an arbitrary http: or https: URL at a certain early point in the installation process.
Near-miss passage: CVE-2015-7713. CWE: CWE-254. CVSS: 5.0. OpenStack Compute (Nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) do not properly apply security group changes, which allows remote attackers to bypass intended restriction by leveraging an instance that was running when the change was made.
Query: Sigma rule for Detects modification of the registry settings used for Internet Explorer and other Windows components that use these set
Matching passage: Sigma rule: Detects modification of the registry settings used for Internet Explorer and other Windows components that use these set. Logsource: windows / registry_set. Rule: title: Modification of IE Registry Settings id: d88d0ab2-e696-4d40-a2ed-9790064e66b3 status: test description: Detects modification of the registry settings used for Internet Explorer and other Windows components that use these settings. An attacker can abuse this registry key to add a domain to the trusted sites Zone or insert JavaScript for persistence references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-4---add-domain-to-trusted-sites-zone - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-5---javascript-in-registry author: frack113 date: 2022-01-22 modified: 2025-10-22 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection_domains: TargetObject|contains: \Software\Microsoft\Windows\CurrentVersion\Internet Settings filter_main_dword: Details|startswith: DWORD filter_main_null: Details: null filter_main_office: Details: - 'Cookie:' - 'Visited:' - (Empty) filter_main_path: TargetObject|contains: - \Cache - \ZoneMap - \WpadDecision filter_main_binary: Details: Binary Data filter_optional_accepted_documents: TargetObject|contains: \Software\Microsoft\Windows\CurrentVersion\Internet Settings\Accepted Documents condition: selection_domains and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects the execution of the "net use" command to mount a WebDAV server and then immediately execute some content in it.. Logsource: windows / process_creation. Rule: title: Suspicious File Execution From Internet Hosted WebDav Share id: f0507c0f-a3a2-40f5-acc6-7f543c334993 status: test description: Detects the execution of the "net use" command to mount a WebDAV server and then immediately execute some content in it. As seen being used in malicious LNK files references: - https://twitter.com/ShadowChasing1/status/1552595370961944576 - https://www.virustotal.com/gui/file/a63376ee1dba76361df73338928e528ca5b20171ea74c24581605366dcaa0104/behavior author: pH-T (Nextron Systems) date: 2022-09-01 modified: 2023-02-21 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|contains: \cmd.exe - OriginalFileName: Cmd.EXE selection_base: CommandLine|contains|all: - ' net use http' - '& start /b ' - \DavWWWRoot\ selection_ext: CommandLine|contains: - '.exe ' - '.dll ' - '.bat ' - '.vbs ' - '.ps1 ' condition: all of selection_* falsepositives: - Unknown level: high
Query: Sigma rule for Detects disabling of the Windows Defender virus scanning feature
Matching passage: Sigma rule: Detects disabling of the Windows Defender virus scanning feature. Logsource: windows / windefend. Rule: title: Windows Defender Virus Scanning Feature Disabled id: 686c0b4b-9dd3-4847-9077-d6c1bbe36fcb related: - id: fe34868f-6e0e-4882-81f6-c43aa8f15b62 type: obsolete status: stable description: Detects disabling of the Windows Defender virus scanning feature references: - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide#event-id-5012 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md - https://craigclouditpro.wordpress.com/2020/03/04/hunting-malicious-windows-defender-activity/ author: Ján Trenčanský, frack113 date: 2020-07-28 modified: 2023-11-22 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: windefend detection: selection: EventID: 5012 condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of "forfiles" from a non-default location, in order to potentially spawn a custom "cmd.exe" from t. Logsource: windows / process_creation. Rule: title: Forfiles.EXE Child Process Masquerading id: f53714ec-5077-420e-ad20-907ff9bb2958 status: test description: 'Detects the execution of "forfiles" from a non-default location, in order to potentially spawn a custom "cmd.exe" from the current working directory. ' references: - https://www.hexacorn.com/blog/2023/12/31/1-little-known-secret-of-forfiles-exe/ author: Nasreddine Bencherchali (Nextron Systems), Anish Bogati date: 2024-01-05 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection: ParentCommandLine|endswith: - .exe - .exe" Image|endswith: \cmd.exe CommandLine|startswith: /c echo " filter_main_parent_not_sys: ParentImage|contains: - :\Windows\System32\ - :\Windows\SysWOW64\ ParentImage|endswith: \forfiles.exe Image|contains: - :\Windows\System32\ - :\Windows\SysWOW64\ Image|endswith: \cmd.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high