alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Detects the usage of schtasks with the delete flag and the asterisk symbol to delete all tasks from the schedule of the
Matching passage: Sigma rule: Detects the usage of schtasks with the delete flag and the asterisk symbol to delete all tasks from the schedule of the. Logsource: windows / process_creation. Rule: title: Delete All Scheduled Tasks id: 220457c1-1c9f-4c2e-afe6-9598926222c1 status: test description: Detects the usage of schtasks with the delete flag and the asterisk symbol to delete all tasks from the schedule of the local computer, including tasks scheduled by other users. references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-delete author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-09 tags: - attack.impact - attack.t1489 logsource: category: process_creation product: windows detection: selection: Image|endswith: \schtasks.exe CommandLine|contains|all: - ' /delete ' - /tn \* - ' /f' condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects applications trying to modify the registry in order to disable any write-protect property for storage devices. T. Logsource: windows / process_creation. Rule: title: Write Protect For Storage Disabled id: 75f7a0e2-7154-4c4d-9eae-5cdb4e0a5c13 status: test description: 'Detects applications trying to modify the registry in order to disable any write-protect property for storage devices. This could be a precursor to a ransomware attack and has been an observed technique used by cypherpunk group. ' references: - https://www.manageengine.com/products/desktop-central/os-imaging-deployment/media-is-write-protected.html author: Sreeman date: 2021-06-11 modified: 2024-01-18 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: process_creation detection: selection: CommandLine|contains|all: - \System\CurrentControlSet\Control - Write Protection - '0' - storage condition: selection falsepositives: - Unknown level: medium
Query: detection rule: Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file
Matching passage: Sigma rule: Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file. Logsource: windows / ps_script. Rule: title: Computer Discovery And Export Via Get-ADComputer Cmdlet - PowerShell id: db885529-903f-4c5d-9864-28fe199e6370 related: - id: 435e10e4-992a-4281-96f3-38b11106adde type: similar status: test description: Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file references: - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html - https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/ - https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf author: Nasreddine Bencherchali (Nextron Systems) date: 2022-11-17 tags: - attack.discovery - attack.t1033 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - 'Get-ADComputer ' - ' -Filter \*' ScriptBlockText|contains: - ' | Select ' - Out-File - Set-Content - Add-Content condition: selection falsepositives: - Legitimate admin scripts may use the same technique, it's better to exclude specific computers or users who execute these commands or scripts often level: medium
Near-miss passage: Sigma rule: Detects application popup reporting a failure of the Sysmon service. Logsource: windows / system. Rule: title: Sysmon Application Crashed id: 4d7f1827-1637-4def-8d8a-fd254f9454df status: test description: Detects application popup reporting a failure of the Sysmon service references: - https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows10/1803/W10_1803_Pro_19700101_17134.1/WEPExplorer/Application%20Popup.xml#L36 author: Tim Shelton date: 2022-04-26 modified: 2024-01-17 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: system detection: selection: Provider_Name: Application Popup EventID: 26 Caption: - sysmon64.exe - Application Error - sysmon.exe - Application Error condition: selection falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-6663
Matching passage: CVE-2015-6663. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Client form in the Device Inspector page in SAP Afaria 7 allows remote attackers to inject arbitrary web script or HTML via crafted client name data, aka SAP Security Note 2152669.
Near-miss passage: CVE-2015-5399. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in PHPVibe before 4.21 allows remote authenticated users to inject arbitrary web script or HTML via a comment.
Query: exploit phpMyBackupPro 2.5 and earlier does not properly escape the "." character in request parameters, which allows remote authenticated users with knowledge of a web-accessible and web-
Matching passage: CVE-2015-3640. CWE: CWE-94. CVSS: 7.5. phpMyBackupPro 2.5 and earlier does not properly escape the "." character in request parameters, which allows remote authenticated users with knowledge of a web-accessible and web-writeable directory on the target system to inject and execute arbitrary PHP scripts by injecting scripts via the path, filename, and dirs parameters to scheduled.php, and making requests to injected scripts.
Near-miss passage: CVE-2015-5647. CWE: CWE-94. CVSS: 8.5. The RSS Reader component in Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 allows remote authenticated users to execute arbitrary PHP code via unspecified vectors, aka CyVDB-866.
Query: risk of Multiple open redirect vulnerabilities in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allow remote attackers to redirect users to arbitrar
Matching passage: CVE-2015-3175. CWE: UNKNOWN. CVSS: 5.800000190734863. Multiple open redirect vulnerabilities in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving an error page that links to a URL from an HTTP Referer header.
Near-miss passage: CVE-2015-8474. CWE: UNKNOWN. CVSS: 7.400000095367432. Open redirect vulnerability in the valid_back_url function in app/controllers/application_controller.rb in Redmine before 2.6.7, 3.0.x before 3.0.5, and 3.1.x before 3.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted back_url parameter, as demonstrated by "@attacker.com," a different vulnerability than CVE-2014-1985.
Query: risk of The user interface in WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, does not display URLs consistently, which makes it easier for remote att
Matching passage: CVE-2015-1084. CWE: CWE-17. CVSS: 5.0. The user interface in WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, does not display URLs consistently, which makes it easier for remote attackers to conduct phishing attacks via a crafted URL.
Near-miss passage: CVE-2015-6823. CWE: CWE-17. CVSS: 7.5. The allocate_buffers function in libavcodec/alac.c in FFmpeg before 2.7.2 does not initialize certain context data, which allows remote attackers to cause a denial of service (segmentation violation) or possibly have unspecified other impact via crafted Apple Lossless Audio Codec (ALAC) data.
Query: CVE similar to CVE-2015-0506
Matching passage: CVE-2015-0506. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB, a different vulnerability than CVE-2015-0508.
Near-miss passage: CVE-2015-0456. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle WebCenter Portal component in Oracle Fusion Middleware 11.1.1.8.0 allows remote attackers to affect integrity via unknown vectors related to Portlet Services.
Query: secure coding against Irrelevant Code
Matching passage: CWE-1164 Irrelevant Code. The product contains code that is not essential for execution, i.e. makes no state changes and has no side effects that alter data or control flow, such that removal of the code would have no impact to functionality or correctness.
Near-miss passage: CWE-1296 Incorrect Chaining or Granularity of Debug Components. The product's debug components contain incorrect chaining or granularity of debug components.
Query: exploit Bomgar Remote Support before 15.1.1 allows remote attackers to execute arbitrary PHP code via crafted serialized data to unspecified PHP scripts.
Matching passage: CVE-2015-0935. CWE: CWE-94. CVSS: 7.5. Bomgar Remote Support before 15.1.1 allows remote attackers to execute arbitrary PHP code via crafted serialized data to unspecified PHP scripts.
Near-miss passage: CVE-2015-7381. CWE: CWE-94. CVSS: 7.5. Multiple PHP remote file inclusion vulnerabilities in install.php in Web Reference Database (aka refbase) through 0.9.6 allow remote attackers to execute arbitrary PHP code via the (1) pathToMYSQL or (2) databaseStructureFile parameter, a different issue than CVE-2015-6008.
Query: alert when Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often us
Matching passage: Sigma rule: Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often us. Logsource: windows / ps_script. Rule: title: Potential Active Directory Enumeration Using AD Module - PsScript id: 9e620995-f2d8-4630-8430-4afd89f77604 related: - id: 70bc5215-526f-4477-963c-a47a5c9ebd12 type: similar - id: 74176142-4684-4d8a-8b0a-713257e7df8e type: similar status: test description: Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often used by attackers to perform AD enumeration. references: - https://github.com/samratashok/ADModule - https://twitter.com/cyb3rops/status/1617108657166061568?s=20 - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/active-directory-enumeration-with-ad-module-without-rsat-or-admin-privileges author: frack113, Nasreddine Bencherchali date: 2023-01-22 tags: - attack.reconnaissance - attack.discovery - attack.impact logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enable' detection: selection_generic: ScriptBlockText|contains|all: - 'Import-Module ' - Microsoft.ActiveDirectory.Management.dll selection_specific: ScriptBlockText|contains: ipmo Microsoft.ActiveDirectory.Management.dll condition: 1 of selection_* falsepositives: - Legitimate use of the library for administrative activity level: medium
Near-miss passage: Sigma rule: Detects changes to the ESXi syslog configuration via "esxcli". Logsource: linux / process_creation. Rule: title: ESXi Syslog Configuration Change Via ESXCLI id: 38eb1dbb-011f-40b1-a126-cf03a0210563 status: test description: Detects changes to the ESXi syslog configuration via "esxcli" references: - https://support.solarwinds.com/SuccessCenter/s/article/Configure-ESXi-Syslog-to-LEM?language=en_US - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html author: Cedric Maurugeon date: 2023-09-04 tags: - attack.execution - attack.defense-impairment - attack.t1685 - attack.t1690 - attack.t1059.012 logsource: category: process_creation product: linux detection: selection: Image|endswith: /esxcli CommandLine|contains|all: - system - syslog - config CommandLine|contains: ' set' condition: selection falsepositives: - Legitimate administrative activities level: medium
Query: exploit Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to execute arbitrary code with root privileges via a crafted UDS patch with shell s
Matching passage: CVE-2015-2252. CWE: CWE-94. CVSS: 8.800000190734863. Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to execute arbitrary code with root privileges via a crafted UDS patch with shell scripts.
Near-miss passage: CVE-2015-8351. CWE: CWE-94. CVSS: 9.0. PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allow_url_include is enabled, allows remote authenticated users to execute arbitrary PHP code via a URL in the abspath parameter to frontend/captcha/ajaxresponse.php. NOTE: this can also be leveraged to include and execute arbitrary local files via directory traversal sequences regardless of whether allow_url_include is enabled.
Query: explain CWE-690
Matching passage: CWE-690 Unchecked Return Value to NULL Pointer Dereference. The product does not check for an error after calling a function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference.
Near-miss passage: CWE-384 Session Fixation. Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
Query: detection rule: Detects WinRAR creating files in Windows startup locations, which may indicate an attempt to establish persistence by ad
Matching passage: Sigma rule: Detects WinRAR creating files in Windows startup locations, which may indicate an attempt to establish persistence by ad. Logsource: windows / file_event. Rule: title: WinRAR Creating Files in Startup Locations id: 74a2b37d-fea4-41e0-9ac7-c9fbcf1f60cc status: experimental description: 'Detects WinRAR creating files in Windows startup locations, which may indicate an attempt to establish persistence by adding malicious files to the Startup folder. This kind of behaviour has been associated with exploitation of WinRAR path traversal vulnerability CVE-2025-6218 or CVE-2025-8088. ' references: - https://github.com/mulwareX/CVE-2025-6218-POC - https://x.com/0x534c/status/1944694507787710685 - https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-07-16 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: file_event product: windows detection: selection: Image|endswith: - \WinRAR.exe - \Rar.exe TargetFilename|contains: \Start Menu\Programs\Startup\ condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a script interpreter wscript/cscript opening a network connection to a non-local network. Adversaries may use sc. Logsource: windows / network_connection. Rule: title: Outbound Network Connection Initiated By Script Interpreter id: 992a6cae-db6a-43c8-9cec-76d7195c96fc related: - id: 08249dc0-a28d-4555-8ba5-9255a198e08c type: derived status: test description: Detects a script interpreter wscript/cscript opening a network connection to a non-local network. Adversaries may use script to download malicious payloads. references: - https://github.com/redcanaryco/atomic-red-team/blob/28d190330fe44de6ff4767fc400cc10fa7cd6540/atomics/T1105/T1105.md author: frack113, Florian Roth (Nextron Systems) date: 2022-08-28 modified: 2024-03-13 tags: - attack.command-and-control - attack.t1105 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' Image|endswith: - \wscript.exe - \cscript.exe filter_main_local_ranges: DestinationIp|cidr: - 127.0.0.0/8 - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 filter_main_ms_ranges: DestinationIp|cidr: 20.0.0.0/11 condition: selection and not 1 of filter_main_* falsepositives: - Legitimate scripts level: high
Query: describe CVE-2015-2674
Matching passage: CVE-2015-2674. CWE: CWE-295. CVSS: 5.900000095367432. Restkit allows man-in-the-middle attackers to spoof TLS servers by leveraging use of the ssl.wrap_socket function in Python with the default CERT_NONE value for the cert_reqs argument.
Near-miss passage: CVE-2015-2330. CWE: CWE-295. CVSS: 7.5. Late TLS certificate verification in WebKitGTK+ prior to 2.6.6 allows remote attackers to view a secure HTTP request, including, for example, secure cookies.
Query: Suspicious Remote Desktop Software execution detected on endpoint
Matching passage: T1219.002 Remote Desktop Software. Tactics: command and control. Description: An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks. Desktop support software provides a graphical interface for remotely controlling another computer, transmitting the display output, keyboard input, and mouse control between devices using various protocols. Desktop support software, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy) Remote access modules/features may also exist as part of otherwise existing software such as Zoom or Google Chrome’s Remote Desktop.(Citation: Google Chrome Remote Desktop)(Citation: Chrome Remote Desktop)
Near-miss passage: T1219 Remote Access Tools. Tactics: command and control. Description: An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy) Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access. Remote access tools may be installed and used post-compromise as an alternate communications channel for redundant access or to establish an interactive remote desktop session with the target system. It may also be used as a malware component to establish a reverse connection or back-connect to a service or adversary-controlled system. Installation of many remote access tools may also include persistence (e.g., the software's installation routine creates a [Windows Service](https://attack.mitre.org/techniques/T1543/003)). Remote access modules/features may also exist as part of otherwise existing software (e.g., Google Chrome’s Remote Desktop).(Citation: Google Chrome Remote Desktop)(Citation: Chrome Remote Desktop)
Query: risk of Unrestricted file upload vulnerability in the (1) myAccount, (2) projects, (3) tasks, (4) tickets, (5) discussions, (6) reports, and (7) scheduler pages in qdPM 8.3 allows remote a
Matching passage: CVE-2015-3884. CWE: CWE-434. CVSS: 8.800000190734863. Unrestricted file upload vulnerability in the (1) myAccount, (2) projects, (3) tasks, (4) tickets, (5) discussions, (6) reports, and (7) scheduler pages in qdPM 8.3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/attachments/ or uploads/users/.
Near-miss passage: CVE-2015-0796. CWE: CWE-434. CVSS: 7.800000190734863. In open buildservice 2.6 before 2.6.3, 2.5 before 2.5.7 and 2.4 before 2.4.8 the source service patch application could generate non-standard files like symlinks or device nodes, which could allow buildservice users to break of confinement or cause denial of service attacks on the source service.
Query: exploit Multiple open redirect vulnerabilities in Web Reference Database (aka refbase) through 0.9.6 and bleeding-edge before 2015-01-08 allow remote attackers to redirect users to arbitra
Matching passage: CVE-2015-6012. CWE: UNKNOWN. CVSS: 5.800000190734863. Multiple open redirect vulnerabilities in Web Reference Database (aka refbase) through 0.9.6 and bleeding-edge before 2015-01-08 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the referrer parameter.
Near-miss passage: CVE-2015-4895. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB.
Query: Sigma rule for Detects well-known credential dumping tools execution via service execution events
Matching passage: Sigma rule: Detects well-known credential dumping tools execution via service execution events. Logsource: windows / system. Rule: title: Credential Dumping Tools Service Execution - System id: 4976aa50-8f41-45c6-8b15-ab3fc10e79ed status: test description: Detects well-known credential dumping tools execution via service execution events references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment author: Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community date: 2017-03-05 modified: 2022-11-29 tags: - attack.credential-access - attack.execution - attack.t1003.001 - attack.t1003.002 - attack.t1003.004 - attack.t1003.005 - attack.t1003.006 - attack.t1569.002 - attack.s0005 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ImagePath|contains: - cachedump - dumpsvc - fgexec - gsecdump - mimidrv - pwdump - servpw condition: selection falsepositives: - Legitimate Administrator using credential dumping tool for password recovery level: high
Near-miss passage: Sigma rule: Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52). Logsource: windows / process_creation. Rule: title: UAC Bypass Abusing Winsat Path Parsing - Process id: 7a01183d-71a2-46ad-ad5c-acd989ac1793 status: test description: Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-30 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: IntegrityLevel: - High - System - S-1-16-16384 - S-1-16-12288 ParentImage|endswith: \AppData\Local\Temp\system32\winsat.exe ParentCommandLine|contains: C:\Windows \system32\winsat.exe condition: selection falsepositives: - Unknown level: high