alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Detects when a rule has been added to the Windows Firewall exception list
Matching passage: Sigma rule: Detects when a rule has been added to the Windows Firewall exception list. Logsource: windows / firewall-as. Rule: title: Uncommon New Firewall Rule Added In Windows Firewall Exception List id: cde0a575-7d3d-4a49-9817-b8004a7bf105 status: test description: Detects when a rule has been added to the Windows Firewall exception list references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10) author: frack113 date: 2022-02-19 modified: 2025-10-08 tags: - attack.defense-impairment - attack.t1686.003 logsource: product: windows service: firewall-as detection: selection: EventID: - 2004 - 2071 - 2097 filter_main_block: Action: 2 filter_main_generic: ApplicationPath|startswith: - C:\Program Files (x86)\ - C:\Program Files\ - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ filter_main_covered_paths: ApplicationPath|contains: - C:\PerfLogs\ - C:\Temp\ - C:\Tmp\ - C:\Users\Public\ - C:\Windows\Tasks\ - C:\Windows\Temp\ - \AppData\Local\Temp\ filter_main_system_dllhost: ApplicationPath: System ModifyingApplication: C:\Windows\System32\dllhost.exe filter_main_tiworker: ModifyingApplication|startswith: C:\Windows\WinSxS\ ModifyingApplication|endswith: \TiWorker.exe filter_main_null: ApplicationPath: null filter_optional_no_path: ModifyingApplication: - C:\Windows\System32\svchost.exe - C:\Windows\System32\dllhost.exe ApplicationPath: '' filter_optional_msmpeng: - ModifyingApplication|startswith: - C:\ProgramData\Microsoft\Windows Defender\Platform\ - C:\Program Files\Windows Defender\ ModifyingApplication|endswith: \MsMpEng.exe - ApplicationPath|startswith: - C:\ProgramData\Microsoft\Windows Defender\Platform\ - C:\Program Files\Windows Defender\ ApplicationPath|endswith: \MsMpEng.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* level: medium
Near-miss passage: Sigma rule: Indicates anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in th. Logsource: azure / riskdetection. Rule: title: Suspicious Browser Activity id: 944f6adb-7a99-4c69-80c1-b712579e93e6 status: test description: Indicates anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#suspicious-browser - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-03 tags: - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation - attack.initial-access logsource: product: azure service: riskdetection detection: selection: riskEventType: suspiciousBrowser condition: selection falsepositives: - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user. level: high
Query: describe CVE-2015-9031
Matching passage: CVE-2015-9031. CWE: CWE-200. CVSS: 3.299999952316284. In all Android releases from CAF using the Linux kernel, a TZ memory address is exposed to HLOS by HDCP.
Near-miss passage: CVE-2015-1677. CWE: CWE-200. CVSS: 2.0999999046325684. The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to bypass the ASLR protection mechanism via a crafted function call, aka "Microsoft Windows Kernel Memory Disclosure Vulnerability," a different vulnerability than CVE-2015-1676, CVE-2015-1678, CVE-2015-1679, and CVE-2015-1680.
Query: alert when Detects Obfuscated Powershell via use Rundll32 in Scripts
Matching passage: Sigma rule: Detects Obfuscated Powershell via use Rundll32 in Scripts. Logsource: windows / ps_module. Rule: title: Invoke-Obfuscation Via Use Rundll32 - PowerShell Module id: 88a22f69-62f9-4b8a-aa00-6b0212f2f05a related: - id: a5a30a6e-75ca-4233-8b8c-42e0f2037d3b type: derived status: test description: Detects Obfuscated Powershell via use Rundll32 in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2019-10-08 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_4103: Payload|contains|all: - '&&' - rundll32 - shell32.dll - shellexec_rundll Payload|contains: - value - invoke - comspec - iex condition: selection_4103 falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects programs that connect to uncommon destination ports. Logsource: windows / network_connection. Rule: title: Communication To Uncommon Destination Ports id: 6d8c3d20-a5e1-494f-8412-4571d716cf5c related: - id: 4b89abaa-99fe-4232-afdd-8f9aa4d20382 type: similar status: test description: Detects programs that connect to uncommon destination ports references: - https://docs.google.com/spreadsheets/d/17pSTDNpa0sf6pHeRhusvWG6rThciE8CsXTSlDUAZDyo author: Florian Roth (Nextron Systems) date: 2017-03-19 modified: 2024-03-12 tags: - attack.persistence - attack.command-and-control - attack.t1571 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' DestinationPort: - 8080 - 8888 filter_main_local_ranges: DestinationIp|cidr: - 127.0.0.0/8 - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 filter_optional_sys_directories: Image|startswith: - C:\Program Files\ - C:\Program Files (x86)\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Query: describe CVE-2015-7273
Matching passage: CVE-2015-7273. CWE: CWE-611. CVSS: 9.800000190734863. Dell Integrated Remote Access Controller (iDRAC) 7/8 before 2.21.21.21 has XXE.
Near-miss passage: CVE-2015-8866. CWE: CWE-611. CVSS: 9.600000381469727. ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, which allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document, a related issue to CVE-2015-5161.
Query: rule covering Detects actions that clear the local ShimCache and remove forensic evidence
Matching passage: Sigma rule: Detects actions that clear the local ShimCache and remove forensic evidence. Logsource: windows / process_creation. Rule: title: ShimCache Flush id: b0524451-19af-4efa-a46f-562a977f792e status: stable description: Detects actions that clear the local ShimCache and remove forensic evidence references: - https://medium.com/@blueteamops/shimcache-flush-89daff28d15e author: Florian Roth (Nextron Systems) date: 2021-02-01 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: process_creation product: windows detection: selection1a: CommandLine|contains|all: - rundll32 - apphelp.dll selection1b: CommandLine|contains: - ShimFlushCache - '#250' selection2a: CommandLine|contains|all: - rundll32 - kernel32.dll selection2b: CommandLine|contains: - BaseFlushAppcompatCache - '#46' condition: ( selection1a and selection1b ) or ( selection2a and selection2b ) falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects changes to the security groups associated with an Elastic Load Balancer (ELB) or Application Load Balancer (ALB). Logsource: aws / cloudtrail. Rule: title: LoadBalancer Security Group Modification id: 7a4409fc-f8ca-45f6-8006-127d779eaad9 status: test description: 'Detects changes to the security groups associated with an Elastic Load Balancer (ELB) or Application Load Balancer (ALB). This can indicate that a misconfiguration allowing more traffic into the system than required, or could indicate that an attacker is attempting to enable new connections into a VPC or subnet controlled by the account. ' references: - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/ author: jamesc-grafana date: 2024-07-11 tags: - attack.initial-access - attack.t1190 logsource: product: aws service: cloudtrail detection: selection: eventSource: elasticloadbalancing.amazonaws.com eventName: - ApplySecurityGroupsToLoadBalancer - SetSecurityGroups condition: selection falsepositives: - Repurposing of an ELB or ALB to serve a different or additional application - Changes to security groups to allow for new services to be deployed level: medium
Query: risk of iTerm2 3.x before 3.1.1 allows remote attackers to discover passwords by reading DNS queries. A new (default) feature was added to iTerm2 version 3.0.0 (and unreleased 2.9.x versio
Matching passage: CVE-2015-9231. CWE: CWE-200. CVSS: 7.5. iTerm2 3.x before 3.1.1 allows remote attackers to discover passwords by reading DNS queries. A new (default) feature was added to iTerm2 version 3.0.0 (and unreleased 2.9.x versions such as 2.9.20150717) that resulted in a potential information disclosure. In an attempt to see whether the text under the cursor (or selected text) was a URL, the text would be sent as an unencrypted DNS query. This has the potential to result in passwords and other sensitive information being sent in cleartext without the user being aware.
Near-miss passage: CVE-2015-1977. CWE: CWE-200. CVSS: 7.5. Directory traversal vulnerability in the Web Administration tool in IBM Tivoli Directory Server (ITDS) before 6.1.0.74-ISS-ISDS-IF0074, 6.2.x before 6.2.0.50-ISS-ISDS-IF0050, and 6.3.x before 6.3.0.43-ISS-ISDS-IF0043 and IBM Security Directory Server (ISDS) before 6.3.1.18-ISS-ISDS-IF0018 and 6.4.x before 6.4.0.9-ISS-ISDS-IF0009 allows remote attackers to read arbitrary files via a .. (dot dot) in a URL.
Query: CVE similar to CVE-2015-7877
Matching passage: CVE-2015-7877. CWE: CWE-89. CVSS: 9.800000190734863. Multiple SQL injection vulnerabilities in the User Dashboard module 7.x before 7.x-1.4 for Drupal allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-5078. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the insert function in application/controllers/admin/dataentry.php in LimeSurvey 2.06+ allows remote authenticated users to execute arbitrary SQL commands via the closedate parameter.
Query: risk of The Telephony subsystem in Apple iOS before 9.1 allows attackers to obtain sensitive call-status information via a crafted app.
Matching passage: CVE-2015-7022. CWE: CWE-200. CVSS: 4.300000190734863. The Telephony subsystem in Apple iOS before 9.1 allows attackers to obtain sensitive call-status information via a crafted app.
Near-miss passage: CVE-2015-1677. CWE: CWE-200. CVSS: 2.0999999046325684. The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to bypass the ASLR protection mechanism via a crafted function call, aka "Microsoft Windows Kernel Memory Disclosure Vulnerability," a different vulnerability than CVE-2015-1676, CVE-2015-1678, CVE-2015-1679, and CVE-2015-1680.
Query: describe CVE-2015-2737
Matching passage: CVE-2015-2737. CWE: CWE-17. CVSS: 10.0. The rx::d3d11::SetBufferData function in the Direct3D 11 implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 reads data from uninitialized memory locations, which has unspecified impact and attack vectors.
Near-miss passage: CVE-2015-1233. CWE: CWE-17. CVSS: 7.5. Google Chrome before 41.0.2272.118 does not properly handle the interaction of IPC, the Gamepad API, and Google V8, which allows remote attackers to execute arbitrary code via unspecified vectors.
Query: describe CVE-2015-6428
Matching passage: CVE-2015-6428. CWE: CWE-200. CVSS: 5.0. Cisco DPQ3925 devices with EDVA r1 Base allow remote attackers to obtain sensitive information via a crafted HTTP request, aka Bug ID CSCuv03958.
Near-miss passage: CVE-2015-6759. CWE: CWE-200. CVSS: 5.0. The shouldTreatAsUniqueOrigin function in platform/weborigin/SecurityOrigin.cpp in Blink, as used in Google Chrome before 46.0.2490.71, does not ensure that the origin of a LocalStorage resource is considered unique, which allows remote attackers to obtain sensitive information via vectors involving a blob: URL.
Query: patch priority for CVE-2015-8418
Matching passage: CVE-2015-8418. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8417, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, CVE-2015-8451, and CVE-2015-8455.
Near-miss passage: CVE-2015-3682. CWE: CWE-119. CVSS: 6.800000190734863. Apple Type Services (ATS) in Apple OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-3679, CVE-2015-3680, and CVE-2015-3681.
Query: exploit Gummi 0.6.5 allows local users to write to arbitrary files via a symlink attack on a temporary dot file that uses the name of an existing file and a (1) .aux, (2) .log, (3) .out, (
Matching passage: CVE-2015-7758. CWE: CWE-59. CVSS: 3.299999952316284. Gummi 0.6.5 allows local users to write to arbitrary files via a symlink attack on a temporary dot file that uses the name of an existing file and a (1) .aux, (2) .log, (3) .out, (4) .pdf, or (5) .toc extension for the file name, as demonstrated by .thesis.tex.aux.
Near-miss passage: CVE-2015-7724. CWE: CWE-59. CVSS: 7.800000190734863. AMD fglrx-driver before 15.9 allows local users to gain privileges via a symlink attack. NOTE: This vulnerability exists due to an incomplete fix for CVE-2015-7723.
Query: exploit Cisco Unified Communications Manager 10.0(1.10000.12) allows local users to gain privileges via a command string in an unspecified parameter, aka Bug ID CSCut19546.
Matching passage: CVE-2015-0717. CWE: CWE-20. CVSS: 6.900000095367432. Cisco Unified Communications Manager 10.0(1.10000.12) allows local users to gain privileges via a command string in an unspecified parameter, aka Bug ID CSCut19546.
Near-miss passage: CVE-2015-0658. CWE: CWE-20. CVSS: 7.900000095367432. The DHCP implementation in the PowerOn Auto Provisioning (POAP) feature in Cisco NX-OS does not properly restrict the initialization process, which allows remote attackers to execute arbitrary commands as root by sending crafted response packets on the local network, aka Bug ID CSCur14589.
Query: CVE similar to CVE-2015-7294
Matching passage: CVE-2015-7294. CWE: CWE-90. CVSS: 7.5. ldapauth-fork before 2.3.3 allows remote attackers to perform LDAP injection attacks via a crafted username.
Near-miss passage: CVE-2015-10027. CWE: CWE-90. CVSS: 9.800000190734863. A vulnerability, which was classified as problematic, has been found in hydrian TTRSS-Auth-LDAP. Affected by this issue is some unknown functionality of the component Username Handler. The manipulation leads to ldap injection. Upgrading to version 2.0b1 is able to address this issue. The patch is identified as a7f7a5a82d9202a5c40d606a5c519ba61b224eb8. It is recommended to upgrade the affected component. VDB-217622 is the identifier assigned to this vulnerability.
Query: Sigma rule for Identifies use of various commands to query a systems time. This technique may be used before executing a scheduled task
Matching passage: Sigma rule: Identifies use of various commands to query a systems time. This technique may be used before executing a scheduled task. Logsource: windows / process_creation. Rule: title: Discovery of a System Time id: b243b280-65fe-48df-ba07-6ddea7646427 status: test description: Identifies use of various commands to query a systems time. This technique may be used before executing a scheduled task or to discover the time zone of a target system. references: - https://eqllib.readthedocs.io/en/latest/analytics/fcdb99c2-ac3c-4bde-b664-4b336329bed2.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1124/T1124.md author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community date: 2019-10-24 modified: 2022-06-28 tags: - attack.discovery - attack.t1124 logsource: category: process_creation product: windows detection: selection_time: Image|endswith: - \net.exe - \net1.exe CommandLine|contains: time selection_w32tm: Image|endswith: \w32tm.exe CommandLine|contains: tz condition: 1 of selection_* falsepositives: - Legitimate use of the system utilities to discover system time for legitimate reason level: low
Near-miss passage: Sigma rule: This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that ar. Logsource: windows. Rule: title: Mimikatz Use id: 06d71506-7beb-4f22-8888-e2e5e2ca7fd8 status: test description: This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups) references: - https://tools.thehacker.recipes/mimikatz/modules author: Florian Roth (Nextron Systems), David ANDRE (additional keywords) date: 2017-01-10 modified: 2022-01-05 tags: - attack.s0002 - attack.lateral-movement - attack.credential-access - car.2013-07-001 - car.2019-04-004 - attack.t1003.002 - attack.t1003.004 - attack.t1003.001 - attack.t1003.006 logsource: product: windows detection: keywords: - dpapi::masterkey - eo.oe.kiwi - event::clear - event::drop - gentilkiwi.com - kerberos::golden - kerberos::ptc - kerberos::ptt - kerberos::tgt - Kiwi Legit Printer - 'lsadump::' - mimidrv.sys - \mimilib.dll - misc::printnightmare - misc::shadowcopies - misc::skeleton - privilege::backup - privilege::debug - privilege::driver - 'sekurlsa::' filter: EventID: 15 condition: keywords and not filter falsepositives: - Naughty administrators - AV Signature updates - Files with Mimikatz in their filename level: high
Query: CVE similar to CVE-2015-5273
Matching passage: CVE-2015-5273. CWE: CWE-59. CVSS: 3.5999999046325684. The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users to write to arbitrary files via a symlink attack on unpacked.cpio in a pre-created directory with a predictable name in /var/tmp.
Near-miss passage: CVE-2015-4156. CWE: CWE-59. CVSS: 3.5999999046325684. GNU Parallel before 20150522 (Nepal), when using (1) --cat or (2) --fifo with --sshlogin, allows local users to write to arbitrary files via a symlink attack on a temporary file.
Query: rule covering Detects a network connection initiated by "wordpad.exe" over uncommon destination ports. This might indicate potential p
Matching passage: Sigma rule: Detects a network connection initiated by "wordpad.exe" over uncommon destination ports. This might indicate potential p. Logsource: windows / network_connection. Rule: title: Suspicious Wordpad Outbound Connections id: 786cdae8-fefb-4eb2-9227-04e34060db01 status: test description: 'Detects a network connection initiated by "wordpad.exe" over uncommon destination ports. This might indicate potential process injection activity from a beacon or similar mechanisms. ' references: - https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit author: X__Junior (Nextron Systems) date: 2023-07-12 modified: 2023-12-15 tags: - attack.command-and-control - attack.stealth logsource: category: network_connection product: windows detection: selection: Initiated: 'true' Image|endswith: \wordpad.exe filter_main_ports: DestinationPort: - 80 - 139 - 443 - 445 - 465 - 587 - 993 - 995 condition: selection and not 1 of filter_main_* falsepositives: - Other ports can be used, apply additional filters accordingly level: medium
Near-miss passage: Sigma rule: Detects an appx package deployment / installation with the error code "0x80073cff" which indicates that the package didn. Logsource: windows / appxdeployment-server. Rule: title: AppX Package Deployment Failed Due to Signing Requirements id: 898d5fc9-fbc3-43de-93ad-38e97237c344 status: test description: 'Detects an appx package deployment / installation with the error code "0x80073cff" which indicates that the package didn''t meet the signing requirements. ' references: - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/ - https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting - https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-11 modified: 2025-12-03 tags: - attack.stealth logsource: product: windows service: appxdeployment-server detection: selection: EventID: 401 ErrorCode: '0x80073cff' condition: selection falsepositives: - Legitimate AppX packages not signed by MS used part of an enterprise. level: medium