alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Detects the creation of a schtasks that potentially executes a payload stored in the Windows Registry using PowerShell.
Matching passage: Sigma rule: Detects the creation of a schtasks that potentially executes a payload stored in the Windows Registry using PowerShell.. Logsource: windows / process_creation. Rule: title: Scheduled Task Executing Payload from Registry id: 86588b36-c6d3-465f-9cee-8f9093e07798 related: - id: c4eeeeae-89f4-43a7-8b48-8d1bdfa66c78 type: derived status: test description: Detects the creation of a schtasks that potentially executes a payload stored in the Windows Registry using PowerShell. references: - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/ author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2023-07-18 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1053.005 - attack.t1059.001 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \schtasks.exe - OriginalFileName: schtasks.exe selection_cli_create: CommandLine|contains: /Create selection_cli_get: CommandLine|contains: - Get-ItemProperty - ' gp ' selection_cli_hive: CommandLine|contains: - 'HKCU:' - 'HKLM:' - 'registry::' - HKEY_ filter_main_encoding: CommandLine|contains: - FromBase64String - encodedcommand condition: all of selection_* and not 1 of filter_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects unusual processes accessing desktop.ini remotely over network share, which can be leveraged to alter how Explore. Logsource: windows / security. Rule: title: Windows Network Access Suspicious desktop.ini Action id: 35bc7e28-ee6b-492f-ab04-da58fcf6402e status: test description: Detects unusual processes accessing desktop.ini remotely over network share, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk. references: - https://isc.sans.edu/forums/diary/Desktopini+as+a+postexploitation+tool/25912/ author: Tim Shelton (HAWK.IO) date: 2021-12-06 modified: 2022-01-16 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.009 logsource: product: windows service: security detection: selection: EventID: 5145 ObjectType: File RelativeTargetName|endswith: \desktop.ini AccessList|contains: - WriteData - DELETE - WriteDAC - AppendData - AddSubdirectory condition: selection falsepositives: - Read only access list authority level: medium
Query: Sigma rule for Detects Certify a tool for Active Directory certificate abuse based on PE metadata characteristics and common command li
Matching passage: Sigma rule: Detects Certify a tool for Active Directory certificate abuse based on PE metadata characteristics and common command li. Logsource: windows / process_creation. Rule: title: HackTool - Certify Execution id: 762f2482-ff21-4970-8939-0aa317a886bb status: test description: Detects Certify a tool for Active Directory certificate abuse based on PE metadata characteristics and common command line arguments. references: - https://github.com/GhostPack/Certify author: pH-T (Nextron Systems) date: 2023-04-17 modified: 2023-04-25 tags: - attack.discovery - attack.credential-access - attack.t1649 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \Certify.exe - OriginalFileName: Certify.exe - Description|contains: Certify selection_cli_commands: CommandLine|contains: - '.exe cas ' - '.exe find ' - '.exe pkiobjects ' - '.exe request ' - '.exe download ' selection_cli_options: CommandLine|contains: - ' /vulnerable' - ' /template:' - ' /altname:' - ' /domain:' - ' /path:' - ' /ca:' condition: selection_img or all of selection_cli_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious processes spawned from a Java host process which could indicate a sign of exploitation (e.g. log4j). Logsource: windows / process_creation. Rule: title: Suspicious Processes Spawned by Java.EXE id: 0d34ed8b-1c12-4ff2-828c-16fc860b766d related: - id: dff1e1cc-d3fd-47c8-bfc2-aeb878a754c0 type: similar status: test description: Detects suspicious processes spawned from a Java host process which could indicate a sign of exploitation (e.g. log4j) references: - https://web.archive.org/web/20231230220738/https://www.lunasec.io/docs/blog/log4j-zero-day/ author: Andreas Hunkeler (@Karneades), Florian Roth date: 2021-12-17 modified: 2024-01-18 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \java.exe Image|endswith: - \AppVLP.exe - \bitsadmin.exe - \certutil.exe - \cscript.exe - \curl.exe - \forfiles.exe - \hh.exe - \mftrace.exe - \mshta.exe - \net.exe - \net1.exe - \query.exe - \reg.exe - \regsvr32.exe - \rundll32.exe - \schtasks.exe - \scrcons.exe - \scriptrunner.exe - \sh.exe - \systeminfo.exe - \whoami.exe - \wmic.exe - \wscript.exe condition: selection falsepositives: - Legitimate calls to system binaries - Company specific internal usage level: high
Query: vulnerability: Cisco ASR 5500 System Architecture Evolution (SAE) Gateway devices allow remote attackers to cause a denial of service (CPU consumption and SNMP outage) via malformed SNMP packets,
Matching passage: CVE-2015-0617. CWE: CWE-399. CVSS: 5.0. Cisco ASR 5500 System Architecture Evolution (SAE) Gateway devices allow remote attackers to cause a denial of service (CPU consumption and SNMP outage) via malformed SNMP packets, aka Bug ID CSCur13393.
Near-miss passage: CVE-2015-3810. CWE: CWE-399. CVSS: 7.800000190734863. epan/dissectors/packet-websocket.c in the WebSocket dissector in Wireshark 1.12.x before 1.12.5 uses a recursive algorithm, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted packet.
Query: alert when Detects the execution of "dctask64.exe", a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This
Matching passage: Sigma rule: Detects the execution of "dctask64.exe", a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This. Logsource: windows / process_creation. Rule: title: ManageEngine Endpoint Central Dctask64.EXE Potential Abuse id: 6345b048-8441-43a7-9bed-541133633d7a status: test description: 'Detects the execution of "dctask64.exe", a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This binary can be abused for DLL injection, arbitrary command and process execution. ' references: - https://twitter.com/gN3mes1s/status/1222088214581825540 - https://twitter.com/gN3mes1s/status/1222095963789111296 - https://twitter.com/gN3mes1s/status/1222095371175911424 author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2020-01-28 modified: 2025-01-22 tags: - attack.privilege-escalation - attack.stealth - attack.t1055.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \dctask64.exe - Hashes|contains: - IMPHASH=6834B1B94E49701D77CCB3C0895E1AFD - IMPHASH=1BB6F93B129F398C7C4A76BB97450BBA - IMPHASH=FAA2AC19875FADE461C8D89DCF2710A3 - IMPHASH=F1039CED4B91572AB7847D26032E6BBF selection_cli: CommandLine|contains: - ' executecmd64 ' - ' invokeexe ' - ' injectDll ' condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects newly added root certificate authority to an AzureAD tenant to support certificate based authentication.. Logsource: azure / auditlogs. Rule: title: New Root Certificate Authority Added id: 4bb80281-3756-4ec8-a88e-523c5a6fda9e status: test description: Detects newly added root certificate authority to an AzureAD tenant to support certificate based authentication. references: - https://posts.specterops.io/passwordless-persistence-and-privilege-escalation-in-azure-98a01310be3f - https://goodworkaround.com/2022/02/15/digging-into-azure-ad-certificate-based-authentication/ author: Harjot Shah Singh, '@cyb3rjy0t' date: 2024-03-26 tags: - attack.credential-access - attack.persistence - attack.privilege-escalation - attack.defense-impairment - attack.t1556 logsource: product: azure service: auditlogs detection: selection: OperationName: Set Company Information TargetResources.modifiedProperties.newValue|contains: TrustedCAsForPasswordlessAuth condition: selection falsepositives: - Unknown level: medium
Query: weakness Assigning instead of Comparing
Matching passage: CWE-481 Assigning instead of Comparing. The code uses an operator for assignment when the intention was to perform a comparison.
Near-miss passage: CWE-783 Operator Precedence Logic Error. The product uses an expression in which operator precedence causes incorrect logic to be used.
Query: CVE similar to CVE-2015-5014
Matching passage: CVE-2015-5014. CWE: CWE-20. CVSS: 9.300000190734863. IBM Cognos Disclosure Management (CDM) 10.1.x and 10.2.x before 10.2.4 IF10 allows man-in-the-middle attackers to obtain access by spoofing an executable file during a client upload operation.
Near-miss passage: CVE-2015-8844. CWE: CWE-20. CVSS: 5.5. The signal implementation in the Linux kernel before 4.3.5 on powerpc platforms does not check for an MSR with both the S and T bits set, which allows local users to cause a denial of service (TM Bad Thing exception and panic) via a crafted application.
Query: CVE similar to CVE-2015-3235
Matching passage: CVE-2015-3235. CWE: CWE-264. CVSS: 6.0. Foreman before 1.9.0 allows remote authenticated users with the edit_users permission to edit administrator users and change their passwords via unspecified vectors.
Near-miss passage: CVE-2015-5498. CWE: CWE-264. CVSS: 5.0. The Shipwire API module 7.x-1.x before 7.x-1.03 for Drupal does not check the view permission for the shipments overview (admin/shipwire/shipments), which allows remote attackers to obtain sensitive information via a request to the page.
Query: detect Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. This activit in logs
Matching passage: Sigma rule: Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. This activit. Logsource: aws / cloudtrail. Rule: title: AWS KMS Imported Key Material Usage id: 1279262f-1464-422f-ac0d-5b545320c526 status: experimental description: 'Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. This activity is uncommon and provides a high certainty signal. ' references: - https://www.chrisfarris.com/post/effective-aws-ransomware/ - https://docs.aws.amazon.com/kms/latest/developerguide/ct-importkeymaterial.html - https://docs.aws.amazon.com/kms/latest/developerguide/ct-deleteimportedkeymaterial.html author: toopricey date: 2025-10-18 tags: - attack.impact - attack.t1486 - attack.resource-development - attack.t1608.003 logsource: product: aws service: cloudtrail detection: selection: eventSource: kms.amazonaws.com eventName: - ImportKeyMaterial - DeleteImportedKeyMaterial condition: selection falsepositives: - Legitimate use cases for imported key material are rare, but may include, Organizations with hybrid cloud architectures that import external key material for compliance requirements. - Development or testing environments that simulate external key management scenarios. Even in these cases, such activity is typically infrequent and should not add significant noise. level: high
Near-miss passage: Sigma rule: Detects deletion of the RunMRU registry key, which stores the history of commands executed via the Run dialog. In the cl. Logsource: windows / process_creation. Rule: title: RunMRU Registry Key Deletion id: c11aecef-9c37-45a6-9c07-bc0782f963fd related: - id: 3a9b8c1e-5b2e-4f7a-9d1c-2a7f3b6e1c55 type: similar status: experimental description: 'Detects deletion of the RunMRU registry key, which stores the history of commands executed via the Run dialog. In the clickfix techniques, the phishing lures instruct users to open a run dialog through (Win + R) and execute malicious commands. Adversaries may delete this key to cover their tracks after executing commands. ' references: - https://www.zscaler.com/blogs/security-research/coldriver-updates-arsenal-baitswitch-and-simplefix author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-09-25 tags: - attack.stealth - attack.t1070.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_cli: CommandLine|contains|all: - ' del' - \Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU condition: all of selection_* falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-6385
Matching passage: CVE-2015-6385. CWE: CWE-20. CVSS: 7.199999809265137. The publish-event event-manager feature in Cisco IOS 15.5(2)S and 15.5(3)S on Cloud Services Router 1000V devices allows local users to execute arbitrary commands with root privileges by leveraging administrative access to enter crafted environment variables, aka Bug ID CSCux14943.
Near-miss passage: CVE-2015-5401. CWE: CWE-20. CVSS: 7.5. Teradata Gateway before 15.00.03.02-1 and 15.10.x before 15.10.00.01-1 and TD Express before 15.00.02.08_Sles10 and 15.00.02.08_Sles11 allow remote attackers to cause a denial of service (database crash) via a malformed CONFIG REQUEST message.
Query: Suspicious Masquerade File Type execution detected on endpoint
Matching passage: T1036.008 Masquerade File Type. Tactics: stealth. Description: Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, icon, and contents. Various file types have a typical standard format, including how they are encoded and organized. For example, a file’s signature (also known as header or magic bytes) is the beginning bytes of a file and is often used to identify the file’s type. For example, the header of a JPEG file, is <code> 0xFF 0xD8</code> and the file extension is either `.JPE`, `.JPEG` or `.JPG`. Adversaries may edit the header’s hex code and/or the file extension of a malicious payload in order to bypass file validation checks and/or input sanitization. This behavior is commonly used when payload files are transferred (e.g., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) and stored (e.g., [Upload Malware](https://attack.mitre.org/techniques/T1608/001)) so that adversaries may move their malware without triggering detections. Common non-executable file types and extensions, such as text files (`.txt`) and image files (`.jpg`, `.gif`, etc.) may be typically treated as benign. Based on this, adversaries may use a file extension to disguise malware, such as naming a PHP backdoor code with a file name of <code>test.gif</code>. A user may not know that a file is malicious due to the benign appearance and file extension. Polyglot files, which are files that have multiple different file types and that function differently based on the application that will execute them, may also be used to disguise malicious malware and capabilities.(Citation: polygot_icedID)
Near-miss passage: T1036.003 Rename Legitimate Utilities. Tactics: stealth. Description: Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for legitimate utilities adversaries are capable of abusing, including both built-in binaries and tools such as PSExec, AutoHotKey, and IronPython.(Citation: LOLBAS Main Site)(Citation: Huntress Python Malware 2025)(Citation: The DFIR Report AutoHotKey 2023)(Citation: Splunk Detect Renamed PSExec) It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename <code>rundll32.exe</code>).(Citation: Elastic Masquerade Ball) An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on these utilities executing from non-standard paths.(Citation: F-Secure CozyDuke)
Query: secure coding against Incomplete Model of Endpoint Features
Matching passage: CWE-437 Incomplete Model of Endpoint Features. A product acts as an intermediary or monitor between two or more endpoints, but it does not have a complete model of an endpoint's features, behaviors, or state, potentially causing the product to perform incorrect actions based on this incomplete model.
Near-miss passage: CWE-1276 Hardware Child Block Incorrectly Connected to Parent System. Signals between a hardware IP and the parent system design are incorrectly connected causing security risks.
Query: secure coding against Externally-Generated Error Message Containing Sensitive Information
Matching passage: CWE-211 Externally-Generated Error Message Containing Sensitive Information. The product performs an operation that triggers an external diagnostic or error message that is not directly generated or controlled by the product, such as an error generated by the programming language interpreter that a software application uses. The error can contain sensitive system information.
Near-miss passage: CWE-1173 Improper Use of Validation Framework. The product does not use, or incorrectly uses, an input validation framework that is provided by the source language or an independent library.
Query: CVE similar to CVE-2015-0241
Matching passage: CVE-2015-0241. CWE: CWE-120. CVSS: 8.800000190734863. The to_char function in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a (1) large number of digits when processing a numeric formatting template, which triggers a buffer over-read, or (2) crafted timestamp formatting template, which triggers a buffer overflow.
Near-miss passage: CVE-2015-8126. CWE: CWE-120. CVSS: 7.5. Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.
Query: patch priority for CVE-2015-9188
Matching passage: CVE-2015-9188. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, in Secure DEMUX command handler, when parameter validation fails, an error code is written into a response buffer without checking that response buffer length, passed from HLOS, which may result in memory corruption.
Near-miss passage: CVE-2015-2797. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in AirTies Air 6372, 5760, 5750, 5650TT, 5453, 5444TT, 5443, 5442, 5343, 5342, 5341, and 5021 DSL modems with firmware 1.0.2.0 and earlier allows remote attackers to execute arbitrary code via a long string in the redirect parameter to cgi-bin/login.
Query: secure coding against External Control of File Name or Path
Matching passage: CWE-73 External Control of File Name or Path. The product allows user input to control or influence paths or file names that are used in filesystem operations.
Near-miss passage: CWE-406 Insufficient Control of Network Message Volume (Network Amplification). The product does not sufficiently monitor or control transmitted network traffic volume, so that an actor can cause the product to transmit more traffic than should be allowed for that actor.
Query: common weakness: Improper Neutralization of Special Elements in Data Query Logic
Matching passage: CWE-943 Improper Neutralization of Special Elements in Data Query Logic. The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.
Near-miss passage: CWE-272 Least Privilege Violation. The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.
Query: SIEM correlation: defense impairment activity consistent with Disable Crypto Hardware
Matching passage: T1600.002 Disable Crypto Hardware. Tactics: defense impairment. Description: Adversaries disable a network device’s dedicated hardware encryption, which may enable them to leverage weaknesses in software encryption in order to reduce the effort involved in collecting, manipulating, and exfiltrating transmitted data. Many network devices such as routers, switches, and firewalls, perform encryption on network traffic to secure transmission across networks. Often, these devices are equipped with special, dedicated encryption hardware to greatly increase the speed of the encryption process as well as to prevent malicious tampering. When an adversary takes control of such a device, they may disable the dedicated hardware, for example, through use of [Modify System Image](https://attack.mitre.org/techniques/T1601), forcing the use of software to perform encryption on general processors. This is typically used in conjunction with attacks to weaken the strength of the cipher in software (e.g., [Reduce Key Space](https://attack.mitre.org/techniques/T1600/001)). (Citation: Cisco Blog Legacy Device Attacks)
Near-miss passage: T1600.001 Reduce Key Space. Tactics: defense impairment. Description: Adversaries may reduce the level of effort required to decrypt data transmitted over the network by reducing the cipher strength of encrypted communications.(Citation: Cisco Synful Knock Evolution) Adversaries can weaken the encryption software on a compromised network device by reducing the key size used by the software to convert plaintext to ciphertext (e.g., from hundreds or thousands of bytes to just a couple of bytes). As a result, adversaries dramatically reduce the amount of effort needed to decrypt the protected information without the key. Adversaries may modify the key size used and other encryption parameters using specialized commands in a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) introduced to the system through [Modify System Image](https://attack.mitre.org/techniques/T1601) to change the configuration of the device. (Citation: Cisco Blog Legacy Device Attacks)
Query: common weakness: Spyware
Matching passage: CWE-512 Spyware. The product collects personally identifiable information about a human user or the user's activities, but the product accesses this information using other resources besides itself, and it does not require that user's explicit approval or direct input into the product.
Near-miss passage: CWE-624 Executable Regular Expression Error. The product uses a regular expression that either (1) contains an executable component with user-controlled inputs, or (2) allows a user to enable execution by inserting pattern modifiers.