alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Detects Obfuscated use of stdin to execute PowerShell
Matching passage: Sigma rule: Detects Obfuscated use of stdin to execute PowerShell. Logsource: windows / ps_module. Rule: title: Invoke-Obfuscation STDIN+ Launcher - PowerShell Module id: 9ac8b09b-45de-4a07-9da1-0de8c09304a3 related: - id: 779c8c12-0eb1-11eb-adc1-0242ac120002 type: derived status: test description: Detects Obfuscated use of stdin to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-15 modified: 2024-04-05 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_4103: Payload|re: cmd.{0,5}(?:/c|/r).+powershell.+(?:\$\{?input\}?|noexit).+" condition: selection_4103 falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the use of SysmonEnte, a tool to attack the integrity of Sysmon. Logsource: windows / process_access. Rule: title: HackTool - SysmonEnte Execution id: d29ada0f-af45-4f27-8f32-f7b77c3dbc4e status: test description: Detects the use of SysmonEnte, a tool to attack the integrity of Sysmon references: - https://codewhitesec.blogspot.com/2022/09/attacks-on-sysmon-revisited-sysmonente.html - https://github.com/codewhitesec/SysmonEnte/ - https://github.com/codewhitesec/SysmonEnte/blob/fe267690fcc799fbda15398243615a30451d9099/screens/1.png author: Florian Roth (Nextron Systems) date: 2022-09-07 modified: 2026-06-29 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: process_access product: windows detection: selection_sysmon: TargetImage|contains: - :\Windows\Sysmon.exe - :\Windows\Sysmon64.exe - :\Windows\Sysmon64a.exe GrantedAccess: '0x1400' selection_calltrace: CallTrace: Ente filter_main_generic: SourceImage|contains: - :\Program Files (x86)\ - :\Program Files\ - :\Windows\System32\ - :\Windows\SysWOW64\ filter_main_msdefender: SourceImage|contains: :\ProgramData\Microsoft\Windows Defender\Platform\ SourceImage|endswith: \MsMpEng.exe condition: ( selection_sysmon and not 1 of filter_main_* ) or selection_calltrace falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-4392
Matching passage: CVE-2015-4392. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Display Suite module 7.x-2.7 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to field display settings.
Near-miss passage: CVE-2015-2768. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Websense TRITON AP-EMAIL before 8.0.0 and V-Series 7.7 appliances allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the use of Replace.exe which can be used to replace file with another file. Logsource: windows / process_creation. Rule: title: Replace.exe Usage id: 9292293b-8496-4715-9db6-37028dcda4b3 status: test description: Detects the use of Replace.exe which can be used to replace file with another file references: - https://lolbas-project.github.io/lolbas/Binaries/Replace/ - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/replace author: frack113 date: 2022-03-06 modified: 2024-03-13 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection: Image|endswith: \replace.exe argument: CommandLine|contains|windash: -a condition: selection and argument falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of ruby using the "-e" flag. This is could be used as a way to launch a reverse shell or execute live. Logsource: windows / process_creation. Rule: title: Ruby Inline Command Execution id: 20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8 status: test description: Detects execution of ruby using the "-e" flag. This is could be used as a way to launch a reverse shell or execute live ruby code. references: - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet - https://www.revshells.com/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-02 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \ruby.exe - OriginalFileName: ruby.exe selection_cli: CommandLine|contains: ' -e' condition: all of selection_* falsepositives: - Unknown level: medium
Query: Suspicious Group Policy Discovery execution detected on endpoint
Matching passage: T1615 Group Policy Discovery. Tactics: discovery. Description: Adversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and to discover patterns in domain objects that can be manipulated or used to blend in the environment. Group Policy allows for centralized management of user and computer settings in Active Directory (AD). Group policy objects (GPOs) are containers for group policy settings made up of files stored within a predictable network path `\<DOMAIN>\SYSVOL\<DOMAIN>\Policies\`.(Citation: TechNet Group Policy Basics)(Citation: ADSecurity GPO Persistence 2016) Adversaries may use commands such as <code>gpresult</code> or various publicly available PowerShell functions, such as <code>Get-DomainGPO</code> and <code>Get-DomainGPOLocalGroup</code>, to gather information on Group Policy settings.(Citation: Microsoft gpresult)(Citation: Github PowerShell Empire) Adversaries may use this information to shape follow-on behaviors, including determining potential attack paths within the target network as well as opportunities to manipulate Group Policy settings (i.e. [Domain or Tenant Policy Modification](https://attack.mitre.org/techniques/T1484)) for their benefit.
Near-miss passage: T1518 Software Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment. Adversaries may use the information from [Software Discovery](https://attack.mitre.org/techniques/T1518) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Such software may be deployed widely across the environment for configuration management or security reasons, such as [Software Deployment Tools](https://attack.mitre.org/techniques/T1072), and may allow adversaries broad access to infect devices or move laterally. Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable to [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068).
Query: rule covering Detects network connections to Devtunnels domains initiated by a process on a system. Attackers can abuse that feature t
Matching passage: Sigma rule: Detects network connections to Devtunnels domains initiated by a process on a system. Attackers can abuse that feature t. Logsource: windows / network_connection. Rule: title: Network Connection Initiated To DevTunnels Domain id: 9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4 related: - id: 4b657234-038e-4ad5-997c-4be42340bce4 type: similar - id: b3e6418f-7c7a-4fad-993a-93b65027a9f1 type: similar - id: 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b type: similar status: test description: 'Detects network connections to Devtunnels domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine. ' references: - https://blueteamops.medium.com/detecting-dev-tunnels-16f0994dc3e2 - https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security - https://cydefops.com/devtunnels-unleashed author: Kamran Saifullah date: 2023-11-20 tags: - attack.exfiltration - attack.command-and-control - attack.t1567.001 - attack.t1572 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' DestinationHostname|endswith: .devtunnels.ms condition: selection falsepositives: - Legitimate use of Devtunnels will also trigger this. level: medium
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via Stdin in Scripts. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation Via Stdin - Powershell id: 86b896ba-ffa1-4fea-83e3-ee28a4c915c7 status: test description: Detects Obfuscated Powershell via Stdin in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2020-10-12 modified: 2024-04-05 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_4104: ScriptBlockText|re: (?i)(set).*&&\s?set.*(environment|invoke|\$\{?input).*&&.*" condition: selection_4104 falsepositives: - Unknown level: high
Query: describe CVE-2015-8974
Matching passage: CVE-2015-8974. CWE: CWE-89. CVSS: 10.0. SQL injection vulnerability in the Group Promotions module in the admin control panel in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-9454. CWE: CWE-89. CVSS: 8.800000190734863. The smooth-slider plugin before 2.7 for WordPress has SQL Injection via the wp-admin/admin.php?page=smooth-slider-admin current_slider_id parameter.
Query: exploit The php_handler function in sapi/apache2handler/sapi_apache2.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, when the Apache HTTP Server 2.4.x is used, allows 
Matching passage: CVE-2015-3330. CWE: CWE-20. CVSS: 6.800000190734863. The php_handler function in sapi/apache2handler/sapi_apache2.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, when the Apache HTTP Server 2.4.x is used, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via pipelined HTTP requests that result in a "deconfigured interpreter."
Near-miss passage: CVE-2015-5234. CWE: CWE-20. CVSS: 6.800000190734863. IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks.
Query: rule covering An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, Amm
Matching passage: Sigma rule: An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, Amm. Logsource: windows / process_creation. Rule: title: Remote Access Tool - LogMeIn Execution id: d85873ef-a0f8-4c48-a53a-6b621f11729d status: test description: 'An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-3---logmein-files-detected-test-on-windows author: frack113 date: 2022-02-11 modified: 2023-03-05 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: windows detection: selection: - Description: LMIGuardianSvc - Product: LMIGuardianSvc - Company: LogMeIn, Inc. condition: selection falsepositives: - Legitimate use level: medium
Near-miss passage: Sigma rule: Windows Defender logs when the history of detected infections is deleted.. Logsource: windows / windefend. Rule: title: Windows Defender Malware Detection History Deletion id: 2afe6582-e149-11ea-87d0-0242ac130003 status: test description: Windows Defender logs when the history of detected infections is deleted. references: - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus - https://web.archive.org/web/20160727113019/https://answers.microsoft.com/en-us/protect/forum/mse-protect_scanning/microsoft-antimalware-has-removed-history-of/f15af6c9-01a9-4065-8c6c-3f2bdc7de45e author: Cian Heasley date: 2020-08-13 modified: 2023-11-24 tags: - attack.defense-impairment logsource: product: windows service: windefend detection: selection: EventID: 1013 condition: selection falsepositives: - Deletion of Defender malware detections history for legitimate reasons level: informational
Query: ATT&CK technique for Chat Messages
Matching passage: T1552.008 Chat Messages. Tactics: credential access. Description: Adversaries may directly collect unsecured credentials stored or passed through user communication services. Credentials may be sent and stored in user chat communication applications such as email, chat services like Slack or Teams, collaboration tools like Jira or Trello, and any other services that support user communication. Users may share various forms of credentials (such as usernames and passwords, API keys, or authentication tokens) on private or public corporate internal communications channels. Rather than accessing the stored chat logs (i.e., [Credentials In Files](https://attack.mitre.org/techniques/T1552/001)), adversaries may directly access credentials within these services on the user endpoint, through servers hosting the services, or through administrator portals for cloud hosted services. Adversaries may also compromise integration tools like Slack Workflows to automatically search through messages to extract user credentials. These credentials may then be abused to perform follow-on activities such as lateral movement or privilege escalation (Citation: Slack Security Risks).
Near-miss passage: T1552.006 Group Policy Preferences. Tactics: credential access. Description: Adversaries may attempt to find unsecured credentials in Group Policy Preferences (GPP). GPP are tools that allow administrators to create domain policies with embedded credentials. These policies allow administrators to set local accounts.(Citation: Microsoft GPP 2016) These group policies are stored in SYSVOL on a domain controller. This means that any domain user can view the SYSVOL share and decrypt the password (using the AES key that has been made public).(Citation: Microsoft GPP Key) The following tools and scripts can be used to gather and decrypt the password file from Group Policy Preference XML files: * Metasploit’s post exploitation module: <code>post/windows/gather/credentials/gpp</code> * Get-GPPPassword(Citation: Obscuresecurity Get-GPPPassword) * gpprefdecrypt.py On the SYSVOL share, adversaries may use the following command to enumerate potential GPP XML files: <code>dir /s * .xml</code>
Query: ATT&CK technique for Create Cloud Instance
Matching passage: T1578.002 Create Cloud Instance. Tactics: defense impairment. Description: An adversary may create a new instance or virtual machine (VM) within the compute service of a cloud account to evade defenses. Creating a new instance may allow an adversary to bypass firewall rules and permissions that exist on instances currently residing within an account. An adversary may [Create Snapshot](https://attack.mitre.org/techniques/T1578/001) of one or more volumes in an account, create a new instance, mount the snapshots, and then apply a less restrictive security policy to collect [Data from Local System](https://attack.mitre.org/techniques/T1005) or for [Remote Data Staging](https://attack.mitre.org/techniques/T1074/002).(Citation: Mandiant M-Trends 2020) Creating a new instance may also allow an adversary to carry out malicious activity within an environment without affecting the execution of current running instances.
Near-miss passage: T1578.003 Delete Cloud Instance. Tactics: defense impairment. Description: An adversary may delete a cloud instance after they have performed malicious activities in an attempt to evade detection and remove evidence of their presence. Deleting an instance or virtual machine can remove valuable forensic artifacts and other evidence of suspicious behavior if the instance is not recoverable. An adversary may also [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002) and later terminate the instance after achieving their objectives.(Citation: Mandiant M-Trends 2020)
Query: secure coding against Inappropriate Whitespace Style
Matching passage: CWE-1114 Inappropriate Whitespace Style. The source code contains whitespace that is inconsistent across the code or does not follow expected standards for the product.
Near-miss passage: CWE-382 J2EE Bad Practices: Use of System.exit(). A J2EE application uses System.exit(), which also shuts down its container.
Query: CWE for PHP External Variable Modification
Matching passage: CWE-473 PHP External Variable Modification. A PHP application does not properly protect against the modification of variables from external sources, such as query parameters or cookies. This can expose the application to numerous weaknesses that would not exist otherwise.
Near-miss passage: CWE-1310 Missing Ability to Patch ROM Code. Missing an ability to patch ROM code may leave a System or System-on-Chip (SoC) in a vulnerable state.
Query: secure coding against Improper Handling of Single Event Upsets
Matching passage: CWE-1261 Improper Handling of Single Event Upsets. The hardware logic does not effectively handle when single-event upsets (SEUs) occur.
Near-miss passage: CWE-1292 Incorrect Conversion of Security Identifiers. The product implements a conversion mechanism to map certain bus-transaction signals to security identifiers. However, if the conversion is incorrectly implemented, untrusted agents can gain unauthorized access to the asset.
Query: patch priority for CVE-2015-0660
Matching passage: CVE-2015-0660. CWE: CWE-284. CVSS: 7.199999809265137. Cisco Virtual TelePresence Server Software does not properly restrict use of the serial port, which allows local users to execute arbitrary OS commands as root by leveraging vSphere controller administrative privileges, aka Bug ID CSCus61123.
Near-miss passage: CVE-2015-1464. CWE: CWE-284. CVSS: 6.400000095367432. RT (aka Request Tracker) before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to hijack sessions via an RSS feed URL.
Query: detect Detects deletion of the RunMRU registry key, which stores the history of commands executed via the Run dialog. In the cl in logs
Matching passage: Sigma rule: Detects deletion of the RunMRU registry key, which stores the history of commands executed via the Run dialog. In the cl. Logsource: windows / process_creation. Rule: title: RunMRU Registry Key Deletion id: c11aecef-9c37-45a6-9c07-bc0782f963fd related: - id: 3a9b8c1e-5b2e-4f7a-9d1c-2a7f3b6e1c55 type: similar status: experimental description: 'Detects deletion of the RunMRU registry key, which stores the history of commands executed via the Run dialog. In the clickfix techniques, the phishing lures instruct users to open a run dialog through (Win + R) and execute malicious commands. Adversaries may delete this key to cover their tracks after executing commands. ' references: - https://www.zscaler.com/blogs/security-research/coldriver-updates-arsenal-baitswitch-and-simplefix author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-09-25 tags: - attack.stealth - attack.t1070.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_cli: CommandLine|contains|all: - ' del' - \Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects execution of the Windows Kernel Debugger "kd.exe".. Logsource: windows / process_creation. Rule: title: Windows Kernel Debugger Execution id: 27ee9438-90dc-4bef-904b-d3ef927f5e7e status: test description: Detects execution of the Windows Kernel Debugger "kd.exe". references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-15 modified: 2024-04-24 tags: - attack.privilege-escalation - attack.stealth logsource: category: process_creation product: windows detection: selection: - Image|endswith: \kd.exe - OriginalFileName: kd.exe condition: selection falsepositives: - Rare occasions of legitimate cases where kernel debugging is necessary in production. Investigation is required level: medium
Query: write Sigma for Detects when an app is assigned Azure AD roles, such as global administrator, or Azure RBAC roles, such as subscription
Matching passage: Sigma rule: Detects when an app is assigned Azure AD roles, such as global administrator, or Azure RBAC roles, such as subscription. Logsource: azure / auditlogs. Rule: title: App Assigned To Azure RBAC/Microsoft Entra Role id: b04934b2-0a68-4845-8a19-bdfed3a68a7a status: test description: Detects when an app is assigned Azure AD roles, such as global administrator, or Azure RBAC roles, such as subscription owner. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#service-principal-assigned-to-a-role author: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow' date: 2022-07-19 modified: 2024-11-04 tags: - attack.persistence - attack.privilege-escalation - attack.t1098.003 logsource: product: azure service: auditlogs detection: selection: targetResources.type: Service Principal properties.message: - Add member to role - Add eligible member to role - Add scoped member to role condition: selection falsepositives: - When the permission is legitimately needed for the app level: medium
Near-miss passage: Sigma rule: Detects loading of dbgcore.dll or dbghelp.dll from uncommon locations such as user directories. These DLLs contain the M. Logsource: windows / image_load. Rule: title: Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location id: 416bc4a2-7217-4519-8dc7-c3271817f1d5 related: - id: 9f5c1d59-33be-4e60-bcab-85d2f566effd type: similar status: experimental description: 'Detects loading of dbgcore.dll or dbghelp.dll from uncommon locations such as user directories. These DLLs contain the MiniDumpWriteDump function, which can be abused for credential dumping purposes or in some cases for evading EDR/AV detection by suspending processes. ' references: - https://blog.axelarator.net/hunting-for-edr-freeze/ - https://www.zerosalarium.com/2025/09/EDR-Freeze-Puts-EDRs-Antivirus-Into-Coma.html - https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-27 modified: 2026-01-09 tags: - attack.credential-access - attack.defense-impairment - attack.t1003 - attack.t1685 logsource: category: image_load product: windows detection: selection_img: Image|contains: - :\Perflogs\ - :\Temp\ - :\Users\Public\ - \$Recycle.Bin\ - \Contacts\ - \Documents\ - \Favorites\ - \Favourites\ - \inetpub\wwwroot\ - \Music\ - \Pictures\ - \Start Menu\Programs\Startup\ - \Users\Default\ - \Videos\ selection_dll: ImageLoaded|endswith: - \dbgcore.dll - \dbghelp.dll condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/image_load/image_load_win_susp_dbgcore_dbghelp_load/info.yml