alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Detects use of an encoded/obfuscated version of an IP address (hex, octal...) in an URL combined with a download command
Matching passage: Sigma rule: Detects use of an encoded/obfuscated version of an IP address (hex, octal...) in an URL combined with a download command. Logsource: windows / process_creation. Rule: title: Obfuscated IP Download Activity id: cb5a2333-56cf-4562-8fcb-22ba1bca728d status: test description: Detects use of an encoded/obfuscated version of an IP address (hex, octal...) in an URL combined with a download command references: - https://h.43z.one/ipconverter/ - https://twitter.com/Yasser_Elsnbary/status/1553804135354564608 - https://twitter.com/fr0s7_/status/1712780207105404948 author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems) date: 2022-08-03 modified: 2026-03-16 tags: - attack.discovery logsource: category: process_creation product: windows detection: selection_command: CommandLine|contains: - Invoke-WebRequest - 'iwr ' - Invoke-RestMethod - 'irm ' - 'wget ' - 'curl ' - DownloadFile - DownloadString selection_ip_1: CommandLine|contains: - ' 0x' - //0x - .0x - .00x selection_ip_2: CommandLine|contains|all: - http://% - '%2e' selection_ip_3: - CommandLine|re: https?://[0-9]{1,3}\.[0-9]{1,3}\.0[0-9]{3,4} - CommandLine|re: https?://[0-9]{1,3}\.0[0-9]{3,7} - CommandLine|re: https?://0[0-9]{3,11} - CommandLine|re: https?://(?:0[0-9]{1,11}\.){3}0[0-9]{1,11} - CommandLine|re: https?://0[0-9]{1,11} - CommandLine|re: ' [0-7]{7,13}' filter_main_valid_ip: CommandLine|re: https?://(?:(?:25[0-5]|(?:2[0-4]|1\d|[1-9])?\d)(?:\.|\b)){4} condition: selection_command and 1 of selection_ip_* and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via use Rundll32 in Scripts. Logsource: windows / security. Rule: title: Invoke-Obfuscation Via Use Rundll32 - Security id: cd0f7229-d16f-42de-8fe3-fba365fbcb3a related: - id: 641a4bfb-c017-44f7-800c-2aee0184ce9b type: derived status: test description: Detects Obfuscated Powershell via use Rundll32 in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2020-10-09 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows service: security definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697 detection: selection: EventID: 4697 ServiceFileName|contains|all: - '&&' - rundll32 - shell32.dll - shellexec_rundll ServiceFileName|contains: - value - invoke - comspec - iex condition: selection falsepositives: - Unknown level: high
Query: describe CVE-2015-8658
Matching passage: CVE-2015-8658. CWE: CWE-787. CVSS: 8.800000190734863. Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (uninitialized pointer dereference and memory corruption) via crafted MPEG-4 data, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, CVE-2015-8451, CVE-2015-8455, CVE-2015-8652, CVE-2015-8654, CVE-2015-8656, CVE-2015-8657, and CVE-2015-8820.
Near-miss passage: CVE-2015-0569. CWE: CWE-787. CVSS: 7.800000190734863. Heap-based buffer overflow in the private wireless extensions IOCTL implementation in wlan_hdd_wext.c in the WLAN (aka Wi-Fi) driver for the Linux kernel 3.x and 4.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges via a crafted application that establishes a packet filter.
Query: Sigma rule for When IIS uses an old .Net Framework it's possible to enumerate folders with the symbol "~"
Matching passage: Sigma rule: When IIS uses an old .Net Framework it's possible to enumerate folders with the symbol "~". Logsource: webserver. Rule: title: Successful IIS Shortname Fuzzing Scan id: 7cb02516-6d95-4ffc-8eee-162075e111ac status: test description: When IIS uses an old .Net Framework it's possible to enumerate folders with the symbol "~" references: - https://github.com/projectdiscovery/nuclei-templates/blob/9d2889356eebba661c8407038e430759dfd4ec31/fuzzing/iis-shortname.yaml - https://www.exploit-db.com/exploits/19525 - https://github.com/lijiejie/IIS_shortname_Scanner author: frack113 date: 2021-10-06 modified: 2023-01-02 tags: - attack.initial-access - attack.t1190 logsource: category: webserver detection: selection: cs-uri-query|contains: ~1 cs-uri-query|endswith: a.aspx cs-method: - GET - OPTIONS sc-status: - 200 - 301 condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the execution of TruffleHog, a popular open-source tool used for scanning repositories for secrets and sensitive. Logsource: aws / cloudtrail. Rule: title: PUA - AWS TruffleHog Execution id: a840e606-7c8c-4684-9bc1-eb6b6155127f status: experimental description: 'Detects the execution of TruffleHog, a popular open-source tool used for scanning repositories for secrets and sensitive information, within an AWS environment. It has been reported to be used by threat actors for credential harvesting. All detections should be investigated to determine if the usage is authorized by security teams or potentially malicious. ' references: - https://github.com/trufflesecurity/trufflehog - https://www.rapid7.com/blog/post/tr-crimson-collective-a-new-threat-group-observed-operating-in-the-cloud/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-10-21 tags: - attack.credential-access - attack.t1555 - attack.t1003 logsource: product: aws service: cloudtrail detection: selection: userAgent: TruffleHog condition: selection falsepositives: - Legitimate use of TruffleHog by security teams for credential scanning. level: medium
Query: vulnerability: Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous befo
Matching passage: CVE-2015-4449. CWE: CWE-200. CVSS: 5.0. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2014-8450, CVE-2015-4450, CVE-2015-5088, CVE-2015-5089, and CVE-2015-5092.
Near-miss passage: CVE-2015-5878. CWE: CWE-200. CVSS: 2.0999999046325684. Notes in Apple OS X before 10.11 misparses links, which allows local users to obtain sensitive information via unspecified vectors.
Query: vulnerability: Citrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 does not properly restrict access to the Advent Java Management Extensions (JMX) Servlet, which allows remote 
Matching passage: CVE-2015-2683. CWE: CWE-264. CVSS: 7.5. Citrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 does not properly restrict access to the Advent Java Management Extensions (JMX) Servlet, which allows remote attackers to execute arbitrary code via unspecified vectors to servlets/Jmx_dynamic.
Near-miss passage: CVE-2015-1885. CWE: CWE-264. CVSS: 9.300000190734863. WebSphereOauth20SP.ear in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, 8.5 Liberty Profile before 8.5.5.5, and 8.5 Full Profile before 8.5.5.6, when the OAuth grant type requires sending a password, allows remote attackers to gain privileges via unspecified vectors.
Query: vulnerability: The web management interface of Ubiquiti airMAX, airFiber, airGateway and EdgeSwitch XP (formerly TOUGHSwitch) allows an unauthenticated attacker to upload and write arbitrary file
Matching passage: CVE-2015-9266. CWE: CWE-22. CVSS: 9.800000190734863. The web management interface of Ubiquiti airMAX, airFiber, airGateway and EdgeSwitch XP (formerly TOUGHSwitch) allows an unauthenticated attacker to upload and write arbitrary files using directory traversal techniques. An attacker can exploit this vulnerability to gain root privileges. This vulnerability is fixed in the following product versions (fixes released in July 2015, all prior versions are affected): airMAX AC 7.1.3; airMAX M (and airRouter) 5.6.2 XM/XW/TI, 5.5.11 XM/TI, and 5.5.10u2 XW; airGateway 1.1.5; airFiber AF24/AF24HD 2.2.1, AF5x 3.0.2.1, and AF5 2.2.1; airOS 4 XS2/XS5 4.0.4; and EdgeSwitch XP (formerly TOUGHSwitch) 1.3.2.
Near-miss passage: CVE-2015-3301. CWE: CWE-22. CVSS: 4.0. Directory traversal vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote administrators to read arbitrary files via a .. (dot dot) in the tcp_box_path parameter in the checkout_editor_settings page to wp-admin/admin.php.
Query: risk of SearchBlox 8.3 before 8.3.1 allows remote attackers to write to the config file, and consequently cause a denial of service (application crash), via unspecified vectors.
Matching passage: CVE-2015-7919. CWE: CWE-264. CVSS: 10.0. SearchBlox 8.3 before 8.3.1 allows remote attackers to write to the config file, and consequently cause a denial of service (application crash), via unspecified vectors.
Near-miss passage: CVE-2015-1489. CWE: CWE-264. CVSS: 8.5. The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP1 allows remote authenticated users to gain privileges via unspecified vectors.
Query: common weakness: Large Data Table with Excessive Number of Indices
Matching passage: CWE-1089 Large Data Table with Excessive Number of Indices. The product uses a large data table that contains an excessively large number of indices.
Near-miss passage: CWE-110 Struts: Validator Without Form Field. Validation fields that do not appear in forms they are associated with indicate that the validation logic is out of date.
Query: detect Detects potential DLL sideloading of Python DLL files. in logs
Matching passage: Sigma rule: Detects potential DLL sideloading of Python DLL files.. Logsource: windows / image_load. Rule: title: Potential Python DLL SideLoading id: d36f7c12-14a3-4d48-b6b8-774b9c66f44d status: test description: Detects potential DLL sideloading of Python DLL files. references: - https://www.securonix.com/blog/seolurker-attack-campaign-uses-seo-poisoning-fake-google-ads-to-install-malware/ - https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware/ - https://github.com/wietze/HijackLibs/tree/dc9c9f2f94e6872051dab58fbafb043fdd8b4176/yml/3rd_party/python author: Swachchhanda Shrawan Poudel date: 2024-10-06 modified: 2025-08-18 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: - \python39.dll - \python310.dll - \python311.dll - \python312.dll filter_main_default_install_paths: - ImageLoaded|startswith: - C:\Program Files\Python3 - C:\Program Files (x86)\Python3 - ImageLoaded|contains: \AppData\Local\Programs\Python\Python3 filter_optional_visual_studio: ImageLoaded|startswith: C:\Program Files\Microsoft Visual Studio\ filter_optional_anaconda: ImageLoaded|startswith: C:\ProgramData\Anaconda3\ filter_optional_cpython: ImageLoaded|contains: - \cpython\externals\ - \cpython\PCbuild\ filter_optional_pyinstaller: ImageLoaded|startswith: C:\Users ImageLoaded|contains: \AppData\Local\Temp\_MEI filter_main_legit_signature_details: Product: Python Signed: 'true' Description: Python Company: Python Software Foundation condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate software using Python DLLs level: medium
Near-miss passage: Sigma rule: Detects instances where an OpenCanary node has been targeted by a NMAP NULL Scan. Logsource: opencanary / application. Rule: title: OpenCanary - NMAP NULL Scan id: 68b8547b-107f-43f3-97fb-900a7d63c190 status: experimental description: Detects instances where an OpenCanary node has been targeted by a NMAP NULL Scan references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Marco Pedrinazzi (@pedrinazziM) date: 2026-01-06 tags: - attack.discovery - attack.t1046 logsource: category: application product: opencanary detection: selection: logtype: 5003 condition: selection falsepositives: - Unlikely level: high
Query: CVE similar to CVE-2015-7016
Matching passage: CVE-2015-7016. CWE: CWE-264. CVSS: 7.599999904632568. The MCX Application Restrictions component in Apple OS X before 10.11.1, when Managed Configuration is enabled, mishandles provisioning profiles, which allows attackers to bypass intended entitlement restrictions and gain privileges via a crafted developer-signed app.
Near-miss passage: CVE-2015-2363. CWE: CWE-264. CVSS: 7.199999809265137. win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012, and Windows RT allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
Query: alert when Detects attempts to disable the Windows Firewall using PowerShell
Matching passage: Sigma rule: Detects attempts to disable the Windows Firewall using PowerShell. Logsource: windows / process_creation. Rule: title: Windows Firewall Disabled via PowerShell id: 12f6b752-042d-483e-bf9c-915a6d06ad75 related: - id: 488b44e7-3781-4a71-888d-c95abfacf44d type: similar status: test description: Detects attempts to disable the Windows Firewall using PowerShell references: - https://www.elastic.co/guide/en/security/current/windows-firewall-disabled-via-powershell.html author: Tim Rauch, Elastic (idea) date: 2022-09-14 modified: 2023-02-13 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_name: - Image|endswith: - \powershell.exe - \pwsh.exe - \powershell_ise.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_args: CommandLine|contains|all: - 'Set-NetFirewallProfile ' - ' -Enabled ' - ' False' selection_opt: CommandLine|contains: - ' -All ' - Public - Domain - Private condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects tools such as UACMe used to bypass UAC with computerdefaults.exe (UACMe 59). Logsource: windows / process_creation. Rule: title: UAC Bypass Tools Using ComputerDefaults id: 3c05e90d-7eba-4324-9972-5d7f711a60a8 status: test description: Detects tools such as UACMe used to bypass UAC with computerdefaults.exe (UACMe 59) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-31 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: IntegrityLevel: - High - System - S-1-16-16384 - S-1-16-12288 Image: C:\Windows\System32\ComputerDefaults.exe filter: ParentImage|contains: - :\Windows\System32 - :\Program Files condition: selection and not filter falsepositives: - Unknown level: high
Query: common weakness: Inappropriate Encoding for Output Context
Matching passage: CWE-838 Inappropriate Encoding for Output Context. The product uses or specifies an encoding when generating output to a downstream component, but the specified encoding is not the same as the encoding that is expected by the downstream component.
Near-miss passage: CWE-1066 Missing Serialization Control Element. The product contains a serializable data element that does not have an associated serialization method.
Query: exploit Stack-based buffer overflow in the Ipropsapi.ipropsapiCtrl.1 ActiveX control in ipropsapivideo in Panasonic Security API (PS-API) ActiveX SDK before 8.10.18 allows remote attackers
Matching passage: CVE-2015-4648. CWE: CWE-20. CVSS: 7.5. Stack-based buffer overflow in the Ipropsapi.ipropsapiCtrl.1 ActiveX control in ipropsapivideo in Panasonic Security API (PS-API) ActiveX SDK before 8.10.18 allows remote attackers to execute arbitrary code via a long string to the MulticastAddr method.
Near-miss passage: CVE-2015-6112. CWE: CWE-20. CVSS: 5.800000190734863. SChannel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 lacks the required extended master-secret binding support to ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation, which allows man-in-the-middle attackers to obtain sensitive information or modify TLS session data via a "triple handshake attack," aka "Schannel TLS Triple Handshake Vulnerability."
Query: Multiple failed authentications followed by Messaging Applications
Matching passage: T1213.005 Messaging Applications. Tactics: collection. Description: Adversaries may leverage chat and messaging applications, such as Microsoft Teams, Google Chat, and Slack, to mine valuable information. The following is a brief list of example information that may hold potential value to an adversary and may also be found on messaging applications: * Testing / development credentials (i.e., [Chat Messages](https://attack.mitre.org/techniques/T1552/008)) * Source code snippets * Links to network shares and other internal resources * Proprietary data(Citation: Guardian Grand Theft Auto Leak 2022) * Discussions about ongoing incident response efforts(Citation: SC Magazine Ragnar Locker 2021)(Citation: Microsoft DEV-0537) In addition to exfiltrating data from messaging applications, adversaries may leverage data from chat messages in order to improve their targeting - for example, by learning more about an environment or evading ongoing incident response efforts.(Citation: Sentinel Labs NullBulge 2024)(Citation: Permiso Scattered Spider 2023)
Near-miss passage: T1213.004 Customer Relationship Management Software. Tactics: collection. Description: Adversaries may leverage Customer Relationship Management (CRM) software to mine valuable information. CRM software is used to assist organizations in tracking and managing customer interactions, as well as storing customer data. Once adversaries gain access to a victim organization, they may mine CRM software for customer data. This may include personally identifiable information (PII) such as full names, emails, phone numbers, and addresses, as well as additional details such as purchase histories and IT support interactions. By collecting this data, an adversary may be able to send personalized [Phishing](https://attack.mitre.org/techniques/T1566) emails, engage in SIM swapping, or otherwise target the organization’s customers in ways that enable financial gain or the compromise of additional organizations.(Citation: Bleeping Computer US Cellular Hack 2022)(Citation: Bleeping Computer Mint Mobile Hack 2021)(Citation: Bleeping Computer Bank Hack 2020) CRM software may be hosted on-premises or in the cloud. Information stored in these solutions may vary based on the specific instance or environment. Examples of CRM software include Microsoft Dynamics 365, Salesforce, Zoho, Zendesk, and HubSpot.
Query: Sigma YAML for windows / ps_script
Matching passage: Sigma rule: Detects Exfiltration Over Alternative Protocol - ICMP. Adversaries may steal data by exfiltrating it over an un-encrypte. Logsource: windows / ps_script. Rule: title: PowerShell ICMP Exfiltration id: 4c4af3cd-2115-479c-8193-6b8bfce9001c status: test description: Detects Exfiltration Over Alternative Protocol - ICMP. Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1048.003/T1048.003.md#atomic-test-2---exfiltration-over-alternative-protocol---icmp author: Bartlomiej Czyz @bczyz1, oscd.community date: 2020-10-10 modified: 2022-12-25 tags: - attack.exfiltration - attack.t1048.003 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - New-Object - System.Net.NetworkInformation.Ping - .Send( condition: selection falsepositives: - Legitimate usage of System.Net.NetworkInformation.Ping class level: medium
Near-miss passage: Sigma rule: Detects possible NTLM coercion via certutil using the 'syncwithWU' flag. Logsource: windows / process_creation. Rule: title: Potential NTLM Coercion Via Certutil.EXE id: 6c6d9280-e6d0-4b9d-80ac-254701b64916 status: test description: Detects possible NTLM coercion via certutil using the 'syncwithWU' flag references: - https://github.com/LOLBAS-Project/LOLBAS/issues/243 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-01 modified: 2023-02-14 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \certutil.exe - OriginalFileName: CertUtil.exe selection_cli: CommandLine|contains|all: - ' -syncwithWU ' - ' \\\\' condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_ntlm_coercion/info.yml
Query: explain CWE-671
Matching passage: CWE-671 Lack of Administrator Control over Security. The product uses security features in a way that prevents the product's administrator from tailoring security settings to reflect the environment in which the product is being used. This introduces resultant weaknesses or prevents it from operating at a level of security that is desired by the administrator.
Near-miss passage: CWE-213 Exposure of Sensitive Information Due to Incompatible Policies. The product's intended functionality exposes information to certain actors in accordance with the developer's security policy, but this information is regarded as sensitive according to the intended security policies of other stakeholders such as the product's administrator, users, or others whose information is being processed.
Query: risk of Cross-site scripting (XSS) vulnerability in the Slider Revolution (revslider) plugin 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the clie
Matching passage: CVE-2015-5151. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Slider Revolution (revslider) plugin 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the client_action parameter in a revslider_ajax_action action to wp-admin/admin-ajax.php.
Near-miss passage: CVE-2015-10117. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability, which was classified as problematic, was found in Gravity Forms DPS PxPay Plugin up to 1.4.2 on WordPress. Affected is an unknown function. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.4.3 is able to address this issue. The name of the patch is 5966a5e6343e3d5610bdfa126a5cfbae95e629b6. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230664.