alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Detects when the Console Window Host (conhost.exe) process is spawned by an uncommon parent process, which could be indi
Matching passage: Sigma rule: Detects when the Console Window Host (conhost.exe) process is spawned by an uncommon parent process, which could be indi. Logsource: windows / process_creation. Rule: title: Conhost Spawned By Uncommon Parent Process id: cbb9e3d1-2386-4e59-912e-62f1484f7a89 status: test description: Detects when the Console Window Host (conhost.exe) process is spawned by an uncommon parent process, which could be indicative of potential code injection activity. references: - https://www.elastic.co/guide/en/security/current/conhost-spawned-by-suspicious-parent-process.html author: Tim Rauch, Elastic (idea) date: 2022-09-28 modified: 2025-03-06 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection: Image|endswith: \conhost.exe ParentImage|endswith: - \explorer.exe - \lsass.exe - \regsvr32.exe - \rundll32.exe - \services.exe - \smss.exe - \spoolsv.exe - \svchost.exe - \userinit.exe - \wininit.exe - \winlogon.exe filter_main_svchost: ParentCommandLine|contains: - -k apphost -s AppHostSvc - -k imgsvc - -k localService -p -s RemoteRegistry - -k LocalSystemNetworkRestricted -p -s NgcSvc - -k NetSvcs -p -s NcaSvc - -k netsvcs -p -s NetSetupSvc - -k netsvcs -p -s wlidsvc - -k NetworkService -p -s DoSvc - -k wsappx -p -s AppXSvc - -k wsappx -p -s ClipSVC - -k wusvcs -p -s WaaSMedicSvc filter_optional_dropbox: ParentCommandLine|contains: - C:\Program Files (x86)\Dropbox\Client\ - C:\Program Files\Dropbox\Client\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects installation or execution of services. Logsource: windows / system. Rule: title: HackTool Service Registration or Execution id: d26ce60c-2151-403c-9a42-49420d87b5e4 status: test description: Detects installation or execution of services references: - Internal Research author: Florian Roth (Nextron Systems) date: 2022-03-21 modified: 2023-08-07 tags: - attack.execution - attack.t1569.002 - attack.s0029 logsource: product: windows service: system detection: selection_eid: Provider_Name: Service Control Manager EventID: - 7045 - 7036 selection_service_name: ServiceName|contains: - cachedump - DumpSvc - gsecdump - pwdump - UACBypassedService - WCE SERVICE - WCESERVICE - winexesvc selection_service_image: ImagePath|contains: bypass condition: selection_eid and 1 of selection_service_* falsepositives: - Unknown level: high
Query: risk of Huawei Mobile WiFi E5151 routers with software before E5151s-2TCPU-V200R001B146D27SP00C00 and E5186 routers with software before V200R001B310D01SP00C00 allow DNS query packets usin
Matching passage: CVE-2015-8265. CWE: CWE-20. CVSS: 7.5. Huawei Mobile WiFi E5151 routers with software before E5151s-2TCPU-V200R001B146D27SP00C00 and E5186 routers with software before V200R001B310D01SP00C00 allow DNS query packets using the static source port, which makes it easier for remote attackers to spoof responses via unspecified vectors.
Near-miss passage: CVE-2015-9147. CWE: CWE-20. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9625, MDM9635M, SD 400, and SD 800, userspace-provided pointer arguments are not validated.
Query: describe CVE-2015-0977
Matching passage: CVE-2015-0977. CWE: CWE-78. CVSS: 10.0. Network Vision IntraVue before 2.3.0a14 on Windows allows remote attackers to execute arbitrary OS commands via unspecified vectors.
Near-miss passage: CVE-2015-6008. CWE: CWE-78. CVSS: 7.5. install.php in Web Reference Database (aka refbase) through 0.9.6 allows remote attackers to execute arbitrary commands via the adminPassword parameter, a different issue than CVE-2015-7381.
Query: exploit SQL injection vulnerability in related.php in Milw0rm Clone Script 1.0 allows remote attackers to execute arbitrary SQL commands via the program parameter.
Matching passage: CVE-2015-4137. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in related.php in Milw0rm Clone Script 1.0 allows remote attackers to execute arbitrary SQL commands via the program parameter.
Near-miss passage: CVE-2015-4724. CWE: CWE-89. CVSS: 8.800000190734863. SQL injection vulnerability in Concrete5 5.7.3.1.
Query: detection rule: Detects port forwarding activity via SSH.exe
Matching passage: Sigma rule: Detects port forwarding activity via SSH.exe. Logsource: windows / process_creation. Rule: title: Port Forwarding Activity Via SSH.EXE id: 327f48c1-a6db-4eb8-875a-f6981f1b0183 status: test description: Detects port forwarding activity via SSH.exe references: - https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-12 modified: 2024-03-05 tags: - attack.command-and-control - attack.lateral-movement - attack.t1572 - attack.t1021.001 - attack.t1021.004 logsource: category: process_creation product: windows detection: selection: Image|endswith: \ssh.exe CommandLine|contains|windash: ' -R ' condition: selection falsepositives: - Administrative activity using a remote port forwarding to a local port level: medium
Near-miss passage: Sigma rule: Detects potential DLL sideloading of "DbgModel.dll". Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Of DbgModel.DLL id: fef394cd-f44d-4040-9b18-95d92fe278c0 status: test description: Detects potential DLL sideloading of "DbgModel.dll" references: - https://hijacklibs.net/entries/microsoft/built-in/dbgmodel.html author: Gary Lobermier date: 2024-07-11 modified: 2024-07-22 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: product: windows category: image_load detection: selection: ImageLoaded|endswith: \dbgmodel.dll filter_main_generic: ImageLoaded|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ filter_optional_windbg: ImageLoaded|startswith: C:\Program Files\WindowsApps\Microsoft.WinDbg_ filter_optional_windows_kits: ImageLoaded|startswith: - C:\Program Files (x86)\Windows Kits\ - C:\Program Files\Windows Kits\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate applications loading their own versions of the DLL mentioned in this rule level: medium
Query: vulnerability: Multiple race conditions in the Advanced Union Filesystem (aufs) aufs3-mmap.patch and aufs4-mmap.patch patches for the Linux kernel 3.x and 4.x allow local users to cause a denial 
Matching passage: CVE-2015-7312. CWE: CWE-362. CVSS: 4.400000095367432. Multiple race conditions in the Advanced Union Filesystem (aufs) aufs3-mmap.patch and aufs4-mmap.patch patches for the Linux kernel 3.x and 4.x allow local users to cause a denial of service (use-after-free and BUG) or possibly gain privileges via a (1) madvise or (2) msync system call, related to mm/madvise.c and mm/msync.c.
Near-miss passage: CVE-2015-0654. CWE: CWE-362. CVSS: 7.099999904632568. Race condition in the TLS implementation in MainApp in the management interface in Cisco Intrusion Prevention System (IPS) Software before 7.3(3)E4 allows remote attackers to cause a denial of service (process hang) by establishing many HTTPS sessions, aka Bug ID CSCuq40652.
Query: campaign using SMB/Windows Admin Shares
Matching passage: T1021.002 SMB/Windows Admin Shares. Tactics: lateral movement. Description: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user. SMB is a file, printer, and serial port sharing protocol for Windows machines on the same network or domain. Adversaries may use SMB to interact with file shares, allowing them to move laterally throughout a network. Linux and macOS implementations of SMB typically use Samba. Windows systems have hidden network shares that are accessible only to administrators and provide the ability for remote file copy and other administrative functions. Example network shares include `C$`, `ADMIN$`, and `IPC$`. Adversaries may use this technique in conjunction with administrator-level [Valid Accounts](https://attack.mitre.org/techniques/T1078) to remotely access a networked system over SMB,(Citation: Wikipedia Server Message Block) to interact with systems using remote procedure calls (RPCs),(Citation: TechNet RPC) transfer files, and run transferred binaries through remote Execution. Example execution techniques that rely on authenticated sessions over SMB/RPC are [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), [Service Execution](https://attack.mitre.org/techniques/T1569/002), and [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047). Adversaries can also use NTLM hashes to access administrator shares on systems with [Pass the Hash](https://attack.mitre.org/techniques/T1550/002) and certain configuration and patch levels.(Citation: Microsoft Admin Shares)
Near-miss passage: T1021.004 SSH. Tactics: lateral movement. Description: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user. SSH is a protocol that allows authorized users to open remote shells on other computers. Many Linux and macOS versions come with SSH installed by default, although typically disabled until the user enables it. On ESXi, SSH can be enabled either directly on the host (e.g., via `vim-cmd hostsvc/enable_ssh`) or via vCenter.(Citation: Sygnia ESXi Ransomware 2025)(Citation: TrendMicro ESXI Ransomware)(Citation: Sygnia Abyss Locker 2025) The SSH server can be configured to use standard password authentication or public-private keypairs in lieu of or in addition to a password. In this authentication scenario, the user’s public key must be in a special file on the computer running the server that lists which keypairs are allowed to login as that user (i.e., [SSH Authorized Keys](https://attack.mitre.org/techniques/T1098/004)).
Query: rule covering Detects suspicious application installed by looking at the added shortcut to the app resolver cache
Matching passage: Sigma rule: Detects suspicious application installed by looking at the added shortcut to the app resolver cache. Logsource: windows / shell-core. Rule: title: Suspicious Application Installed id: 83c161b6-ca67-4f33-8ad0-644a0737cf07 status: test description: Detects suspicious application installed by looking at the added shortcut to the app resolver cache references: - https://nasbench.medium.com/finding-forensic-goodness-in-obscure-windows-event-logs-60e978ea45a3 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-14 tags: - attack.execution logsource: product: windows service: shell-core detection: selection_name: EventID: 28115 Name|contains: - Zenmap - AnyDesk - wireshark - openvpn selection_packageid: EventID: 28115 AppID|contains: - zenmap.exe - prokzult ad - wireshark - openvpn condition: 1 of selection_* falsepositives: - Packages or applications being legitimately used by users or administrators level: medium
Near-miss passage: Sigma rule: Detects Python one-liners that use base64 decoding functions in command line executions. Malicious scripts or attackers. Logsource: windows / process_creation. Rule: title: Python One-Liners with Base64 Decoding id: 50a0aa3d-ab16-4594-a8aa-5145a6e6792b related: - id: 55e862a8-dd9c-4651-807a-f21fcad56716 type: similar status: experimental description: 'Detects Python one-liners that use base64 decoding functions in command line executions. Malicious scripts or attackers often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion. ' references: - https://docs.python.org/3/library/base64.html - https://www.virustotal.com/gui/file/bc43e925d7b4b74319f6e74e836a96f1997ba404e14ac566cf12a21e9da463db/behavior - https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites author: Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-03-09 tags: - attack.execution - attack.stealth - attack.t1059.006 - attack.t1027.010 logsource: category: process_creation product: windows detection: selection_img: - Image|contains: \python - OriginalFileName|contains: python selection_cli: CommandLine|contains|all: - import - base64 - ' -c' CommandLine|contains: - .decode - b16decode - b32decode - b32hexdecode - b64decode - b85decode - z85decode condition: all of selection_* falsepositives: - Legitimate use of Python for decoding data, which is uncommon in typical enterprise environments but possible in development or data analysis contexts. level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_python_base64_encoded_execution/info.yml
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: An attacker may execute an application as a SCR File using rundll32.exe desk.cpl,InstallScreenSaver. Logsource: windows / process_creation. Rule: title: Rundll32 InstallScreenSaver Execution id: 15bd98ea-55f4-4d37-b09a-e7caa0fa2221 status: test description: An attacker may execute an application as a SCR File using rundll32.exe desk.cpl,InstallScreenSaver references: - https://lolbas-project.github.io/lolbas/Libraries/Desk/ - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1218.011/T1218.011.md#atomic-test-13---rundll32-with-deskcpl author: Christopher Peacock @securepeacock, SCYTHE @scythe_io, TactiKoolSec date: 2022-04-28 modified: 2023-02-09 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE selection_cli: CommandLine|contains: InstallScreenSaver condition: all of selection_* falsepositives: - Legitimate installation of a new screensaver level: medium
Near-miss passage: Sigma rule: Detects creation of the Process Monitor driver by processes other than Process Monitor (procmon) itself.. Logsource: windows / file_event. Rule: title: Process Monitor Driver Creation By Non-Sysinternals Binary id: a05baa88-e922-4001-bc4d-8738135f27de status: test description: Detects creation of the Process Monitor driver by processes other than Process Monitor (procmon) itself. references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-05 modified: 2026-06-29 tags: - attack.persistence - attack.privilege-escalation - attack.t1068 logsource: product: windows category: file_event detection: selection: TargetFilename|contains: \procmon TargetFilename|endswith: .sys filter_main_process_explorer: Image|endswith: - \procmon.exe - \procmon64.exe - \procmon64a.exe condition: selection and not 1 of filter_main_* falsepositives: - Some false positives may occur with legitimate renamed process monitor binaries level: medium
Query: patch priority for CVE-2015-7011
Matching passage: CVE-2015-7011. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple Safari before 9.0.1 and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-3 and APPLE-SA-2015-10-21-5.
Near-miss passage: CVE-2015-2546. CWE: CWE-119. CVSS: 8.199999809265137. The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka "Win32k Memory Corruption Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2511, CVE-2015-2517, and CVE-2015-2518.
Query: write Sigma for Detects the creation of a new PowerShell module in the first folder of the module directory structure "\WindowsPowerShel
Matching passage: Sigma rule: Detects the creation of a new PowerShell module in the first folder of the module directory structure "\WindowsPowerShel. Logsource: windows / file_event. Rule: title: Potential Suspicious PowerShell Module File Created id: e8a52bbd-bced-459f-bd93-64db45ce7657 status: test description: Detects the creation of a new PowerShell module in the first folder of the module directory structure "\WindowsPowerShell\Modules\malware\malware.psm1". This is somewhat an uncommon practice as legitimate modules often includes a version folder. references: - Internal Research - https://learn.microsoft.com/en-us/powershell/scripting/developer/module/understanding-a-windows-powershell-module?view=powershell-7.3 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-09 tags: - attack.persistence logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: - \\WindowsPowerShell\\Modules\\*\.ps - \\WindowsPowerShell\\Modules\\*\.dll condition: selection falsepositives: - False positive rate will vary depending on the environments. Additional filters might be required to make this logic usable in production. level: medium
Near-miss passage: Sigma rule: Detects a TacticalRMM service installation. Tactical RMM is a remote monitoring & management tool.. Logsource: windows / system. Rule: title: TacticalRMM Service Installation id: 4bb79b62-ef12-4861-981d-2aab43fab642 status: test description: Detects a TacticalRMM service installation. Tactical RMM is a remote monitoring & management tool. references: - https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-11-28 tags: - attack.command-and-control - attack.t1219.002 logsource: product: windows service: system detection: selection_root: Provider_Name: Service Control Manager EventID: 7045 selection_service: - ImagePath|contains: tacticalrmm.exe - ServiceName|contains: TacticalRMM Agent Service condition: all of selection_* falsepositives: - Legitimate use of the tool level: medium
Query: risk of NaCl in 2015 allowed the CLFLUSH instruction, making rowhammer attacks possible.
Matching passage: CVE-2015-0565. CWE: CWE-119. CVSS: 10.0. NaCl in 2015 allowed the CLFLUSH instruction, making rowhammer attacks possible.
Near-miss passage: CVE-2015-2991. CWE: CWE-119. CVSS: 6.800000190734863. Buffer overflow in NScripter before 3.00 allows remote attackers to execute arbitrary code via crafted save data.
Query: intelligence brief on T1213.004
Matching passage: T1213.004 Customer Relationship Management Software. Tactics: collection. Description: Adversaries may leverage Customer Relationship Management (CRM) software to mine valuable information. CRM software is used to assist organizations in tracking and managing customer interactions, as well as storing customer data. Once adversaries gain access to a victim organization, they may mine CRM software for customer data. This may include personally identifiable information (PII) such as full names, emails, phone numbers, and addresses, as well as additional details such as purchase histories and IT support interactions. By collecting this data, an adversary may be able to send personalized [Phishing](https://attack.mitre.org/techniques/T1566) emails, engage in SIM swapping, or otherwise target the organization’s customers in ways that enable financial gain or the compromise of additional organizations.(Citation: Bleeping Computer US Cellular Hack 2022)(Citation: Bleeping Computer Mint Mobile Hack 2021)(Citation: Bleeping Computer Bank Hack 2020) CRM software may be hosted on-premises or in the cloud. Information stored in these solutions may vary based on the specific instance or environment. Examples of CRM software include Microsoft Dynamics 365, Salesforce, Zoho, Zendesk, and HubSpot.
Near-miss passage: T1213.005 Messaging Applications. Tactics: collection. Description: Adversaries may leverage chat and messaging applications, such as Microsoft Teams, Google Chat, and Slack, to mine valuable information. The following is a brief list of example information that may hold potential value to an adversary and may also be found on messaging applications: * Testing / development credentials (i.e., [Chat Messages](https://attack.mitre.org/techniques/T1552/008)) * Source code snippets * Links to network shares and other internal resources * Proprietary data(Citation: Guardian Grand Theft Auto Leak 2022) * Discussions about ongoing incident response efforts(Citation: SC Magazine Ragnar Locker 2021)(Citation: Microsoft DEV-0537) In addition to exfiltrating data from messaging applications, adversaries may leverage data from chat messages in order to improve their targeting - for example, by learning more about an environment or evading ongoing incident response efforts.(Citation: Sentinel Labs NullBulge 2024)(Citation: Permiso Scattered Spider 2023)
Query: detection rule: Detects disabling of system firewalls which could be used by adversaries to bypass controls that limit usage of the netw
Matching passage: Sigma rule: Detects disabling of system firewalls which could be used by adversaries to bypass controls that limit usage of the netw. Logsource: linux / auditd. Rule: title: Disable System Firewall id: 53059bc0-1472-438b-956a-7508a94a91f0 status: test description: Detects disabling of system firewalls which could be used by adversaries to bypass controls that limit usage of the network. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md - https://firewalld.org/documentation/man-pages/firewall-cmd.html author: Pawel Mazur date: 2022-01-22 tags: - attack.defense-impairment - attack.t1686 logsource: product: linux service: auditd detection: selection: type: SERVICE_STOP unit: - firewalld - iptables - ufw condition: selection falsepositives: - Admin activity level: high
Near-miss passage: Sigma rule: Detect usage of the "runexehelper.exe" binary as a proxy to launch other programs. Logsource: windows / process_creation. Rule: title: Lolbin Runexehelper Use As Proxy id: cd71385d-fd9b-4691-9b98-2b1f7e508714 status: test description: Detect usage of the "runexehelper.exe" binary as a proxy to launch other programs references: - https://twitter.com/0gtweet/status/1206692239839289344 - https://lolbas-project.github.io/lolbas/Binaries/Runexehelper/ author: frack113 date: 2022-12-29 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \runexehelper.exe condition: selection falsepositives: - Unknown level: medium
Query: risk of Integer overflow in the Bitmap_createFromParcel function in core/jni/android/graphics/Bitmap.cpp in Android before 5.1.1 LMY48I allows attackers to cause a denial of service (syste
Matching passage: CVE-2015-1536. CWE: CWE-189. CVSS: 8.5. Integer overflow in the Bitmap_createFromParcel function in core/jni/android/graphics/Bitmap.cpp in Android before 5.1.1 LMY48I allows attackers to cause a denial of service (system_server crash) or obtain sensitive system_server memory-content information via a crafted application that leverages improper unmarshalling of bitmaps, aka internal bug 19666945.
Near-miss passage: CVE-2015-4022. CWE: CWE-189. CVSS: 7.5. Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command, leading to a heap-based buffer overflow.