alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects suspicious start of rundll32.exe without any parameters as found in CobaltStrike beacon activity. Logsource: windows / process_creation. Rule: title: Rundll32 Execution Without CommandLine Parameters id: 1775e15e-b61b-4d14-a1a3-80981298085a status: test description: Detects suspicious start of rundll32.exe without any parameters as found in CobaltStrike beacon activity references: - https://www.cobaltstrike.com/help-opsec - https://twitter.com/ber_m1ng/status/1397948048135778309 author: Florian Roth (Nextron Systems) date: 2021-05-27 modified: 2023-08-31 tags: - attack.stealth - attack.t1202 logsource: category: process_creation product: windows detection: selection: CommandLine|endswith: - \rundll32.exe - \rundll32.exe" - \rundll32 filter: ParentImage|contains: - \AppData\Local\ - \Microsoft\Edge\ condition: selection and not filter falsepositives: - Possible but rare level: high
Near-miss passage: Sigma rule: Detects the export of a crital Registry key to a file.. Logsource: windows / process_creation. Rule: title: Exports Critical Registry Keys To a File id: 82880171-b475-4201-b811-e9c826cd5eaa related: - id: f0e53e89-8d22-46ea-9db5-9d4796ee2f8a type: similar status: test description: Detects the export of a crital Registry key to a file. references: - https://lolbas-project.github.io/lolbas/Binaries/Regedit/ - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f author: Oddvar Moe, Sander Wiebing, oscd.community date: 2020-10-12 modified: 2024-03-13 tags: - attack.exfiltration - attack.discovery - attack.t1012 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \regedit.exe - OriginalFileName: REGEDIT.EXE selection_cli_1: CommandLine|contains|windash: ' -E ' selection_cli_2: CommandLine|contains: - hklm - hkey_local_machine selection_cli_3: CommandLine|endswith: - \system - \sam - \security condition: all of selection_* falsepositives: - Dumping hives for legitimate purpouse i.e. backup or forensic investigation level: high
Query: exploit Buffer overflow in Schneider Electric IMT25 Magnetic Flow DTM before 1.500.004 for the HART Protocol allows remote authenticated users to execute arbitrary code or cause a denial o
Matching passage: CVE-2015-3977. CWE: CWE-119. CVSS: 7.699999809265137. Buffer overflow in Schneider Electric IMT25 Magnetic Flow DTM before 1.500.004 for the HART Protocol allows remote authenticated users to execute arbitrary code or cause a denial of service (memory corruption) via a crafted HART reply.
Near-miss passage: CVE-2015-2282. CWE: CWE-119. CVSS: 7.5. Stack-based buffer overflow in the LZC decompression implementation (CsObjectInt::CsDecomprLZC function in vpa106cslzc.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java, Netweaver RFC SDK, GUI, RFC SDK, SAPCAR archive tool, and other products allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors, aka SAP Security Note 2124806, 2121661, 2127995, and 2125316.
Query: detection rule: Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately
Matching passage: Sigma rule: Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately. Logsource: azure / activitylogs. Rule: title: Azure Subscription Permission Elevation Via ActivityLogs id: 09438caa-07b1-4870-8405-1dbafe3dad95 status: test description: 'Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn''t planned. This setting could allow an attacker access to Azure subscriptions in your environment. ' references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftauthorization author: Austin Songer @austinsonger date: 2021-11-26 modified: 2022-08-23 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078.004 logsource: product: azure service: activitylogs detection: selection: operationName: MICROSOFT.AUTHORIZATION/ELEVATEACCESS/ACTION condition: selection falsepositives: - If this was approved by System Administrator. level: high
Near-miss passage: Sigma rule: Detects events in which a history file gets deleted, e.g. the ~/bash_history to remove traces of malicious activity. Logsource: linux / process_creation. Rule: title: History File Deletion id: 1182f3b3-e716-4efa-99ab-d2685d04360f status: test description: Detects events in which a history file gets deleted, e.g. the ~/bash_history to remove traces of malicious activity references: - https://github.com/sleventyeleven/linuxprivchecker/ - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md author: Florian Roth (Nextron Systems) date: 2022-06-20 modified: 2022-09-15 tags: - attack.impact - attack.t1565.001 logsource: category: process_creation product: linux detection: selection: Image|endswith: - /rm - /unlink - /shred selection_history: - CommandLine|contains: - /.bash_history - /.zsh_history - CommandLine|endswith: - _history - .history - zhistory condition: all of selection* falsepositives: - Legitimate administration activities level: high
Query: risk of Xen 3.3.x through 4.5.x does not properly restrict access to PCI MSI mask bits, which allows local x86 HVM guest users to cause a denial of service (unexpected interrupt and host c
Matching passage: CVE-2015-4104. CWE: CWE-264. CVSS: 7.800000190734863. Xen 3.3.x through 4.5.x does not properly restrict access to PCI MSI mask bits, which allows local x86 HVM guest users to cause a denial of service (unexpected interrupt and host crash) via unspecified vectors.
Near-miss passage: CVE-2015-6306. CWE: CWE-264. CVSS: 7.199999809265137. Cisco AnyConnect Secure Mobility Client 4.1(8) on OS X and Linux does not verify pathnames before installation actions, which allows local users to obtain root privileges via a crafted installation file, aka Bug ID CSCuv11947.
Query: CVE similar to CVE-2015-7292
Matching passage: CVE-2015-7292. CWE: CWE-119. CVSS: 9.800000190734863. Stack-based buffer overflow in the havok_write function in drivers/staging/havok/havok.c in Amazon Fire OS before 2016-01-15 allows attackers to cause a denial of service (panic) or possibly have unspecified other impact via a long string to /dev/hv.
Near-miss passage: CVE-2015-5791. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Query: describe CVE-2015-2924
Matching passage: CVE-2015-2924. CWE: CWE-20. CVSS: 3.299999952316284. The receive_ra function in rdisc/nm-lndp-rdisc.c in the Neighbor Discovery (ND) protocol implementation in the IPv6 stack in NetworkManager 1.x allows remote attackers to reconfigure a hop-limit setting via a small hop_limit value in a Router Advertisement (RA) message, a similar issue to CVE-2015-2922.
Near-miss passage: CVE-2015-4605. CWE: CWE-20. CVSS: 7.5. The mcopy function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, does not properly restrict a certain offset value, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string that is mishandled by a "Python script text executable" rule.
Query: weakness Generation of Incorrect Security Tokens
Matching passage: CWE-1270 Generation of Incorrect Security Tokens. The product implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens generated in the system are incorrect.
Near-miss passage: CWE-7 J2EE Misconfiguration: Missing Custom Error Page. The default error page of a web application should not display sensitive information about the product.
Query: risk of Multiple open redirect vulnerabilities in u5CMS before 3.9.4 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) pidve
Matching passage: CVE-2015-1578. CWE: UNKNOWN. CVSS: 5.800000190734863. Multiple open redirect vulnerabilities in u5CMS before 3.9.4 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) pidvesa cookie to u5admin/pidvesa.php or (2) uri parameter to u5admin/meta2.php.
Near-miss passage: CVE-2015-0412. CWE: UNKNOWN. CVSS: 7.199999809265137. Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS.
Query: detection rule: Detects instances where an OpenCanary node has been targeted by a NMAP FIN Scan
Matching passage: Sigma rule: Detects instances where an OpenCanary node has been targeted by a NMAP FIN Scan. Logsource: opencanary / application. Rule: title: OpenCanary - NMAP FIN Scan id: eae8c0c8-e5da-450a-9d7d-66aa56cd26b6 status: experimental description: Detects instances where an OpenCanary node has been targeted by a NMAP FIN Scan references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Marco Pedrinazzi (@pedrinazziM) date: 2026-01-06 tags: - attack.discovery - attack.t1046 logsource: category: application product: opencanary detection: selection: logtype: 5005 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects system information discovery commands. Logsource: linux / process_creation. Rule: title: System Information Discovery id: 42df45e7-e6e9-43b5-8f26-bec5b39cc239 status: stable description: Detects system information discovery commands references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1082/T1082.md author: Ömer Günal, oscd.community date: 2020-10-08 modified: 2021-09-14 tags: - attack.discovery - attack.t1082 logsource: product: linux category: process_creation detection: selection: Image|endswith: - /uname - /hostname - /uptime - /lspci - /dmidecode - /lscpu - /lsmod condition: selection falsepositives: - Legitimate administration activities level: informational
Query: rule covering Detects a highly relevant Antivirus alert that reports APT malware. This event must not be ignored just because the AV h
Matching passage: Sigma rule: Detects a highly relevant Antivirus alert that reports APT malware. This event must not be ignored just because the AV h. Logsource: antivirus. Rule: title: Antivirus - APT Malware Signature id: 101a1877-2cf4-474d-abfd-7f6ac4788d1a status: experimental description: 'Detects a highly relevant Antivirus alert that reports APT malware. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place. ' references: - https://www.nextron-systems.com/?s=antivirus author: Arnim Rupp (Nextron Systems) date: 2026-06-15 tags: - attack.execution - attack.t1203 - attack.command-and-control - attack.t1219.002 logsource: category: antivirus detection: selection: - Signature|re: - APT\d - ATK\d - UNC\d - UAC\d - Signature|contains: - '[APT]' - APT_ - APT- - BackOrder - BlindingCan - Blizzard - Chollima - Cleaver - Cobra - DarkHotel - Dragon - DTrack - Equation - GiftedCrook - GraphSteel - GreyEnergy - GEnergy - GrimPlant - Hydra - Jackal - Kitten - Kimsuky - Lazar - LightRail - Lotus - Luminous - LumiMoth - Nimbus - Manticore - MiniBike - MiniBrowse - MiniBus - MiniFast - MiniJuke - MiniUpdate - MuddyWater - NukeSped - OilRig - Panda - Sandstorm - SandWorm - Seamonkey - Sleet - SlugResin - SnailResin - Snake - Tempest - Tsunami - Turla - Typhoon - UAC_ - UAC- - UNC_ - UNC- - VinoSiren - Winnti condition: selection falsepositives: - Unlikely level: critical
Near-miss passage: Sigma rule: Detects the creation or modification of the Windows Terminal Profile settings file "settings.json" by an uncommon proces. Logsource: windows / file_event. Rule: title: Windows Terminal Profile Settings Modification By Uncommon Process id: 9b64de98-9db3-4033-bd7a-f51430105f00 status: test description: Detects the creation or modification of the Windows Terminal Profile settings file "settings.json" by an uncommon process. references: - https://github.com/redcanaryco/atomic-red-team/blob/74438b0237d141ee9c99747976447dc884cb1a39/atomics/T1547.015/T1547.015.md#atomic-test-1---persistence-by-modifying-windows-terminal-profile - https://twitter.com/nas_bench/status/1550836225652686848 author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-07-22 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.015 logsource: product: windows category: file_event detection: selection: Image|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \wscript.exe TargetFilename|endswith: \AppData\Local\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\LocalState\settings.json condition: selection falsepositives: - Some false positives may occur with admin scripts that set WT settings. level: medium
Query: patch priority for CVE-2015-0383
Matching passage: CVE-2015-0383. CWE: UNKNOWN. CVSS: 5.400000095367432. Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4 and R28.3.4 allows local users to affect integrity and availability via unknown vectors related to Hotspot.
Near-miss passage: CVE-2015-7917. CWE: UNKNOWN. CVSS: 7.199999809265137. Untrusted search path vulnerability in Open Automation OPC Systems.NET 8.00.0023 and earlier allows local users to gain privileges via a Trojan horse DLL in an unspecified directory.
Query: risk of The web framework in Cisco Prime Collaboration Assurance (PCA) 10.5(1) allows remote authenticated users to bypass intended access restrictions and read arbitrary files via a craft
Matching passage: CVE-2015-6328. CWE: CWE-200. CVSS: 6.800000190734863. The web framework in Cisco Prime Collaboration Assurance (PCA) 10.5(1) allows remote authenticated users to bypass intended access restrictions and read arbitrary files via a crafted URL, aka Bug ID CSCus88380.
Near-miss passage: CVE-2015-2286. CWE: CWE-200. CVSS: 6.5. lms/templates/footer-edx-new.html in Open edX edx-platform before 2015-01-29 does not properly restrict links on the password-reset page, which allows user-assisted remote attackers to discover password-reset tokens by reading a referer log after a victim navigates from this page to a social-sharing site.
Query: risk of Cross-site request forgery (CSRF) vulnerability in the Commerce Balanced Payments module for Drupal allows remote attackers to hijack the authentication of arbitrary users for requ
Matching passage: CVE-2015-3388. CWE: CWE-352. CVSS: 5.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Commerce Balanced Payments module for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that delete the user's configured bank accounts via unspecified vectors.
Near-miss passage: CVE-2015-2248. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the user portal in Dell SonicWALL Secure Remote Access (SRA) products with firmware before 7.5.1.0-38sv and 8.x before 8.0.0.1-16sv allows remote attackers to hijack the authentication of users for requests that create bookmarks via a crafted request to cgi-bin/editBookmark.
Query: describe CVE-2015-0990
Matching passage: CVE-2015-0990. CWE: UNKNOWN. CVSS: 4.400000095367432. Untrusted search path vulnerability in Ecava IntegraXor SCADA Server before 4.2.4488 allows local users to gain privileges via a renamed DLL in the default install directory.
Near-miss passage: CVE-2015-4907. CWE: UNKNOWN. CVSS: 4.599999904632568. Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Solaris Kernel Zones, a different vulnerability than CVE-2015-4820.
Query: CVE similar to CVE-2015-1131
Matching passage: CVE-2015-1131. CWE: CWE-20. CVSS: 7.199999809265137. fontd in Apple Type Services (ATS) in Apple OS X before 10.10.3 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-1132, CVE-2015-1133, CVE-2015-1134, and CVE-2015-1135.
Near-miss passage: CVE-2015-0228. CWE: CWE-20. CVSS: 5.0. The lua_websocket_read function in lua_request.c in the mod_lua module in the Apache HTTP Server through 2.4.12 allows remote attackers to cause a denial of service (child-process crash) by sending a crafted WebSocket Ping frame after a Lua script has called the wsupgrade function.
Query: detect Detects potential malicious modification of the property value of IsCredGuardEnabled from HKLM:\SYSTEM\CurrentControlSet in logs
Matching passage: Sigma rule: Detects potential malicious modification of the property value of IsCredGuardEnabled from HKLM:\SYSTEM\CurrentControlSet. Logsource: windows / registry_event. Rule: title: Wdigest CredGuard Registry Modification id: 1a2d6c47-75b0-45bd-b133-2c0be75349fd status: test description: 'Detects potential malicious modification of the property value of IsCredGuardEnabled from HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest to disable Cred Guard on a system. This is usually used with UseLogonCredential to manipulate the caching credentials. ' references: - https://teamhydra.blog/2020/08/25/bypassing-credential-guard/ author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2019-08-25 modified: 2021-11-27 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_event product: windows detection: selection: TargetObject|endswith: \IsCredGuardEnabled condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects process connections to a Monero crypto mining pool. Logsource: linux / network_connection. Rule: title: Linux Crypto Mining Pool Connections id: a46c93b7-55ed-4d27-a41b-c259456c4746 status: stable description: Detects process connections to a Monero crypto mining pool references: - https://www.poolwatch.io/coin/monero author: Florian Roth (Nextron Systems) date: 2021-10-26 tags: - attack.impact - attack.t1496 logsource: product: linux category: network_connection detection: selection: DestinationHostname: - pool.minexmr.com - fr.minexmr.com - de.minexmr.com - sg.minexmr.com - ca.minexmr.com - us-west.minexmr.com - pool.supportxmr.com - mine.c3pool.com - xmr-eu1.nanopool.org - xmr-eu2.nanopool.org - xmr-us-east1.nanopool.org - xmr-us-west1.nanopool.org - xmr-asia1.nanopool.org - xmr-jp1.nanopool.org - xmr-au1.nanopool.org - xmr.2miners.com - xmr.hashcity.org - xmr.f2pool.com - xmrpool.eu - pool.hashvault.pro - moneroocean.stream - monerocean.stream condition: selection falsepositives: - Legitimate use of crypto miners level: high
Query: risk of The Undertow module of WildFly 9.x before 9.0.0.CR2 and 10.x before 10.0.0.Alpha1 allows remote attackers to obtain the source code of a JSP page via a "/" at the end of a URL.
Matching passage: CVE-2015-3198. CWE: CWE-200. CVSS: 7.5. The Undertow module of WildFly 9.x before 9.0.0.CR2 and 10.x before 10.0.0.Alpha1 allows remote attackers to obtain the source code of a JSP page via a "/" at the end of a URL.
Near-miss passage: CVE-2015-5022. CWE: CWE-200. CVSS: 4.300000190734863. IBM Multi-Enterprise Integration Gateway 1.x through 1.0.0.1 and B2B Advanced Communications 1.0.0.2 and 1.0.0.3 before 1.0.0.3_2, when access by guests is enabled, place an internal hostname and a payload path in a response, which allows remote authenticated users to obtain sensitive information by leveraging a trading-partner relationship and reading response fields.
Query: alert when Use of reg to get MachineGuid information
Matching passage: Sigma rule: Use of reg to get MachineGuid information. Logsource: windows / process_creation. Rule: title: Suspicious Query of MachineGUID id: f5240972-3938-4e56-8e4b-e33893176c1f status: test description: Use of reg to get MachineGuid information references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1082/T1082.md#atomic-test-8---windows-machineguid-discovery author: frack113 date: 2022-01-01 tags: - attack.discovery - attack.t1082 logsource: category: process_creation product: windows detection: selection: Image|endswith: \reg.exe CommandLine|contains|all: - SOFTWARE\Microsoft\Cryptography - '/v ' - MachineGuid condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detect malicious GPO modifications can be used to implement many other malicious behaviors.. Logsource: windows / ps_script. Rule: title: Modify Group Policy Settings - ScriptBlockLogging id: b7216a7d-687e-4c8d-82b1-3080b2ad961f related: - id: ada4b0c4-758b-46ac-9033-9004613a150d type: similar status: test description: Detect malicious GPO modifications can be used to implement many other malicious behaviors. references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1484.001/T1484.001.md author: frack113 date: 2022-08-19 tags: - attack.privilege-escalation - attack.defense-impairment - attack.t1484.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_path: ScriptBlockText|contains: \SOFTWARE\Policies\Microsoft\Windows\System selection_key: ScriptBlockText|contains: - GroupPolicyRefreshTimeDC - GroupPolicyRefreshTimeOffsetDC - GroupPolicyRefreshTime - GroupPolicyRefreshTimeOffset - EnableSmartScreen - ShellSmartScreenLevel condition: all of selection_* falsepositives: - Legitimate use level: medium
Query: vulnerability: client_chown in the sync client in Synology Cloud Station 1.1-2291 through 3.1-3320 on OS X allows local users to change the ownership of arbitrary files, and consequently obtain r
Matching passage: CVE-2015-2851. CWE: CWE-264. CVSS: 6.800000190734863. client_chown in the sync client in Synology Cloud Station 1.1-2291 through 3.1-3320 on OS X allows local users to change the ownership of arbitrary files, and consequently obtain root access, by specifying a filename.
Near-miss passage: CVE-2015-7052. CWE: CWE-264. CVSS: 7.199999809265137. kext tools in Apple OS X before 10.11.2 mishandles kernel-extension loading, which allows local users to gain privileges via unspecified vectors.
Query: CVE similar to CVE-2015-8685
Matching passage: CVE-2015-8685. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.8.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) external calendar url or (2) the bank name field in the "import external calendar" page.
Near-miss passage: CVE-2015-7997. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the Nitro API in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 10.1 Build 133.9, 10.5 before Build 58.11, and 10.5.e before Build 56.1505.e on NetScaler Service Delivery Appliance Service VM (SVM) devices allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.