alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Identifies when an organization doesn't have the proper license for PIM and is out of compliance.
Matching passage: Sigma rule: Identifies when an organization doesn't have the proper license for PIM and is out of compliance.. Logsource: azure / pim. Rule: title: Invalid PIM License id: 58af08eb-f9e1-43c8-9805-3ad9b0482bd8 status: test description: Identifies when an organization doesn't have the proper license for PIM and is out of compliance. references: - https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#the-organization-doesnt-have-microsoft-entra-premium-p2-or-microsoft-entra-id-governance author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-14 tags: - attack.initial-access - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation logsource: product: azure service: pim detection: selection: riskEventType: invalidLicenseAlertIncident condition: selection falsepositives: - Investigate if licenses have expired. level: high
Near-miss passage: Sigma rule: Detects suspicious Windows Update Agent activity in which a wuauclt.exe process command line doesn't contain any command. Logsource: windows / process_creation. Rule: title: Suspicious Windows Update Agent Empty Cmdline id: 52d097e2-063e-4c9c-8fbb-855c8948d135 status: test description: 'Detects suspicious Windows Update Agent activity in which a wuauclt.exe process command line doesn''t contain any command line flags ' references: - https://redcanary.com/blog/blackbyte-ransomware/ author: Florian Roth (Nextron Systems) date: 2022-02-26 modified: 2023-11-11 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \Wuauclt.exe - OriginalFileName: Wuauclt.exe selection_cli: CommandLine|endswith: - Wuauclt - Wuauclt.exe condition: all of selection* falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-4490
Matching passage: CVE-2015-4490. CWE: CWE-79. CVSS: 4.300000190734863. The nsCSPHostSrc::permits function in dom/security/nsCSPUtils.cpp in Mozilla Firefox before 40.0 does not implement the Content Security Policy Level 2 exceptions for the blob, data, and filesystem URL schemes during wildcard source-expression matching, which might make it easier for remote attackers to conduct cross-site scripting (XSS) attacks by leveraging unexpected policy-enforcement behavior.
Near-miss passage: CVE-2015-8755. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allow remote authenticated editors to inject arbitrary web script or HTML via unknown vectors.
Query: CVE similar to CVE-2015-3038
Matching passage: CVE-2015-3038. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3041, CVE-2015-3042, and CVE-2015-3043.
Near-miss passage: CVE-2015-4840. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 7u85 and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via unknown vectors related to 2D.
Query: CVE similar to CVE-2015-1601
Matching passage: CVE-2015-1601. CWE: CWE-254. CVSS: 6.800000190734863. Siemens SIMATIC STEP 7 (TIA Portal) 12 and 13 before 13 SP1 Upd1 allows man-in-the-middle attackers to obtain sensitive information or modify transmitted data via unspecified vectors.
Near-miss passage: CVE-2015-9331. CWE: CWE-254. CVSS: 7.5. The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.
Query: patch priority for CVE-2015-6268
Matching passage: CVE-2015-6268. CWE: CWE-399. CVSS: 7.800000190734863. Cisco IOS XE before 2.2.3 on ASR 1000 devices allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted IPv4 UDP packet, aka Bug ID CSCsw95482.
Near-miss passage: CVE-2015-8230. CWE: CWE-399. CVSS: 7.5. Memory leak in Huawei eSpace 8950 IP phones with software before V200R003C00SPC300 allows remote attackers to cause a denial of service (memory consumption and restart) via a large number of crafted ARP packets.
Query: exploit Multiple insecure Temporary File vulnerabilities in 389 Administration Server before 1.1.38.
Matching passage: CVE-2015-0233. CWE: CWE-254. CVSS: 4.199999809265137. Multiple insecure Temporary File vulnerabilities in 389 Administration Server before 1.1.38.
Near-miss passage: CVE-2015-6498. CWE: CWE-254. CVSS: 7.5. Alcatel-Lucent Home Device Manager before 4.1.10, 4.2.x before 4.2.2 allows remote attackers to spoof and make calls as target devices.
Query: alert when Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has
Matching passage: Sigma rule: Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has. Logsource: windows / security. Rule: title: Password Protected ZIP File Opened id: 00ba9da1-b510-4f6b-b258-8d338836180f status: test description: Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened. references: - https://twitter.com/sbousseaden/status/1523383197513379841 author: Florian Roth (Nextron Systems) date: 2022-05-09 tags: - attack.stealth - attack.t1027 logsource: product: windows service: security detection: selection: EventID: 5379 TargetName|contains: Microsoft_Windows_Shell_ZipFolder:filename filter: TargetName|contains: \Temporary Internet Files\Content.Outlook condition: selection and not filter falsepositives: - Legitimate used of encrypted ZIP files level: medium
Near-miss passage: Sigma rule: Detects the execution of TruffleHog, a popular open-source tool used for scanning repositories for secrets and sensitive. Logsource: aws / cloudtrail. Rule: title: PUA - AWS TruffleHog Execution id: a840e606-7c8c-4684-9bc1-eb6b6155127f status: experimental description: 'Detects the execution of TruffleHog, a popular open-source tool used for scanning repositories for secrets and sensitive information, within an AWS environment. It has been reported to be used by threat actors for credential harvesting. All detections should be investigated to determine if the usage is authorized by security teams or potentially malicious. ' references: - https://github.com/trufflesecurity/trufflehog - https://www.rapid7.com/blog/post/tr-crimson-collective-a-new-threat-group-observed-operating-in-the-cloud/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-10-21 tags: - attack.credential-access - attack.t1555 - attack.t1003 logsource: product: aws service: cloudtrail detection: selection: userAgent: TruffleHog condition: selection falsepositives: - Legitimate use of TruffleHog by security teams for credential scanning. level: medium
Query: write Sigma for Detects suspicious DNS queries to api.telegram.org used by Telegram Bots of any kind
Matching passage: Sigma rule: Detects suspicious DNS queries to api.telegram.org used by Telegram Bots of any kind. Logsource: dns. Rule: title: Telegram Bot API Request id: c64c5175-5189-431b-a55e-6d9882158251 status: test description: Detects suspicious DNS queries to api.telegram.org used by Telegram Bots of any kind references: - https://core.telegram.org/bots/faq - https://researchcenter.paloaltonetworks.com/2018/03/unit42-telerat-another-android-trojan-leveraging-telegrams-bot-api-to-target-iranian-users/ - https://blog.malwarebytes.com/threat-analysis/2016/11/telecrypt-the-ransomware-abusing-telegram-api-defeated/ - https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/ author: Florian Roth (Nextron Systems) date: 2018-06-05 modified: 2022-10-09 tags: - attack.command-and-control - attack.t1102.002 logsource: category: dns detection: selection: query: api.telegram.org condition: selection falsepositives: - Legitimate use of Telegram bots in the company level: medium
Near-miss passage: Sigma rule: Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters.. Logsource: windows / file_event. Rule: title: Potential Homoglyph Attack Using Lookalike Characters in Filename id: 4f1707b1-b50b-45b4-b5a2-3978b5a5d0d6 status: test description: 'Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters. This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters. ' references: - https://redcanary.com/threat-detection-report/threats/socgholish/#threat-socgholish - http://www.irongeek.com/homoglyph-attack-generator.php author: Micah Babinski, @micahbabinski date: 2023-05-08 tags: - attack.stealth - attack.t1036 - attack.t1036.003 logsource: category: file_event product: windows detection: selection_upper: TargetFilename|contains: - А - В - Е - К - М - Н - О - Р - С - Т - Х - Ѕ - І - Ј - Ү - Ӏ - Ԍ - Ԛ - Ԝ - Α - Β - Ε - Ζ - Η - Ι - Κ - Μ - Ν - Ο - Ρ - Τ - Υ - Χ selection_lower: TargetFilename|contains: - а - е - о - р - с - х - ѕ - і - ӏ - ј - һ - ԁ - ԛ - ԝ - ο condition: 1 of selection_* falsepositives: - File names with legitimate Cyrillic text. Will likely require tuning (or not be usable) in countries where these alphabets are in use. level: medium
Query: incident response steps for Outbound C2 pattern associated with Create Process with Token
Matching passage: Playbook for T1134.002 Create Process with Token. 1) Validate alert telemetry against T1134.002. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth, privilege escalation. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may create a new process with an existing token to escalate privileges and bypass access controls. Processes can be created with the token and resulting security context of another user using features such as <code>CreateProcessWithTokenW</code> and <code>runas</code>.(Citation: Microsoft RunAs) Creating processes with a token not associated with the current user may require the creden
Near-miss passage: Playbook for T1134.001 Token Impersonation/Theft. Different response path focused on stealth, privilege escalation.
Query: explain CWE-182
Matching passage: CWE-182 Collapse of Data into Unsafe Value. The product filters data in a way that causes it to be reduced or collapsed into an unsafe value that violates an expected security property.
Near-miss passage: CWE-922 Insecure Storage of Sensitive Information. The product stores sensitive information without properly limiting read or write access by unauthorized actors.
Query: CVE similar to CVE-2015-7060
Matching passage: CVE-2015-7060. CWE: CWE-119. CVSS: 6.800000190734863. The ASN.1 decoder in Apple OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate, a different vulnerability than CVE-2015-7059 and CVE-2015-7061.
Near-miss passage: CVE-2015-5817. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Query: secure coding against Generation of Weak Initialization Vector (IV)
Matching passage: CWE-1204 Generation of Weak Initialization Vector (IV). The product uses a cryptographic primitive that uses an Initialization Vector (IV), but the product does not generate IVs that are sufficiently unpredictable or unique according to the expected cryptographic requirements for that primitive.
Near-miss passage: CWE-1317 Improper Access Control in Fabric Bridge. The product uses a fabric bridge for transactions between two Intellectual Property (IP) blocks, but the bridge does not properly perform the expected privilege, identity, or other access control checks between those IP blocks.
Query: exploit SQL injection vulnerability in the Gateway Provisioning service in EMC Secure Remote Services Virtual Edition (ESRS VE) 3.02 and 3.03 allows remote attackers to execute arbitrary S
Matching passage: CVE-2015-0524. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the Gateway Provisioning service in EMC Secure Remote Services Virtual Edition (ESRS VE) 3.02 and 3.03 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-9330. CWE: CWE-89. CVSS: 9.800000190734863. The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection.
Query: patch priority for CVE-2015-1291
Matching passage: CVE-2015-1291. CWE: CWE-264. CVSS: 6.400000095367432. The ContainerNode::parserRemoveChild function in core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 45.0.2454.85, does not check whether a node is expected, which allows remote attackers to bypass the Same Origin Policy or cause a denial of service (DOM tree corruption) via a web site with crafted JavaScript code and IFRAME elements.
Near-miss passage: CVE-2015-9015. CWE: CWE-264. CVSS: 7.800000190734863. An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36714120.
Query: describe CVE-2015-3978
Matching passage: CVE-2015-3978. CWE: CWE-200. CVSS: 2.0999999046325684. SAP Sybase Unwired Platform Online Data Proxy allows local users to obtain usernames and passwords via the DataVault, aka SAP Security Note 2094830.
Near-miss passage: CVE-2015-7836. CWE: CWE-200. CVSS: 3.299999952316284. Siemens RUGGEDCOM ROS before 4.2.1 allows remote attackers to obtain sensitive information by sniffing the network for VLAN data within the padding section of an Ethernet frame.
Query: threat report mentioning Software Packing
Matching passage: T1027.002 Software Packing. Tactics: stealth. Description: Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.(Citation: ESET FinFisher Jan 2018) Utilities used to perform software packing are called packers. Example packers are MPRESS and UPX. A more comprehensive list of known packers is available, but adversaries may create their own packing techniques that do not leave the same artifacts as well-known packers to evade defenses.(Citation: Awesome Executable Packing)
Near-miss passage: T1027.018 Invisible Unicode. Tactics: stealth. Description: Adversaries may abuse invisible or non-printing Unicode characters to conceal malicious content within files, scripts, or text. By inserting characters that do not visibly render, adversaries may hide data, alter how content is interpreted, or make malicious code appear as benign text or whitespace. Adversaries may encode these malicious payloads, using binary, Base64, or custom schemes, to be reconstructed at runtime through scripting features such as [JavaScript](https://attack.mitre.org/techniques/T1059/007) Proxy traps, `eval()`, or other dynamic execution methods. This technique enables adversaries to evade visual inspection and basic static analysis by hiding malicious encoded content in innocuous text.(Citation: PUAs Unicode - Eriksen)(Citation: Tycoon2FA - Unicode)(Citation: Unicode - Veracode) Unicode is a standardized character encoding model that assigns a unique numerical value, known as a code point, to every character across writing systems, enabling consistent text representation across platforms, applications, and languages. Code points are represented as `U+` followed by a hexadecimal value and may be encoded using formats such as `UTF-8` or `UTF-16`. Adversaries may abuse the valid code points in Unicode that are not visibly rendered but still take up bytes, such as zero-width spaces, variation selectors, or bidirectional formatting controls, to conceal malicious payloads.(Citation: Tycoon2FA - Unicode)(Citation: GlassWorm - Unicode)(Citation: Unicode and Hidden Prompts - Perets) Adversaries may additionally exploit Private Use Area (PUA) characters, a range of code points reserved for custom assignment. PUA characters that are not defined by a font or application are typically rendered blank.(Citation: PUAs Unicode - Eriksen) Unicode characters may also be leveraged in support of other techniques such as [Phishing](https://attack.mitre.org/techniques/T1660), [Right-to-Left Override](https://attack.mitre.org/techniques/T1036/002), or [User Executio
Query: Sigma YAML for linux / process_creation
Matching passage: Sigma rule: Detects when the file "passwd" or "shadow" is copied from tmp path. Logsource: linux / process_creation. Rule: title: Copy Passwd Or Shadow From TMP Path id: fa4aaed5-4fe0-498d-bbc0-08e3346387ba status: test description: Detects when the file "passwd" or "shadow" is copied from tmp path references: - https://blogs.blackberry.com/ - https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144 author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-01-31 tags: - attack.credential-access - attack.t1552.001 logsource: product: linux category: process_creation detection: selection_img: Image|endswith: /cp selection_path: CommandLine|contains: /tmp/ selection_file: CommandLine|contains: - passwd - shadow condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects AWS Config Service disabling. Logsource: aws / cloudtrail. Rule: title: AWS Config Disabling Channel/Recorder id: 07330162-dba1-4746-8121-a9647d49d297 status: test description: Detects AWS Config Service disabling references: - https://docs.aws.amazon.com/config/latest/developerguide/cloudtrail-log-files-for-aws-config.html author: vitaliy0x1 date: 2020-01-21 modified: 2022-10-09 tags: - attack.defense-impairment - attack.t1685.002 logsource: product: aws service: cloudtrail detection: selection: eventSource: config.amazonaws.com eventName: - DeleteDeliveryChannel - StopConfigurationRecorder condition: selection falsepositives: - Valid change in AWS Config Service level: high
Query: vulnerability: Multiple cross-site scripting (XSS) vulnerabilities in Web Reference Database (aka refbase) through 0.9.6 and bleeding-edge before 2015-01-08 allow remote attackers to inject arbit
Matching passage: CVE-2015-6010. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Web Reference Database (aka refbase) through 0.9.6 and bleeding-edge before 2015-01-08 allow remote attackers to inject arbitrary web script or HTML via the (1) errorNo or (2) errorMsg parameter to error.php; the (3) viewType parameter to duplicate_manager.php; the (4) queryAction, (5) displayType, (6) citeOrder, (7) sqlQuery, (8) showQuery, (9) showLinks, (10) showRows, or (11) queryID parameter to query_manager.php; the (12) sourceText or (13) sourceIDs parameter to import.php; or the (14) typeName or (15) fileName parameter to modify.php.
Near-miss passage: CVE-2015-5630. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the NTT Broadband Platform Japan Connected-free Wi-Fi application 1.6.0 and earlier for Android and 1.0.2 and earlier for iOS allows remote attackers to inject arbitrary web script or HTML via a crafted SSID.
Query: Sigma rule for Detects the Installation of a Exchange Transport Agent
Matching passage: Sigma rule: Detects the Installation of a Exchange Transport Agent. Logsource: windows / msexchange-management. Rule: title: MSExchange Transport Agent Installation - Builtin id: 4fe151c2-ecf9-4fae-95ae-b88ec9c2fca6 related: - id: 83809e84-4475-4b69-bc3e-4aad8568612f type: derived status: test description: Detects the Installation of a Exchange Transport Agent references: - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=7 author: Tobias Michalski (Nextron Systems) date: 2021-06-08 modified: 2022-11-27 tags: - attack.persistence - attack.t1505.002 logsource: product: windows service: msexchange-management detection: selection: - Install-TransportAgent condition: selection falsepositives: - Legitimate installations of exchange TransportAgents. AssemblyPath is a good indicator for this. level: medium
Near-miss passage: Sigma rule: Detects disabling of the "Automatic Sample Submission" feature of Windows Defender.. Logsource: windows / windefend. Rule: title: Windows Defender Submit Sample Feature Disabled id: 91903aba-1088-42ee-b680-d6d94fe002b0 related: - id: 1321dc4e-a1fe-481d-a016-52c45f0c8b4f type: similar - id: a3ab73f1-bd46-4319-8f06-4b20d0617886 type: similar - id: 801bd44f-ceed-4eb6-887c-11544633c0aa type: similar status: stable description: Detects disabling of the "Automatic Sample Submission" feature of Windows Defender. references: - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide - https://bidouillesecurity.com/disable-windows-defender-in-powershell/#DisableAntiSpyware author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-06 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: windefend detection: selection: EventID: 5007 NewValue|contains: \Real-Time Protection\SubmitSamplesConsent = 0x0 condition: selection falsepositives: - Administrator activity (must be investigated) level: low