alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection rule: Detects attempts to modify the registry using VBScript's CreateObject("Wscript.shell") and RegWrite methods embedded wit
Matching passage: Sigma rule: Detects attempts to modify the registry using VBScript's CreateObject("Wscript.shell") and RegWrite methods embedded wit. Logsource: windows / ps_script. Rule: title: Registry Modification Attempt Via VBScript - PowerShell id: 2a0a169d-cc66-43ce-9ae2-6e678e54e46a related: - id: 921aa10f-2e74-4cca-9498-98f9ca4d6fdf type: similar - id: 7f4c43f9-b1a5-4c7d-b24a-b41bf3a3ebf2 type: similar status: experimental description: 'Detects attempts to modify the registry using VBScript''s CreateObject("Wscript.shell") and RegWrite methods embedded within PowerShell scripts or commands. Threat actors commonly embed VBScript code within PowerShell to perform registry modifications, attempting to evade detection that monitors for direct registry access through traditional tools. This technique can be used for persistence, defense evasion, and privilege escalation by modifying registry keys without using regedit.exe, reg.exe, or PowerShell''s native registry cmdlets. ' references: - https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity-7344801774182051843-TE00/ - https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/ - https://detect.fyi/hunting-fileless-malware-in-the-windows-registry-1339ccde00ad date: 2025-08-13 author: Swachchhanda Shrawan Poudel (Nextron Systems) tags: - attack.persistence - attack.execution - attack.defense-impairment - attack.t1112 - attack.t1059.005 logsource: category: ps_script product: windows detection: selection: ScriptBlockText|contains|all: - CreateObject - Wscript.shell - .RegWrite condition: selection falsepositives: - Some legitimate admin or install scripts may use these processes for registry modifications. level: medium
Near-miss passage: Sigma rule: Identifies an event where there are there are too many accounts assigned the Global Administrator role.. Logsource: azure / pim. Rule: title: Too Many Global Admins id: 7bbc309f-e2b1-4eb1-8369-131a367d67d3 status: test description: Identifies an event where there are there are too many accounts assigned the Global Administrator role. references: - https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#there-are-too-many-global-administrators author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-14 tags: - attack.initial-access - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation logsource: product: azure service: pim detection: selection: riskEventType: tooManyGlobalAdminsAssignedToTenantAlertIncident condition: selection falsepositives: - Investigate if threshold setting in PIM is too low. level: high
Query: secure coding against Improper Protection of Alternate Path
Matching passage: CWE-424 Improper Protection of Alternate Path. The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.
Near-miss passage: CWE-228 Improper Handling of Syntactically Invalid Structure. The product does not handle or incorrectly handles input that is not syntactically well-formed with respect to the associated specification.
Query: common weakness: Incorrect Execution-Assigned Permissions
Matching passage: CWE-279 Incorrect Execution-Assigned Permissions. While it is executing, the product sets the permissions of an object in a way that violates the intended permissions that have been specified by the user.
Near-miss passage: CWE-509 Replicating Malicious Code (Virus or Worm). Replicating malicious code, including viruses and worms, will attempt to attack other systems once it has successfully compromised the target system or the product.
Query: vulnerability: Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a crafted command, a differ
Matching passage: CVE-2015-8519. CWE: CWE-119. CVSS: 9.800000190734863. Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a crafted command, a different vulnerability than CVE-2015-8520, CVE-2015-8521, and CVE-2015-8522.
Near-miss passage: CVE-2015-4409. CWE: CWE-119. CVSS: 6.5. Buffer overflow on Hikvision NVR DS-76xxNI-E1/2 and DS-77xxxNI-E4 devices before 3.4.0 allows remote authenticated users to cause a denial of service (service interruption) via a crafted HTTP request, aka the SDK issue.
Query: patch priority for CVE-2015-1794
Matching passage: CVE-2015-1794. CWE: CWE-189. CVSS: 5.0. The ssl3_get_key_exchange function in ssl/s3_clnt.c in OpenSSL 1.0.2 before 1.0.2e allows remote servers to cause a denial of service (segmentation fault) via a zero p value in an anonymous Diffie-Hellman (DH) ServerKeyExchange message.
Near-miss passage: CVE-2015-4625. CWE: CWE-189. CVSS: 4.599999904632568. Integer overflow in the authentication_agent_new_cookie function in PolicyKit (aka polkit) before 0.113 allows local users to gain privileges by creating a large number of connections, which triggers the issuance of a duplicate cookie value.
Query: vulnerability: The fill_buffer_resample function in util.c in libmp3lame.a in LAME 3.99.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via
Matching passage: CVE-2015-9100. CWE: CWE-476. CVSS: 5.5. The fill_buffer_resample function in util.c in libmp3lame.a in LAME 3.99.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted audio file.
Near-miss passage: CVE-2015-8926. CWE: CWE-476. CVSS: 5.5. The archive_read_format_rar_read_data function in archive_read_support_format_rar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted rar archive.
Query: describe CVE-2015-3002
Matching passage: CVE-2015-3002. CWE: CWE-17. CVSS: 6.900000095367432. Juniper Junos 12.1X44 before 12.1X44-D45, 12.1X46 before 12.1X46-D30, 12.1X47 before 12.1X47-D15, and 12.3X48 before 12.3X48-D10 on SRX series devices does not properly enforce the log-out-on-disconnect feature when configured in the [system port console] stanza, which allows physically proximate attackers to reconnect to the console port and gain administrative access by leveraging access to the device.
Near-miss passage: CVE-2015-4700. CWE: CWE-17. CVSS: 4.900000095367432. The bpf_int_jit_compile function in arch/x86/net/bpf_jit_comp.c in the Linux kernel before 4.0.6 allows local users to cause a denial of service (system crash) by creating a packet filter and then loading crafted BPF instructions that trigger late convergence by the JIT compiler.
Query: Sigma YAML for windows / security
Matching passage: Sigma rule: Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.. Logsource: windows / security. Rule: title: WMI Persistence - Security id: f033f3f3-fd24-4995-97d8-a3bb17550a88 related: - id: 0b7889b4-5577-4521-a60a-3376ee7f9f7b type: derived status: test description: Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs. references: - https://twitter.com/mattifestation/status/899646620148539397 - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/ author: Florian Roth (Nextron Systems), Gleb Sukhodolskiy, Timur Zinniatullin oscd.community date: 2017-08-22 modified: 2022-11-29 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.003 logsource: product: windows service: security detection: selection: EventID: 4662 ObjectType: WMI Namespace ObjectName|contains: subscription condition: selection falsepositives: - Unknown (data set is too small; further testing needed) level: medium
Near-miss passage: Sigma rule: Detects modifications to the "Hidden" and "ShowSuperHidden" explorer registry values in order to disable showing of hidd. Logsource: windows / registry_set. Rule: title: Displaying Hidden Files Feature Disabled id: 5a5152f1-463f-436b-b2f5-8eceb3964b42 status: test description: 'Detects modifications to the "Hidden" and "ShowSuperHidden" explorer registry values in order to disable showing of hidden files and system files. This technique is abused by several malware families to hide their files from normal users. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.001/T1564.001.md#atomic-test-8---hide-files-through-registry author: frack113 date: 2022-04-02 modified: 2024-03-26 tags: - attack.stealth - attack.t1564.001 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: - \Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden - \Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden Details: DWORD (0x00000000) condition: selection falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-6471
Matching passage: CVE-2015-6471. CWE: CWE-200. CVSS: 5.300000190734863. Eaton Cooper Power Systems ProView 4.x and 5.x before 5.1 on Form 6 controls and Idea and IdeaPLUS relays does not properly initialize padding fields in Ethernet packets, which allows remote attackers to obtain sensitive information by reading packet data.
Near-miss passage: CVE-2015-1314. CWE: CWE-200. CVSS: 2.0999999046325684. The USAA Mobile Banking application before 7.10.1 for Android displays the most recently-used screen before prompting the user for login, which might allow physically proximate users to obtain banking account numbers and balances.
Query: describe CVE-2015-4205
Matching passage: CVE-2015-4205. CWE: CWE-399. CVSS: 5.699999809265137. Cisco IOS XR 5.3.1 on ASR 9000 devices allows remote attackers to cause a denial of service (NPU chip reset or line-card reload) by sending crafted IEEE 802.3x flow-control PAUSE frames on the local network, aka Bug ID CSCut19959.
Near-miss passage: CVE-2015-0056. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1623 and CVE-2015-1626.
Query: vulnerability: The displayBlock function Template.php in Sensio Labs Twig before 1.20.0, when Sandbox mode is enabled, allows remote attackers to execute arbitrary code via the _self variable in 
Matching passage: CVE-2015-7809. CWE: CWE-264. CVSS: 6.800000190734863. The displayBlock function Template.php in Sensio Labs Twig before 1.20.0, when Sandbox mode is enabled, allows remote attackers to execute arbitrary code via the _self variable in a template.
Near-miss passage: CVE-2015-1643. CWE: CWE-264. CVSS: 7.199999809265137. Microsoft Windows Server 2003 R2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do not properly constrain impersonation levels, which allows local users to gain privileges via a crafted application, aka "NtCreateTransactionManager Type Confusion Vulnerability."
Query: exploit Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel for Mac 2011, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office 
Matching passage: CVE-2015-6122. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel for Mac 2011, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-8385. CWE: CWE-119. CVSS: 7.5. PCRE before 8.38 mishandles the /(?|(\k'Pm')|(?'Pm'))/ pattern and related patterns with certain forward references, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
Query: write Sigma for Detects the use of the "Get-ADComputer" cmdlet in order to identify systems which are configured for unconstrained deleg
Matching passage: Sigma rule: Detects the use of the "Get-ADComputer" cmdlet in order to identify systems which are configured for unconstrained deleg. Logsource: windows / ps_script. Rule: title: Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock id: cdfa73b6-3c9d-4bb8-97f8-ddbd8921f5c5 status: experimental description: Detects the use of the "Get-ADComputer" cmdlet in order to identify systems which are configured for unconstrained delegation. references: - https://pentestlab.blog/2022/03/21/unconstrained-delegation/ - https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-adcomputer?view=windowsserver2022-ps author: frack113 date: 2025-03-05 tags: - attack.reconnaissance - attack.discovery - attack.credential-access - attack.t1018 - attack.t1558 - attack.t1589.002 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enable' detection: selection: ScriptBlockText|contains: - -Properties*TrustedForDelegation - -Properties*TrustedToAuthForDelegation - -Properties*msDS-AllowedToDelegateTo - -Properties*PrincipalsAllowedToDelegateToAccount - -LDAPFilter*(userAccountControl:1.2.840.113556.1.4.803:=524288) condition: selection falsepositives: - Legitimate use of the library for administrative activity level: medium
Near-miss passage: Sigma rule: Detects changes to the "ExtErrorInformation" key in order to disable ETW logging for rpcrt4.dll. Logsource: windows / registry_set. Rule: title: ETW Logging Disabled For rpcrt4.dll id: 90f342e1-1aaa-4e43-b092-39fda57ed11e status: test description: Detects changes to the "ExtErrorInformation" key in order to disable ETW logging for rpcrt4.dll references: - http://redplait.blogspot.com/2020/07/whats-wrong-with-etw.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-09 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 - attack.t1685 logsource: product: windows category: registry_set detection: selection: TargetObject|endswith: \Microsoft\Windows NT\Rpc\ExtErrorInformation Details: - DWORD (0x00000000) - DWORD (0x00000002) condition: selection falsepositives: - Unknown level: low
Query: vulnerability: Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1.
Matching passage: CVE-2015-4085. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1.
Near-miss passage: CVE-2015-4666. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in opm/read_sessionlog.php in Xceedium Xsuite 2.4.4.5 and earlier allows remote attackers to read arbitrary files via a ....// (quadruple dot double slash) in the logFile parameter.
Query: exploit Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12.1 allows remote attackers to execute arbitrary code via a crafted packet, a diffe
Matching passage: CVE-2015-4933. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12.1 allows remote attackers to execute arbitrary code via a crafted packet, a different vulnerability than CVE-2015-4931, CVE-2015-4932, CVE-2015-4934, and CVE-2015-4935.
Near-miss passage: CVE-2015-9034. CWE: CWE-119. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a string can fail to be null-terminated in SIP leading to a buffer overflow.
Query: patch priority for CVE-2015-5075
Matching passage: CVE-2015-5075. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in X2Engine X2CRM before 5.2 allows remote attackers to hijack the authentication of administrators for requests that create an administrative account via a crafted request to index.php/users/create.
Near-miss passage: CVE-2015-1581. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the Mobile Domain plugin 1.5.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or conduct cross-site scripting (XSS) attacks via the (2) domain, (3) text, (4) font, (5) fontcolor, (6) color, or (7) padding parameter in an add-domain action in the mobile-domain page to wp-admin/options-general.php.
Query: exploit The Install Framework Legacy component in Apple OS X before 10.11 allows local users to obtain root privileges via vectors involving a privileged executable file.
Matching passage: CVE-2015-5888. CWE: CWE-264. CVSS: 7.199999809265137. The Install Framework Legacy component in Apple OS X before 10.11 allows local users to obtain root privileges via vectors involving a privileged executable file.
Near-miss passage: CVE-2015-3290. CWE: CWE-264. CVSS: 7.199999809265137. arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform improperly relies on espfix64 during nested NMI processing, which allows local users to gain privileges by triggering an NMI within a certain instruction window.
Query: vulnerability: Cisco ASR 5500 System Architecture Evolution (SAE) Gateway devices with software 19.1.0.61559 and 19.2.0 allow remote attackers to cause a denial of service (BGP process restart) v
Matching passage: CVE-2015-6351. CWE: CWE-20. CVSS: 5.0. Cisco ASR 5500 System Architecture Evolution (SAE) Gateway devices with software 19.1.0.61559 and 19.2.0 allow remote attackers to cause a denial of service (BGP process restart) via a crafted header in a BGP packet, aka Bug ID CSCuw65781.
Near-miss passage: CVE-2015-8373. CWE: CWE-20. CVSS: 6.800000190734863. The kea-dhcp4 and kea-dhcp6 servers 0.9.2 and 1.0.0-beta in ISC Kea, when certain debugging settings are used, allow remote attackers to cause a denial of service (daemon crash) via a malformed packet.
Query: explain CWE-379
Matching passage: CWE-379 Creation of Temporary File in Directory with Insecure Permissions. The product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.
Near-miss passage: CWE-42 Path Equivalence: 'filename.' (Trailing Dot). The product accepts path input in the form of trailing dot ('filedir.') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
Query: CVE similar to CVE-2015-8781
Matching passage: CVE-2015-8781. CWE: CWE-787. CVSS: 6.5. tif_luv.c in libtiff allows attackers to cause a denial of service (out-of-bounds write) via an invalid number of samples per pixel in a LogL compressed TIFF image, a different vulnerability than CVE-2015-8782.
Near-miss passage: CVE-2015-6696. CWE: CWE-787. CVSS: 6.800000190734863. Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-6698.
Query: describe CVE-2015-9267
Matching passage: CVE-2015-9267. CWE: CWE-269. CVSS: 5.5. Nullsoft Scriptable Install System (NSIS) before 2.49 uses temporary folder locations that allow unprivileged local users to overwrite files. This allows a local attack in which either a plugin or the uninstaller can be replaced by a Trojan horse program.
Near-miss passage: CVE-2015-5071. CWE: CWE-269. CVSS: 6.5. AR System Mid Tier in the AR System Mid Tier component before 9.0 SP1 for BMC Remedy AR System Server allows remote authenticated users to "navigate" to arbitrary files via the __report parameter of the BIRT viewer servlet.
Query: patch priority for CVE-2015-8357
Matching passage: CVE-2015-8357. CWE: CWE-22. CVSS: 6.5. Directory traversal vulnerability in the bitrix.xscan module before 1.0.4 for Bitrix allows remote authenticated users to rename arbitrary files, and consequently obtain sensitive information or cause a denial of service, via a .. (dot dot) in the file parameter to admin/bitrix.xscan_worker.php.
Near-miss passage: CVE-2015-2007. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in IBM Security QRadar SIEM 7.2.x before 7.2.5 Patch 6 allows remote authenticated users to read arbitrary files via a crafted URL.
Query: telemetry for T1135
Matching passage: T1135 Network Share Discovery. Tactics: discovery. Description: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network. File sharing over a Windows network occurs over the SMB protocol. (Citation: Wikipedia Shared Resource) (Citation: TechNet Shared Folder) [Net](https://attack.mitre.org/software/S0039) can be used to query a remote system for available shared drives using the <code>net view \\\\remotesystem</code> command. It can also be used to query shared drives on the local system using <code>net share</code>. For macOS, the <code>sharing -l</code> command lists all shared points used for smb services.
Near-miss passage: T1497 Virtualization/Sandbox Evasion. Tactics: stealth, discovery. Description: Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness) Adversaries may use several methods to accomplish [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) such as checking for security monitoring tools (e.g., Sysinternals, Wireshark, etc.) or other system artifacts associated with analysis or virtualization. Adversaries may also check for legitimate user activity to help determine if it is in an analysis environment. Additional methods include use of sleep timers or loops within malware code to avoid operating within a temporary sandbox.(Citation: Unit 42 Pirpi July 2015)