alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects GitHub self-hosted runners executing workflows on local infrastructure that could be abused for persistence and. Logsource: windows / process_creation. Rule: title: Github Self-Hosted Runner Execution id: 5bac7a56-da88-4c27-922e-c81e113b20cb status: test description: 'Detects GitHub self-hosted runners executing workflows on local infrastructure that could be abused for persistence and code execution. Shai-Hulud is an npm supply chain worm targeting CI/CD environments. It installs runners on compromised systems to maintain access after credential theft, leveraging their access to secrets and internal networks. ' references: - https://about.gitlab.com/blog/gitlab-discovers-widespread-npm-supply-chain-attack/ - https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/ author: Daniel Koifman (KoifSec) date: 2025-11-29 tags: - attack.command-and-control - attack.t1102.002 - attack.t1071 logsource: category: process_creation product: windows detection: selection_worker_img: - Image|endswith: \Runner.Worker.exe - OriginalFileName: Runner.Worker.dll selection_worker_cli: CommandLine|contains: spawnclient selection_listener_img: - Image|endswith: \Runner.Listener.exe - OriginalFileName: Runner.Listener.dll selection_listener_cli: CommandLine|contains: - run - configure condition: all of selection_worker_* or all of selection_listener_* falsepositives: - Legitimate GitHub self-hosted runner installations on designated CI/CD infrastructure - Authorized runner deployments by DevOps/Platform teams following change management - Scheduled runner updates or reconfigurations on existing build agents - Self-hosted runners that follow expected/known naming patterns - Installation via expected/known configuration management tools (reflected mostly as parent process name) level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_github_self_hosted_runner/info.yml
Near-miss passage: Sigma rule: Detects the execution of a specific OneLiner to download and execute powershell modules in memory.. Logsource: windows / process_creation. Rule: title: Obfuscated PowerShell OneLiner Execution id: 44e24481-6202-4c62-9127-5a0ae8e3fe3d status: test description: Detects the execution of a specific OneLiner to download and execute powershell modules in memory. references: - https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/ - https://gist.github.com/mgeeky/3b11169ab77a7de354f4111aa2f0df38 author: '@Kostastsale, TheDFIRReport' date: 2022-05-09 modified: 2025-04-16 tags: - attack.execution - attack.defense-impairment - attack.t1059.001 - attack.t1685 logsource: product: windows category: process_creation detection: selection: Image|endswith: \powershell.exe CommandLine|contains|all: - http://127.0.0.1 - '%{(IRM $_)}' - Invoke condition: selection falsepositives: - Unknown level: high
Query: risk of HP ArcSight Logger before 6.0 P2 allows remote authenticated users to bypass the intended authorization policy via unspecified vectors.
Matching passage: CVE-2015-2136. CWE: CWE-200. CVSS: 4.0. HP ArcSight Logger before 6.0 P2 allows remote authenticated users to bypass the intended authorization policy via unspecified vectors.
Near-miss passage: CVE-2015-5335. CWE: CWE-200. CVSS: 4.300000190734863. Cross-site request forgery (CSRF) vulnerability in admin/registration/register.php in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allows remote attackers to hijack the authentication of administrators for requests that send statistics to an arbitrary hub URL.
Query: vulnerability: The accurate-form-data-real-time-form-validation plugin 1.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=Accu_Data_WP.
Matching passage: CVE-2015-9443. CWE: CWE-352. CVSS: 6.5. The accurate-form-data-real-time-form-validation plugin 1.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=Accu_Data_WP.
Near-miss passage: CVE-2015-9434. CWE: CWE-352. CVSS: 6.5. The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=kwlogos&page=kwlogos_settings tab or tab_flags_order parameter.
Query: risk of The fs_pin implementation in the Linux kernel before 4.0.5 does not ensure the internal consistency of a certain list data structure, which allows local users to cause a denial of 
Matching passage: CVE-2015-4178. CWE: UNKNOWN. CVSS: 5.5. The fs_pin implementation in the Linux kernel before 4.0.5 does not ensure the internal consistency of a certain list data structure, which allows local users to cause a denial of service (system crash) by leveraging user-namespace root access for an MNT_DETACH umount2 system call, related to fs/fs_pin.c and include/linux/fs_pin.h.
Near-miss passage: CVE-2015-8765. CWE: UNKNOWN. CVSS: 8.300000190734863. Intel McAfee ePolicy Orchestrator (ePO) 4.6.9 and earlier, 5.0.x, 5.1.x before 5.1.3 Hotfix 1106041, and 5.3.x before 5.3.1 Hotfix 1106041 allow remote attackers to execute arbitrary code via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
Query: indicators of Non-Standard Port
Matching passage: T1571 Non-Standard Port. Tactics: command and control. Description: Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data. Adversaries may also make changes to victim systems to abuse non-standard ports. For example, Registry keys and other configuration settings can be used to modify protocol and port pairings.(Citation: change_rdp_port_conti)
Near-miss passage: T1568 Dynamic Resolution. Tactics: command and control. Description: Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control. Adversaries may use dynamic resolution for the purpose of [Fallback Channels](https://attack.mitre.org/techniques/T1008). When contact is lost with the primary command and control server malware may employ dynamic resolution as a means to reestablishing command and control.(Citation: Talos CCleanup 2017)(Citation: FireEye POSHSPY April 2017)(Citation: ESET Sednit 2017 Activity)
Query: patch priority for CVE-2015-6655
Matching passage: CVE-2015-6655. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Pligg CMS 2.0.2 allows remote attackers to hijack the authentication of administrators for requests that add an administrator via a request to admin/admin_users.php.
Near-miss passage: CVE-2015-0541. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in EMC RSA Web Threat Detection before 5.1 allows remote attackers to hijack the authentication of arbitrary users.
Query: Sigma rule for Detects attempts to delete Internet Information Services (IIS) log files via command line utilities, which is a common d
Matching passage: Sigma rule: Detects attempts to delete Internet Information Services (IIS) log files via command line utilities, which is a common d. Logsource: windows / process_creation. Rule: title: IIS WebServer Log Deletion via CommandLine Utilities id: 0649be4a-aeb0-45b0-b89e-7f1668f6d9c0 related: - id: 3eb8c339-a765-48cc-a150-4364c04652bf type: similar status: experimental description: 'Detects attempts to delete Internet Information Services (IIS) log files via command line utilities, which is a common defense evasion technique used by attackers to cover their tracks. Threat actors often abuse vulnerabilities in web applications hosted on IIS servers to gain initial access and later delete IIS logs to evade detection. ' references: - https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/managing-iis-log-file-storage author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-09-02 tags: - attack.stealth - attack.t1070 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \cmd.exe - \powershell_ise.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - cmd.exe - powershell.exe - powershell_ise.exe - pwsh.dll selection_cli_del: CommandLine|contains: - 'del ' - 'erase ' - 'rm ' - 'remove-item ' - 'rmdir ' selection_cli_iis_dir: CommandLine|contains: \inetpub\logs\ condition: all of selection_* falsepositives: - Deletion of IIS logs that are older than a certain retention period as part of regular maintenance activities. - Legitimate schedule tasks or scripts that clean up log files regularly. level: medium
Near-miss passage: Sigma rule: Detects non-system users failing to get a handle of the SCM database.. Logsource: windows / security. Rule: title: SCM Database Handle Failure id: 13addce7-47b2-4ca0-a98f-1de964d1d669 status: test description: Detects non-system users failing to get a handle of the SCM database. references: - https://threathunterplaybook.com/hunts/windows/190826-RemoteSCMHandle/notebook.html author: Roberto Rodriguez @Cyb3rWard0g date: 2019-08-12 modified: 2022-07-11 tags: - attack.discovery - attack.t1010 logsource: product: windows service: security detection: selection: EventID: 4656 ObjectType: SC_MANAGER OBJECT ObjectName: ServicesActive AccessMask: '0xf003f' filter: SubjectLogonId: '0x3e4' condition: selection and not filter falsepositives: - Unknown level: medium
Query: risk of A vulnerability classified as critical has been found in arekk uke. This affects an unknown part of the file lib/uke/finder.rb. The manipulation leads to sql injection. The identif
Matching passage: CVE-2015-10014. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability classified as critical has been found in arekk uke. This affects an unknown part of the file lib/uke/finder.rb. The manipulation leads to sql injection. The identifier of the patch is 52fd3b2d0bc16227ef57b7b98a3658bb67c1833f. It is recommended to apply a patch to fix this issue. The identifier VDB-217485 was assigned to this vulnerability.
Near-miss passage: CVE-2015-6659. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the SQL comment filtering system in the Database API in Drupal 7.x before 7.39 allows remote attackers to execute arbitrary SQL commands via an SQL comment.
Query: patch priority for CVE-2015-7279
Matching passage: CVE-2015-7279. CWE: UNKNOWN. CVSS: 5.300000190734863. Amped Wireless R10000 devices with firmware 2.5.2.11 use an improper algorithm for selecting the ID value in the header of a DNS query, which makes it easier for remote attackers to spoof responses by predicting this value.
Near-miss passage: CVE-2015-0318. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0314, CVE-2015-0316, CVE-2015-0321, CVE-2015-0329, and CVE-2015-0330.
Query: Persistence mechanism resembling Exfiltration Over Bluetooth
Matching passage: T1011.001 Exfiltration Over Bluetooth. Tactics: exfiltration. Description: Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel. If the command and control network is a wired Internet connection, an adversary may opt to exfiltrate data using a Bluetooth communication channel. Adversaries may choose to do this if they have sufficient access and proximity. Bluetooth connections might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.
Near-miss passage: T1011 Exfiltration Over Other Network Medium. Tactics: exfiltration. Description: Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel. If the command and control network is a wired Internet connection, the exfiltration may occur, for example, over a WiFi connection, modem, cellular data connection, Bluetooth, or another radio frequency (RF) channel. Adversaries may choose to do this if they have sufficient access or proximity, and the connection might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.
Query: mitigate Defacement
Matching passage: T1491 Defacement. Tactics: impact. Description: Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content. Reasons for [Defacement](https://attack.mitre.org/techniques/T1491) include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion. Disturbing or offensive images may be used as a part of [Defacement](https://attack.mitre.org/techniques/T1491) in order to cause user discomfort, or to pressure compliance with accompanying messages.
Near-miss passage: T1491.001 Internal Defacement. Tactics: impact. Description: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems. This may take the form of modifications to internal websites or server login messages, or directly to user systems with the replacement of the desktop wallpaper.(Citation: Novetta Blockbuster)(Citation: Varonis) Disturbing or offensive images may be used as a part of [Internal Defacement](https://attack.mitre.org/techniques/T1491/001) in order to cause user discomfort, or to pressure compliance with accompanying messages. Since internally defacing systems exposes an adversary's presence, it often takes place after other intrusion goals have been accomplished.(Citation: Novetta Blockbuster Destructive Malware)
Query: risk of Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous befo
Matching passage: CVE-2015-6694. CWE: CWE-119. CVSS: 6.800000190734863. Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted use of the fillColor attribute, a different vulnerability than CVE-2015-6685, CVE-2015-6686, CVE-2015-6693, CVE-2015-6695, and CVE-2015-7622.
Near-miss passage: CVE-2015-8683. CWE: CWE-119. CVSS: 5.5. The putcontig8bitCIELab function in tif_getimage.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via a packed TIFF image.
Query: rule covering Detect set DisallowRun to 1 to prevent user running specific computer program
Matching passage: Sigma rule: Detect set DisallowRun to 1 to prevent user running specific computer program. Logsource: windows / registry_set. Rule: title: Add DisallowRun Execution to Registry id: 275641a5-a492-45e2-a817-7c81e9d9d3e9 status: test description: Detect set DisallowRun to 1 to prevent user running specific computer program references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1112/T1112.md author: frack113 date: 2022-08-19 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun Details: DWORD (0x00000001) condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Office application called wmic to proxye execution through a LOLBIN process. This is often used to break suspicious pare. Logsource: windows / process_creation. Rule: title: Suspicious WMIC Execution Via Office Process id: e1693bc8-7168-4eab-8718-cdcaa68a1738 related: - id: 438025f9-5856-4663-83f7-52f878a70a50 type: derived - id: 518643ba-7d9c-4fa5-9f37-baed36059f6a type: obsolete - id: 9d1c72f5-43f0-4da5-9320-648cf2099dd0 type: obsolete - id: c0e1c3d5-4381-4f18-8145-2583f06a1fe5 type: obsolete - id: 04f5363a-6bca-42ff-be70-0d28bf629ead type: obsolete status: test description: Office application called wmic to proxye execution through a LOLBIN process. This is often used to break suspicious parent-child chain (Office app spawns LOLBin). references: - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ - https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml author: Vadim Khrykov, Cyb3rEng date: 2021-08-23 modified: 2023-02-14 tags: - attack.stealth - attack.t1204.002 - attack.t1047 - attack.t1218.010 - attack.execution logsource: product: windows category: process_creation detection: selection_parent: ParentImage|endswith: - \WINWORD.EXE - \EXCEL.EXE - \POWERPNT.exe - \MSPUB.exe - \VISIO.exe - \MSACCESS.EXE - \EQNEDT32.EXE - \ONENOTE.EXE - \wordpad.exe - \wordview.exe selection_wmic_img: - Image|endswith: \wbem\WMIC.exe - OriginalFileName: wmic.exe selection_wmic_cli: CommandLine|contains|all: - process - create - call CommandLine|contains: - regsvr32 - rundll32 - msiexec - mshta - verclsid - wscript - cscript condition: all of selection_* falsepositives: - Unknown level: high
Query: vulnerability: Cisco Application Policy Infrastructure Controller (APIC) devices with software before 1.0(3o) and 1.1 before 1.1(1j) and Nexus 9000 ACI devices with software before 11.0(4o) and 1
Matching passage: CVE-2015-4235. CWE: CWE-264. CVSS: 9.0. Cisco Application Policy Infrastructure Controller (APIC) devices with software before 1.0(3o) and 1.1 before 1.1(1j) and Nexus 9000 ACI devices with software before 11.0(4o) and 11.1 before 11.1(1j) do not properly restrict access to the APIC filesystem, which allows remote authenticated users to obtain root privileges via unspecified use of the APIC cluster-management configuration feature, aka Bug IDs CSCuu72094 and CSCuv11991.
Near-miss passage: CVE-2015-5005. CWE: CWE-264. CVSS: 8.5. CSPOC in IBM PowerHA SystemMirror on AIX 6.1 and 7.1 allows remote authenticated users to perform an "su root" action by leveraging presence on the cluster-wide password-change list.
Query: exploit Multiple eval injection vulnerabilities in mods/_standard/gradebook/edit_marks.php in ATutor 2.2 and earlier allow remote authenticated users with the AT_PRIV_GRADEBOOK privilege t
Matching passage: CVE-2015-7712. CWE: UNKNOWN. CVSS: 6.5. Multiple eval injection vulnerabilities in mods/_standard/gradebook/edit_marks.php in ATutor 2.2 and earlier allow remote authenticated users with the AT_PRIV_GRADEBOOK privilege to execute arbitrary PHP code via the (1) asc or (2) desc parameter.
Near-miss passage: CVE-2015-4896. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 4.0.34, 4.1.42, 4.2.34, 4.3.32, and 5.0.8, when a VM has the Remote Display feature (RDP) enabled, allows remote attackers to affect availability via unknown vectors related to Core.
Query: common weakness: Incorrect Control Flow Scoping
Matching passage: CWE-705 Incorrect Control Flow Scoping. The product does not properly return control flow to the proper location after it has completed a task or detected an unusual condition.
Near-miss passage: CWE-482 Comparing instead of Assigning. The code uses an operator for comparison when the intention was to perform an assignment.
Query: exploit Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or caus
Matching passage: CVE-2015-0329. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0314, CVE-2015-0316, CVE-2015-0318, CVE-2015-0321, and CVE-2015-0330.
Near-miss passage: CVE-2015-0439. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.6.22 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB, a different vulnerability than CVE-2015-4756.
Query: vulnerability: In Soap Lite (aka the SOAP::Lite extension for Perl) 1.14 and earlier, an example attack consists of defining 10 or more XML entities, each defined as consisting of 10 of the previ
Matching passage: CVE-2015-8978. CWE: CWE-399. CVSS: 7.5. In Soap Lite (aka the SOAP::Lite extension for Perl) 1.14 and earlier, an example attack consists of defining 10 or more XML entities, each defined as consisting of 10 of the previous entity, with the document consisting of a single instance of the largest entity, which expands to one billion copies of the first entity. The amount of computer memory used for handling an external SOAP call would likely exceed that available to the process parsing the XML.
Near-miss passage: CVE-2015-6321. CWE: CWE-399. CVSS: 7.800000190734863. Cisco AsyncOS before 8.5.7-042, 9.x before 9.1.0-032, 9.1.x before 9.1.1-023, and 9.5.x and 9.6.x before 9.6.0-042 on Email Security Appliance (ESA) devices; before 9.1.0-032, 9.1.1 before 9.1.1-005, and 9.5.x before 9.5.0-025 on Content Security Management Appliance (SMA) devices; and before 7.7.0-725 and 8.x before 8.0.8-113 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (memory consumption) via a flood of TCP packets, aka Bug IDs CSCus79774, CSCus79777, and CSCzv95795.