alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for linux / process_creation
Matching passage: Sigma rule: Detects execution of the "esxcli" command with the "vm" and "kill" flag in order to kill/shutdown a specific VM.. Logsource: linux / process_creation. Rule: title: ESXi VM Kill Via ESXCLI id: 2992ac4d-31e9-4325-99f2-b18a73221bb2 status: test description: Detects execution of the "esxcli" command with the "vm" and "kill" flag in order to kill/shutdown a specific VM. references: - https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/ - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vm.html - https://www.secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware/ - https://www.trendmicro.com/en_us/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html author: Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon date: 2023-09-04 tags: - attack.execution - attack.impact - attack.t1059.012 - attack.t1529 logsource: category: process_creation product: linux detection: selection: Image|endswith: /esxcli CommandLine|contains|all: - vm process - kill condition: selection falsepositives: - Legitimate administration activities level: medium
Near-miss passage: Sigma rule: Windows Test Authoring and Execution Framework (TAEF) framework allows you to run automation by executing tests files wr. Logsource: windows / process_creation. Rule: title: Malicious Windows Script Components File Execution by TAEF Detection id: 634b00d5-ccc3-4a06-ae3b-0ec8444dd51b status: test description: 'Windows Test Authoring and Execution Framework (TAEF) framework allows you to run automation by executing tests files written on different languages (C, C#, Microsoft COM Scripting interfaces Adversaries may execute malicious code (such as WSC file with VBScript, dll and so on) directly by running te.exe ' references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Te/ - https://twitter.com/pabraeken/status/993298228840992768 - https://learn.microsoft.com/en-us/windows-hardware/drivers/taef/ author: Agro (@agro_sev) oscd.community date: 2020-10-13 modified: 2021-11-27 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \te.exe - ParentImage|endswith: \te.exe - OriginalFileName: \te.exe condition: selection falsepositives: - It's not an uncommon to use te.exe directly to execute legal TAEF tests level: low
Query: CWE for Improper Handling of Overlap Between Protected Memory Ranges
Matching passage: CWE-1260 Improper Handling of Overlap Between Protected Memory Ranges. The product allows address regions to overlap, which can result in the bypassing of intended memory protection.
Near-miss passage: CWE-104 Struts: Form Bean Does Not Extend Validation Class. If a form bean does not extend an ActionForm subclass of the Validator framework, it can expose the application to other weaknesses related to insufficient input validation.
Query: campaign using Trusted Developer Utilities Proxy Execution
Matching passage: T1127 Trusted Developer Utilities Proxy Execution. Tactics: stealth, execution. Description: Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads. There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering.(Citation: engima0x3 DNX Bypass)(Citation: engima0x3 RCSI Bypass)(Citation: Exploit Monday WinDbg)(Citation: LOLBAS Tracker) These utilities may often be signed with legitimate certificates that allow them to execute on a system and proxy execution of malicious code through a trusted process that effectively bypasses application control solutions. Smart App Control is a feature of Windows that blocks applications it considers potentially malicious from running by verifying unsigned applications against a known safe list from a Microsoft cloud service before executing them.(Citation: Microsoft Smart App Control) However, adversaries may leverage "reputation hijacking" to abuse an operating system’s trust of safe, signed applications that support the execution of arbitrary code. By leveraging [Trusted Developer Utilities Proxy Execution](https://attack.mitre.org/techniques/T1127) to run their malicious code, adversaries may bypass Smart App Control protections.(Citation: Elastic Security Labs)
Near-miss passage: T1127.001 MSBuild. Tactics: stealth, execution. Description: Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio. It handles XML formatted project files that define requirements for loading and building various platforms and configurations.(Citation: MSDN MSBuild) Adversaries can abuse MSBuild to proxy execution of malicious code. The inline task capability of MSBuild that was introduced in .NET version 4 allows for C# or Visual Basic code to be inserted into an XML project file.(Citation: MSDN MSBuild)(Citation: Microsoft MSBuild Inline Tasks 2017) MSBuild will compile and execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is used this way it can execute arbitrary code and bypass application control defenses that are configured to allow MSBuild.exe execution.(Citation: LOLBAS Msbuild)
Query: patch priority for CVE-2015-1781
Matching passage: CVE-2015-1781. CWE: CWE-119. CVSS: 6.800000190734863. Buffer overflow in the gethostbyname_r and other unspecified NSS functions in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response, which triggers a call with a misaligned buffer.
Near-miss passage: CVE-2015-7860. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in the agent in Persistent Accelerite Radia Client Automation (formerly HP Client Automation), possibly before 9.1, allows remote attackers to execute arbitrary code by sending a large amount of data in an environment that lacks relationship-based firewalling.
Query: exploit Unspecified vulnerability in Oracle Java SE 8u40 allows remote attackers to affect integrity via unknown vectors related to Hotspot.
Matching passage: CVE-2015-0470. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in Oracle Java SE 8u40 allows remote attackers to affect integrity via unknown vectors related to Hotspot.
Near-miss passage: CVE-2015-0306. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0303.
Query: explain CWE-267
Matching passage: CWE-267 Privilege Defined With Unsafe Actions. A particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity.
Near-miss passage: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'). The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Query: explain CWE-1069
Matching passage: CWE-1069 Empty Exception Block. An invokable code block contains an exception handling block that does not contain any code, i.e. is empty.
Near-miss passage: CWE-323 Reusing a Nonce, Key Pair in Encryption. Nonces should be used for the present occasion and only once.
Query: exploit Unspecified vulnerability in Oracle MySQL Server 5.6.21 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer.
Matching passage: CVE-2015-0409. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.6.21 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer.
Near-miss passage: CVE-2015-2473. CWE: UNKNOWN. CVSS: 9.300000190734863. Untrusted search path vulnerability in the client in Remote Desktop Protocol (RDP) through 8.1 in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .rdp file, aka "Remote Desktop Protocol DLL Planting Remote Code Execution Vulnerability."
Query: vulnerability: IBM Emptoris Contract Management 9.5.0.x before 9.5.0.6 iFix15, 10.0.0.x and 10.0.1.x before 10.0.1.5 iFix5, 10.0.2.x before 10.0.2.7 iFix4, and 10.0.4.x before 10.0.4.0 iFix3 allo
Matching passage: CVE-2015-5042. CWE: CWE-20. CVSS: 7.5. IBM Emptoris Contract Management 9.5.0.x before 9.5.0.6 iFix15, 10.0.0.x and 10.0.1.x before 10.0.1.5 iFix5, 10.0.2.x before 10.0.2.7 iFix4, and 10.0.4.x before 10.0.4.0 iFix3 allows remote attackers to execute arbitrary code by including a crafted Flash file.
Near-miss passage: CVE-2015-6563. CWE: CWE-20. CVSS: 6.400000095367432. The monitor component in sshd in OpenSSH before 7.0 on non-OpenBSD platforms accepts extraneous username data in MONITOR_REQ_PAM_INIT_CTX requests, which allows local users to conduct impersonation attacks by leveraging any SSH login access in conjunction with control of the sshd uid to send a crafted MONITOR_REQ_PWNAM request, related to monitor.c and monitor_wrap.c.
Query: Outbound C2 pattern associated with Dead Drop Resolver
Matching passage: T1102.001 Dead Drop Resolver. Tactics: command and control. Description: Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of a dead drop resolver may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).
Near-miss passage: T1102.003 One-Way Communication. Tactics: command and control. Description: Adversaries may use an existing, legitimate external Web service as a means for sending commands to a compromised system without receiving return output over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems may opt to send the output from those commands back over a different C2 channel, including to another distinct Web service. Alternatively, compromised systems may return no output at all in cases where adversaries want to send instructions to systems and do not want a response. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Query: Sigma rule for Detects renamed execution of "Microsoft.NodejsTools.PressAnyKey.exe", which can be abused as a LOLBIN to execute arbitra
Matching passage: Sigma rule: Detects renamed execution of "Microsoft.NodejsTools.PressAnyKey.exe", which can be abused as a LOLBIN to execute arbitra. Logsource: windows / process_creation. Rule: title: Visual Studio NodejsTools PressAnyKey Renamed Execution id: 65c3ca2c-525f-4ced-968e-246a713d164f related: - id: a20391f8-76fb-437b-abc0-dba2df1952c6 type: similar status: test description: Detects renamed execution of "Microsoft.NodejsTools.PressAnyKey.exe", which can be abused as a LOLBIN to execute arbitrary binaries references: - https://twitter.com/mrd0x/status/1463526834918854661 - https://gist.github.com/nasbench/a989ce64cefa8081bd50cf6ad8c491b5 author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems) date: 2023-04-11 tags: - attack.execution - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: OriginalFileName: Microsoft.NodejsTools.PressAnyKey.exe filter_main_legit_name: Image|endswith: \Microsoft.NodejsTools.PressAnyKey.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Monitors for the hiding possible malicious files in the C:\Windows\Fonts\ location. This folder doesn't require admin pr. Logsource: windows / process_creation. Rule: title: Writing Of Malicious Files To The Fonts Folder id: ae9b0bd7-8888-4606-b444-0ed7410cb728 status: test description: Monitors for the hiding possible malicious files in the C:\Windows\Fonts\ location. This folder doesn't require admin privillege to be written and executed from. references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ author: Sreeman date: 2020-04-21 modified: 2022-03-08 tags: - attack.stealth - attack.t1211 - attack.t1059 - attack.persistence - attack.execution logsource: product: windows category: process_creation detection: selection_1: CommandLine|contains: - echo - copy - type - file createnew - cacls selection_2: CommandLine|contains: C:\Windows\Fonts\ selection_3: CommandLine|contains: - .sh - .exe - .dll - .bin - .bat - .cmd - .js - .msh - .reg - .scr - .ps - .vb - .jar - .pl - '.inf' - .cpl - .hta - .msi - .vbs condition: all of selection_* falsepositives: - Unknown level: medium
Query: alert when Detects the WMI Event Consumer service scrcons.exe creating a named pipe
Matching passage: Sigma rule: Detects the WMI Event Consumer service scrcons.exe creating a named pipe. Logsource: windows / pipe_created. Rule: title: WMI Event Consumer Created Named Pipe id: 493fb4ab-cdcc-4c4f-818c-0e363bd1e4bb status: test description: Detects the WMI Event Consumer service scrcons.exe creating a named pipe references: - https://github.com/RiccardoAncarani/LiquidSnake author: Florian Roth (Nextron Systems) date: 2021-09-01 modified: 2023-11-30 tags: - attack.t1047 - attack.execution logsource: product: windows category: pipe_created definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection: Image|endswith: \scrcons.exe condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the presence of a registry key created during Azorult execution. Logsource: windows / registry_event. Rule: title: Registry Entries For Azorult Malware id: f7f9ab88-7557-4a69-b30e-0a8f91b3a0e7 status: test description: Detects the presence of a registry key created during Azorult execution references: - https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.azoruit.a author: Trent Liffick date: 2020-05-08 modified: 2021-11-27 tags: - attack.persistence - attack.execution - attack.defense-impairment - attack.t1112 logsource: product: windows category: registry_event detection: selection: EventID: - 12 - 13 TargetObject|contains: SYSTEM\ TargetObject|endswith: \services\localNETService condition: selection falsepositives: - Unknown level: critical
Query: weakness Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created
Matching passage: CWE-593 Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created. The product modifies the SSL context after connection creation has begun.
Near-miss passage: CWE-483 Incorrect Block Delimitation. The code does not explicitly delimit a block that is intended to contain 2 or more statements, creating a logic error.
Query: alert when Detects usage of winget to add new potentially suspicious download sources
Matching passage: Sigma rule: Detects usage of winget to add new potentially suspicious download sources. Logsource: windows / process_creation. Rule: title: Add Potential Suspicious New Download Source To Winget id: c15a46a0-07d4-4c87-b4b6-89207835a83b related: - id: 05ebafc8-7aa2-4bcd-a269-2aec93f9e842 type: similar - id: 81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2 type: similar status: test description: Detects usage of winget to add new potentially suspicious download sources references: - https://learn.microsoft.com/en-us/windows/package-manager/winget/source - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-17 modified: 2023-12-04 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \winget.exe - OriginalFileName: winget.exe selection_cli: CommandLine|contains|all: - 'source ' - 'add ' selection_source_direct_ip: CommandLine|re: ://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects suspicious file writes to the root directory of web applications, particularly Apache web servers or Tomcat serv. Logsource: windows / file_event. Rule: title: Suspicious File Write to Webapps Root Directory id: 89c42960-f244-4dad-9151-ae9b1a3287a2 status: experimental description: 'Detects suspicious file writes to the root directory of web applications, particularly Apache web servers or Tomcat servers. This may indicate an attempt to deploy malicious files such as web shells or other unauthorized scripts. ' references: - https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-10-20 tags: - attack.persistence - attack.t1505.003 - attack.initial-access - attack.t1190 logsource: product: windows category: file_event detection: selection_susp_img: Image|endswith: - \dotnet.exe - \w3wp.exe - \java.exe selection_servers: TargetFilename|contains: - \apache - \tomcat selection_path: TargetFilename|contains: \webapps\ROOT\ selection_susp_extensions: TargetFilename|endswith: .jsp condition: all of selection_* falsepositives: - Unknown level: medium
Query: rule covering Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. This activit
Matching passage: Sigma rule: Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. This activit. Logsource: aws / cloudtrail. Rule: title: AWS KMS Imported Key Material Usage id: 1279262f-1464-422f-ac0d-5b545320c526 status: experimental description: 'Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. This activity is uncommon and provides a high certainty signal. ' references: - https://www.chrisfarris.com/post/effective-aws-ransomware/ - https://docs.aws.amazon.com/kms/latest/developerguide/ct-importkeymaterial.html - https://docs.aws.amazon.com/kms/latest/developerguide/ct-deleteimportedkeymaterial.html author: toopricey date: 2025-10-18 tags: - attack.impact - attack.t1486 - attack.resource-development - attack.t1608.003 logsource: product: aws service: cloudtrail detection: selection: eventSource: kms.amazonaws.com eventName: - ImportKeyMaterial - DeleteImportedKeyMaterial condition: selection falsepositives: - Legitimate use cases for imported key material are rare, but may include, Organizations with hybrid cloud architectures that import external key material for compliance requirements. - Development or testing environments that simulate external key management scenarios. Even in these cases, such activity is typically infrequent and should not add significant noise. level: high
Near-miss passage: Sigma rule: Detects creation of the Process Explorer drivers by processes other than Process Explorer (procexp) itself. Hack tools o. Logsource: windows / file_event. Rule: title: Process Explorer Driver Creation By Non-Sysinternals Binary id: de46c52b-0bf8-4936-a327-aace94f94ac6 status: test description: 'Detects creation of the Process Explorer drivers by processes other than Process Explorer (procexp) itself. Hack tools or malware may use the Process Explorer driver to elevate privileges, drops it to disk for a few moments, runs a service using that driver and removes it afterwards. ' references: - https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer - https://github.com/Yaxser/Backstab - https://www.elastic.co/security-labs/stopping-vulnerable-driver-attacks - https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/ author: Florian Roth (Nextron Systems) date: 2023-05-05 modified: 2026-06-29 tags: - attack.persistence - attack.privilege-escalation - attack.t1068 logsource: product: windows category: file_event detection: selection: TargetFilename|contains: \PROCEXP TargetFilename|endswith: .sys filter_main_process_explorer: Image|endswith: - \procexp.exe - \procexp64.exe - \procexp64a.exe condition: selection and not 1 of filter_main_* falsepositives: - Some false positives may occur with legitimate renamed process explorer binaries level: high
Query: CVE similar to CVE-2015-0534
Matching passage: CVE-2015-0534. CWE: CWE-295. CVSS: 7.5. EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.8 and 4.1.x before 4.1.3, RSA BSAFE Crypto-J before 6.2, RSA BSAFE SSL-J before 6.2, and RSA BSAFE SSL-C 2.8.9 and earlier do not enforce certain constraints on certificate data, which allows remote attackers to defeat a fingerprint-based certificate-blacklist protection mechanism by including crafted data within a certificate's unsigned portion, a similar issue to CVE-2014-8275.
Near-miss passage: CVE-2015-7785. CWE: CWE-295. CVSS: 5.900000095367432. GANMA! App for iOS does not verify SSL certificates.
Query: risk of Red Hat OpenShift Enterprise 3.0.0.0 does not properly check permissions, which allows remote authenticated users with build permissions to execute arbitrary shell commands with ro
Matching passage: CVE-2015-5222. CWE: CWE-264. CVSS: 8.5. Red Hat OpenShift Enterprise 3.0.0.0 does not properly check permissions, which allows remote authenticated users with build permissions to execute arbitrary shell commands with root permissions on arbitrary build pods via unspecified vectors.
Near-miss passage: CVE-2015-8965. CWE: CWE-264. CVSS: 9.800000190734863. Rogue Wave JViews before 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to execute arbitrary Java code that exists in the classpath, such as test code or administration code. The issue exists because the ilog.views.faces.IlvFacesController servlet in jviews-framework-all.jar does not require explicit configuration of servlets that can be called.